4 ms·

It's pretty clear that this completely 100% predictable and predicted attack - open source and free software people have only been talking about the incredibly

It's pretty clear that this completely 100% predictable and predicted attack - open source and free software people have only been talking about the incredibly obvious dangers of a proprietary IT monoculture for 20 years now - is such a damaging "welp, Stallman was right again" moment that Microsoft didn't really have much choice.

Silhouette 9y ago
This has almost nothing to do with proprietary vs. open source. A patch for the vulnerability exploited here had been available for months. The real problem is that organisations had devices sufficiently connected to be vulnerable that had not the patch applied. That leads to questions about software update policies within those organisations, and that in turn leads to some quite difficult questions about regulated medical devices and how they are supplied and maintained.
- syshum 9y ago
  >>A patch for the vulnerability exploited here had been available for months. Not for XP/2003. That patch was not generally available months ago
  - belltaco 9y ago
    I don't think Linux distributions from 2001 are receiving security updates today. The only thing going for a free(as in beer) OS is that upgrades are free, but the main reason that so many corporate systems are still on XP is compatibility, not the cost of the upgrade license which is peanuts for large orgs affected by this. And Linux distros from 2001 would still have the exact same problem. Consider the fact that Windows has the best backward compatibility in the business, while even drivers break across relatively minor Linux kernel versions and compatibility is likely to be a bigger problem with Linux.
    - syshum 9y ago
      due to the nature of Linux being a Monolithic Kernel and open source, there tends to be less issue with backward compatibility issues with Linux making it easier to update systems that today companies refuse to update windows on because it is not compatible with older hardware/software Infact Linux often has the reverse problem in that hardware support for new technology often lags behind because hardware vendors focus on Windows first. >Consider the fact that Windows has the best backward compatibility in the business, That is a complete and utter myth. Windows has terrible backwards compatibility, and changes to the Windows Driver model, and other changes require drivers and software to be completely rewritten between generations of windows. >while even drivers break across relatively minor Linux kernel versions and compatibility is likely to be a bigger problem with Linux. Where do you get this? Drivers are included in the Linux Kernel, it is impossible for a driver to "break" across minor version of Linux, if a driver breaks the kernel fails and is not released.
      - kungtotte 9y ago
        I'd like to see the set of sysadmins that belong to both the group that is running a distro from 2001 and are willing to manually update the kernel on those systems to a later one. Yes, the Linux kernel being what it is makes for good/great backwards compatibility. But that's so far from the point it's not even funny. This is about update policies and internet security at the organisations involved.
      - belltaco 9y ago
        >Where do you get this? Drivers are included in the Linux Kernel, it is impossible for a driver to "break" across minor version of Linux, if a driver breaks the kernel fails and is not released. Linux comes with a limited set of device drivers in the main source tree, just like Windows' bundled drivers. Most of this thread is about rare medical equipment or proprietary drivers/programs from companies that have gone out of business. Also, the Linux kernel ABI routinely breaks drivers, unlike Windows which happens much more rarely. https://www.phoronix.com/scan.php?page=news_item&px=Linux-Kernel-Stable-API-ABI https://www.phoronix.com/scan.php?page=news_item&px=Linux-Ke...
  - Silhouette 9y ago
    That patch was not generally available months ago It was reportedly available to those who were still officially supported, though, possibly as far back as February. As others have suggested, Microsoft has historically offered support (in the sense of at least security patches) for each generation of Windows for much longer than any of the major FOSS operating systems. Obviously you don't get free, unlimited, eternal support with any version of any OS, but even then Microsoft has apparently made arrangements with those who really didn't want to update to a more recent one than XP to continue offering support in return for additional funding. As I said before, the real problem here is how to deal with the conflict between wanting to keep connected systems up-to-date with security patches, while at the same time not breaking their essential functionality. Medical systems used in regulated environments where failures may literally be a matter of life or death are pretty much the ultimate example of this difficulty.
doktrin 9y ago
I completely disagree with your reasoning, and frankly find it downright infuriating. It feels straight up partisan and political. Isn't it entirely plausible an attack of precisely this sort could occur in a world where Linux (or macOS, or templeOS, or whateverOS) is the go-to desktop OS? Isn't Windows the preferred target for attackers because of its ubiquity? How in the world would this be mitigated by "open source"?
- syshum 9y ago
  While these attacks are not impossible on linux/bsd there are inherent weaknesses in design of Windows, Especially Windows XP/2003 that make these attacks more probable Also due to the nature of Linux being a Monolithic Kernel and open source, there tends to be less issue with backward compatibility issues with Linux making it easier to update systems that today companies refuse to update windows on because it is not compatible with older hardware/software Infact Linux often has the reverse problem in that hardware support for new technology often lags behind because hardware vendors focus on Windows first.
- Kali909 9y ago
  One argument for Linux here is that people in the know could have patched it themselves and recompiled the kernel or userland utility causing the problem. Or people after the fact, without having to wait for Microsoft. With Windows, you get what you're given, when they want to provide it (essentially).
- shubb 9y ago
  It seems that a root problem is not the proprietary OS, but the proprietary and abandoned drivers, hardware management tools, and patient record systems the obsolete OS is required to support. Open source might be part of the answer to this, or some kind of legal 'right to migrate'. If all of your patient records are in some ancient software, the new vendor would probably be happy to get them out again if there were documents or a codebase saying how. If you need XP to run ExpensiveScannerManager95, if you had a legal right to get the code somehow, I'm sure you could find you an SME that would port the driver to windows 10. Maybe we / our companies and governments need these legal rights now. But what exactly should they be?
oblio 9y ago
I'm a FOSS supporter, but do you think FOSS systems are always updated on time? Or that distributions released in 2001 are still updated? Or that companies running critical systems on old FOSS systems always go through the pain of updating? Just because the update is free, doesn't mean there's no risk associated with it.
josefx 9y ago
I know people that still run OpenSuSE 11.2 on their internal systems. No amount of "open source" will have customers modify what they see as a working system, especially not when any upgrade comes with a week of integration followed by tests and bugfixes to ensure flawless operation in production. The difference between OpenSource and Proprietary is in this case that Windows XP exists and works well enough while GNU/Hurd doesn't and therefore will never have an outdated version in use.
Matt3o12_ 9y ago
Despite being a big fan of open source software, this does not make a difference. Microsoft released patches for new windows system relatively quickly (in March if I recall correctly). I bet there are still tons of systems that suffer from the Shellshock, or Heartbleed because they are either not updated at all or they are running old linux version which are no longer supported (I bet there are still tons of RHEL/Centos 2, 3, 4, and 5, which do no longer get security update or the companies do not have extended support contracts). The real issue is that people are afraid of updates because they tend to break things. They do not want to invest into "slow rollout strategies" and the like. If updates were applied immediately to 10% (or maybe even less if the company is big enough) of all machines, and if there was a way to quickly rollback the update, there would be less problems and the consequences of failed updates would be less serve. This way you can have your systems up-to-date within 48h (maybe: 1% of 'key users' who do not freak out if things break, and then after maybe 4h 10% of normal users who can call "IT support" to roll back the update, and after 24-48h, to all PCs. This would be even easier for stateless servers because you could redirect all requests to other servers if the 10% fail with 0 downtime).

Silhouette 9y ago

This has almost nothing to do with proprietary vs. open source. A patch for the vulnerability exploited here had been available for months. The real problem is that organisations had devices sufficiently connected to be vulnerable that had not the patch applied. That leads to questions about software update policies within those organisations, and that in turn leads to some quite difficult questions about regulated medical devices and how they are supplied and maintained.

syshum 9y ago
>>A patch for the vulnerability exploited here had been available for months. Not for XP/2003. That patch was not generally available months ago
- belltaco 9y ago
  I don't think Linux distributions from 2001 are receiving security updates today. The only thing going for a free(as in beer) OS is that upgrades are free, but the main reason that so many corporate systems are still on XP is compatibility, not the cost of the upgrade license which is peanuts for large orgs affected by this. And Linux distros from 2001 would still have the exact same problem. Consider the fact that Windows has the best backward compatibility in the business, while even drivers break across relatively minor Linux kernel versions and compatibility is likely to be a bigger problem with Linux.
  - syshum 9y ago
    due to the nature of Linux being a Monolithic Kernel and open source, there tends to be less issue with backward compatibility issues with Linux making it easier to update systems that today companies refuse to update windows on because it is not compatible with older hardware/software Infact Linux often has the reverse problem in that hardware support for new technology often lags behind because hardware vendors focus on Windows first. >Consider the fact that Windows has the best backward compatibility in the business, That is a complete and utter myth. Windows has terrible backwards compatibility, and changes to the Windows Driver model, and other changes require drivers and software to be completely rewritten between generations of windows. >while even drivers break across relatively minor Linux kernel versions and compatibility is likely to be a bigger problem with Linux. Where do you get this? Drivers are included in the Linux Kernel, it is impossible for a driver to "break" across minor version of Linux, if a driver breaks the kernel fails and is not released.
    - kungtotte 9y ago
      I'd like to see the set of sysadmins that belong to both the group that is running a distro from 2001 and are willing to manually update the kernel on those systems to a later one. Yes, the Linux kernel being what it is makes for good/great backwards compatibility. But that's so far from the point it's not even funny. This is about update policies and internet security at the organisations involved.
    - belltaco 9y ago
      >Where do you get this? Drivers are included in the Linux Kernel, it is impossible for a driver to "break" across minor version of Linux, if a driver breaks the kernel fails and is not released. Linux comes with a limited set of device drivers in the main source tree, just like Windows' bundled drivers. Most of this thread is about rare medical equipment or proprietary drivers/programs from companies that have gone out of business. Also, the Linux kernel ABI routinely breaks drivers, unlike Windows which happens much more rarely. https://www.phoronix.com/scan.php?page=news_item&px=Linux-Kernel-Stable-API-ABI https://www.phoronix.com/scan.php?page=news_item&px=Linux-Ke...
- Silhouette 9y ago
  That patch was not generally available months ago It was reportedly available to those who were still officially supported, though, possibly as far back as February. As others have suggested, Microsoft has historically offered support (in the sense of at least security patches) for each generation of Windows for much longer than any of the major FOSS operating systems. Obviously you don't get free, unlimited, eternal support with any version of any OS, but even then Microsoft has apparently made arrangements with those who really didn't want to update to a more recent one than XP to continue offering support in return for additional funding. As I said before, the real problem here is how to deal with the conflict between wanting to keep connected systems up-to-date with security patches, while at the same time not breaking their essential functionality. Medical systems used in regulated environments where failures may literally be a matter of life or death are pretty much the ultimate example of this difficulty.

doktrin 9y ago

I completely disagree with your reasoning, and frankly find it downright infuriating. It feels straight up partisan and political. Isn't it entirely plausible an attack of precisely this sort could occur in a world where Linux (or macOS, or templeOS, or whateverOS) is the go-to desktop OS? Isn't Windows the preferred target for attackers because of its ubiquity? How in the world would this be mitigated by "open source"?

syshum 9y ago
While these attacks are not impossible on linux/bsd there are inherent weaknesses in design of Windows, Especially Windows XP/2003 that make these attacks more probable Also due to the nature of Linux being a Monolithic Kernel and open source, there tends to be less issue with backward compatibility issues with Linux making it easier to update systems that today companies refuse to update windows on because it is not compatible with older hardware/software Infact Linux often has the reverse problem in that hardware support for new technology often lags behind because hardware vendors focus on Windows first.
Kali909 9y ago
One argument for Linux here is that people in the know could have patched it themselves and recompiled the kernel or userland utility causing the problem. Or people after the fact, without having to wait for Microsoft. With Windows, you get what you're given, when they want to provide it (essentially).
shubb 9y ago
It seems that a root problem is not the proprietary OS, but the proprietary and abandoned drivers, hardware management tools, and patient record systems the obsolete OS is required to support. Open source might be part of the answer to this, or some kind of legal 'right to migrate'. If all of your patient records are in some ancient software, the new vendor would probably be happy to get them out again if there were documents or a codebase saying how. If you need XP to run ExpensiveScannerManager95, if you had a legal right to get the code somehow, I'm sure you could find you an SME that would port the driver to windows 10. Maybe we / our companies and governments need these legal rights now. But what exactly should they be?

oblio 9y ago

I'm a FOSS supporter, but do you think FOSS systems are always updated on time? Or that distributions released in 2001 are still updated? Or that companies running critical systems on old FOSS systems always go through the pain of updating? Just because the update is free, doesn't mean there's no risk associated with it.

josefx 9y ago

I know people that still run OpenSuSE 11.2 on their internal systems. No amount of "open source" will have customers modify what they see as a working system, especially not when any upgrade comes with a week of integration followed by tests and bugfixes to ensure flawless operation in production. The difference between OpenSource and Proprietary is in this case that Windows XP exists and works well enough while GNU/Hurd doesn't and therefore will never have an outdated version in use.

Matt3o12_ 9y ago

Despite being a big fan of open source software, this does not make a difference. Microsoft released patches for new windows system relatively quickly (in March if I recall correctly). I bet there are still tons of systems that suffer from the Shellshock, or Heartbleed because they are either not updated at all or they are running old linux version which are no longer supported (I bet there are still tons of RHEL/Centos 2, 3, 4, and 5, which do no longer get security update or the companies do not have extended support contracts). The real issue is that people are afraid of updates because they tend to break things. They do not want to invest into "slow rollout strategies" and the like. If updates were applied immediately to 10% (or maybe even less if the company is big enough) of all machines, and if there was a way to quickly rollback the update, there would be less problems and the consequences of failed updates would be less serve. This way you can have your systems up-to-date within 48h (maybe: 1% of 'key users' who do not freak out if things break, and then after maybe 4h 10% of normal users who can call "IT support" to roll back the update, and after 24-48h, to all PCs. This would be even easier for stateless servers because you could redirect all requests to other servers if the 10% fail with 0 downtime).