"5 big security mistakes you're probably making"

March 13, 2012 By Roger A. Grimes | InfoWorld

A Comment...

Mr. Grimes often speaks of patching. In the world of Microsoft and other proprietary software, I know of little other choice as a first line of defense. That's a big reason I took back my computers from Microsoft, et.al. a few years ago.

Most businesses can't do that since they've decided they like comercial software companies running their business. They no longer maintain the in-house expertise to have secure systems.

Commercial, proprietary, closed-source software can never be secure.

What about the military, NSA, etc. which have some of the most secure systems in existence? Those are all developed in-house or by contractors to exacting specifications (That's why they cost so much). Those institutions have the source code to everything mission-critical they run and they isolate what little commercial software they have.

There have been so many Windows patches that I doubt anyone but Microsoft has a count. But think about this... Every one of those flaws was either present from the initial release or introduced by a previous patch!

Thus, the vast majority of vulnerabilities over the lifetime of any program will always be uncorrected. And the number of person-hours spent looking for vulnerabilities to exploit dwarfs the person-hours that Microsoft or any other company can afford to devote to patching.

How can we have reasonably secure systems then?

The only way I know of is open-source software.

Here's an analogy... Most theft occurs at night, when the lights are off and the theif can't be seen. The first line of defense for a storefront is to leave lights on when the store is closed so police and everyone else can see inside.

Closed-sourcing hides the software's errors from everyone but those with the skill and motivation to exploit them.

Companies will never have secure systems till they realize that the United States can never compete with developing countries on price. Trying to by outsourcing and using commercial software have been short-sighted.

When they take back control of their computer systems -- the engine their entire business depends on -- they will once again be able to compete the only way a country with our standard of living can... with innovation.
  

"Still don't think open source hurts commercial software? Guess again"

January 18, 2012 By Paul Krill | InfoWorld

A Comment...

Open Source is becoming a radical challenge for premium software companies that depend on what are now exorbitant prices.

These companies have been built on the cornerstone of customer lock-in. Once deployed, their large, complex, expensive products are usually too unwieldy and too costy to replace except as part of a massive system architecture upgrade as we were forced to do for Y2K.

How can a company excel if it's not free to do things differently from its competition? The high cost of enhancements to one of these installations keep most somewhere near the basic package. This stifles innovation and competitiveness.

In short, these premium companies have priced themselves out of the market.

Open Source software, while free in initial price, does have costs that many a CIO has yet to appreciate. Though at least as reliable (usually more so) as its commercial counterparts, Open Source software is largely developed by and for programmers and thus requires a deeper level programming and system administration expertise to maintain. That usually means more, and more experienced, and thus more expensive staff.

Here are two simple rules of thumb in deciding between commercial and open source software...

ONE...
If you have more money than expertise, buy commercial.

If you have more expertise than money, use open source.

TWO...
If software in no way effects your competitiveness, buy commercial like everyone else.

If software can in any way effect your competitiveness, use open source for the freedom it gives you to innovate.

By Extension

December 18, 2011 by Robert C. Watson

Seeing What We Expect to See

I'm a Unix/Linux programmer. It capitalizes on my tendency to take what I see quite literally. By making few assumptions, I'm able to see the problem as the computer does.

By contrast, "normal human thinking" depends heavily on our imagination filling in many blanks. We have to make lots of assumptions. Those assumptions cause us to see what we've seen before... what we expect to see.

With almost all of my attention on Unix/Linux over the years, I've mostly just used Microsoft Windows and Office as tools and not followed their inner workings much. Long ago, I attempted to decipher the raw format of a Microsoft Word document (and failed to do so reliably). It left me with a mental image of Word documents consisting of intermixed binary values and text that only Microsoft understood.

A few years later, someone sent me a document in Microsoft Word 2007's new .docx format that I needed to convert to HTML for the web. I only had Office 2003 and was horrified by the mess Word made when exported "As a web page". So I proceeded to read the document into a text editor to see if I could just cut out the content and reformat it by hand. Knowing it was supposed to be XML, that's what I was expecting to see. What I saw instead was gibberish -- pure binary.

"Damn that Microsoft!"

Sliding back and forth through the sizable document and finding no blocks of text or other discernible patterns, I brought up Firefox and started many hours of Googling.

Now one thing I've learned over the years is that, for me at least, there's a very consistent inverse relationship between the intractability of a problem and the complexity of its solution. The longer it takes to solve it, the more simple the solution is likely to be. Assumptions and expectations lead me down an increasingly complex path of study, experimentation and failure as I exhaust "obvious" solutions. (Is "Occam's Razor" misunderstood?)

Lots of Googling have also taught me that simple, fundamental facts and concepts about a piece of software are often documented only once and thus rarely found in search results. Assumptions again.

The more intractable the problem, the more likely that the solution hinges on one of these obscure bits of information.

I finally came across somebody in a forum explaining the new format to a newbie (A Newbie! A Noob! How mortifying...) and discovered that in the world of Microsoft...

Though a .docx is named much like a .doc, looks like a .doc and is used like a doc... it's really a .zip!

"HP dumps WebOS on open source world"

December 09, 2011 By Ted Samson | InfoWorld

A Comment...

I'm glad HP took my advice, though it was kind of a no-brainer.

I've read a number of positive things about webOS from developers working with it. Unlike in the market-driven world of commercial software, webOS only needs to do something - anything, especially well to be adopted in whole or in part by the purely innovation-driven Open Source community.

Since webOS is based on the Linux 2.6.24 kernel, I would expect future webOS development to probably lean towards being another Open Source alternative to Android on small devices. Maybe Google will adopt it if there's something in it they can use.

Commercial software has become so dominated by market forces to the exclusion of functionality, quality, reliability and value, that the industry seems to be coalescing into two camps -- Open Source, where most of the R&D innovation occurs; and Commercial, where they assemble those innovations into commercially viable packages and market them.

Businesses and individuals that want finished products and have more money than time or computing skill, buy commercial software and support. Businesses that need specialized mission-critical software that gives them a competitive edge over their competition or companies and individuals with more time and/or computing skill than money, choose Open Source for some or all of their operations.

Linux (and perhaps webOS) is the Lowes or Home Depot of software whereas Microsoft is the Ethan-Allen Home Furnishings.

How much you want to bet Ethan-Allen's manufacturers have long-standing accounts at Lowes and Home Depot?