Do You Need Open-Source Indemnification?

The idea that companies and individuals might risk lawsuits for running applications that infringe on copyrights or patents gained popularity when SCO began threatening to run down Linux end users in retaliation for secret (SCO refused to detail them) upstream IP violations.

The story was (and still is) that since open source licenses explicitly declaim liability for SCO-style attacks, and since most open source software projects don't have the resources to pay on lawsuit judgments anyhow, open source software is riskier for companies than proprietary software would be.

Unless, of course, your open source software provider was an IT titan with a big sack of patents (and lawyers) slung over its back.

Is open source software indemnification a necessary defense for a real threat, or isn't it?

My Bug Is Pidgin's Feature

Today while trolling around on Slashdot I came across this open-source development flareup tidbit:

Slashdot | Pidgin Controversy Triggers Fork "Pidgin, the premier multi-protocol instant messaging client, has been forked. This is the result of a heated, emotional, and very interesting debate over a controversial new feature: As of version 2.4, the ability to manually resize the text input area has been removed; instead, it automatically resizes depending on how much is typed. It turns out that this feature, along with the uncompromising unwillingness of the developers to provide an option to turn it off, annoys the bejesus of very many users.

Last week or so, I'd read about this Pidgin fork, somewhat lamely named Funpidgin, and I even visited the project's Web site to take a peek. I skimmed over the project page, didn't understand the point of the fork, chalked it up to wacky open-source developer intransigence and moved on.

As it turns out, I ran into Pidgin's new No-Input-Box-Resizing-for-You "feature" a few weeks ago while testing Ubuntu and Fedora. I was annoyed that I couldn't resize the input box as I'm wont to do in Pidgin, thought it was an obvious bug and ignored it, expecting that the issue would be fixed by the time that Ubuntu 8.04 and Fedora 9 shipped.

The Pidgin developers should listen to their users, plenty of whom have weighed in against the pointless resize-restriction. As for me, it's been a little while now since I've used Pidgin regularly, since I've taken to instant messaging through Gmail.

Gmail's IM interface isn't great--there's no per-buddy or per-group status-setting, it limits me to Jabber or AIM networks, and, just like Pidgin, it won't let me resize my input box. Unlike Pidgin, however, my chat logs get to live in the cloud, where they're accessible (and searchable) from wherever I am. Lately, I've prized that convenience over the customization options that a fat IM client affords.

Pidgin's newest "feature" tips the fat vs. thin calculus further in Gmail's favor.

Move Over, Vista: XP SP3 Lives

Now that Windows Vista Service Pack 1 has enjoyed a few weeks in the limelight in which to entice the "wait-for-SP1" IT shops to jump to Microsoft's latest and greatest client operating system, it's time to introduce the OS upgrade we've all been waiting for: Ladies and gentlemen, put your hands together for Windows XP SP3.

XP SP3 is a rather modest upgrade, one that falls much more in line with XP's first service pack than with the security feature-packed SP2 release, but the new service pack stands as an important reminder that while XP will soon leave the retail channel, the operating system on which most organizations have come to depend is still very much supported by its maker.

Two Weeks with Fedora 9

Recently, I came across a blog post about how to install a LiveCD version of Red Hat's upcoming Fedora 9 release onto a USB stick, leaving space on the stick for data to persist between reboots.

Impressed by the persistent USB LiveCD fun and partition encrypting installer improvements, I chose to throw caution to the wind and load up Fedora 9 Beta on my main notebook, replacing the beta Hardy Heron install I'd been running--quite stably--for several weeks.

Read on for the testing details, but the bottom line for Fedora 9 is more or less the same as with previous Fedora versions: Fedora can indeed be used for anything, its primary purpose is to serve as a leading-edge development platform for Red Hat's initiatives. As Red Hat confirmed very clearly last week, providing a mainstream desktop/notebook operating system is not one of their product goals.

Toward a More Perfectly Modular Windows

Gartner made news April 9 by contending that Windows is in danger of collapsing under its own weight. According to Gartner analysts Michael Silver and Neil MacDonald, radical changes to Windows are required. Their prescription: a more modular Windows.

Windows is a massive piece of software, and even though it's not presented as such externally, the operating system is made up of many separate parts. Making the seams between those parts more obvious and providing a way for components to be swapped in or out with ease would make for a more flexible and manageable Windows.

Microsoft agrees with this assessment--and, in fact, Microsoft has been agreeing for the last 10 years or so.

The Secret to Ubuntu's PWN 2 OWN Success?

I came across an interesting item on OSNews today -- a link to a Computerworld story in which Terri Forslof, manager of security response at TippingPoint, explains why Ubuntu Linux was the only OS left standing at the pwn2own contest her firm sponsored at CanSecWest.

"There was just no interest in Ubuntu," said Terri Forslof, manager of security response at 3Com Corp.'s TippingPoint subsidiary, which put up the cash prizes awarded at the contest last week at CanSecWest.... "It was actually a lack of interest" on the part of the PWN to OWN contestants, Forslof said. "[Shane Macaulay's] exploit would have worked on Linux. He could have knocked it over. But [the contestants] get a lot more mileage out of attacks on the Mac or Windows," she continued.

The story doesn't mention how many people attempted to hack the Ubuntu machine at PWN 2 OWN. Does anyone out there have this information? If indeed Ubuntu was "ignored" during the contest, I imagine that someone in attendance must have noticed.

While short on details about how many attacks Ubuntu faced compared to Vista and OS X, the story was particularly long on complimentary quotes about how the mighty prowess of Windows Vista SP1 made the OS tougher to crack than PWN 2 OWNers had perhaps expected. Hooray for Vista.

Back at OSNews, I found the contribution of one commenter particularly interesting:

"Prior to joining TippingPoint, Terri was a Security Program Manager for the Microsoft Security Response Center, focused on driving the resolution of security vulnerabilities within Microsoft products."

http://dvlabs.tippingpoint.com/team/tforslof

Were you at CanSecWest? Just how ignored was Ubuntu?

UPDATE: My colleague Ryan Naraine tells me that only four contestants had signed up for the PWN2OWN challenge, so:

1. It's entirely possible that Ubuntu was indeed completely ignored;
2. It's pretty sad that with so few participants, both Mac and Vista went down, anyway;
3. I must remind myself to pay less, or at least more guarded, attention to PWN2OWN next year.
   Read more... | Comment (0) | del.icio.us | digg.com

   View all of Security

Sprint and Company Cover Their Broadband Bases

Today, eWEEK's Clint Boulton is reporting on the latest efforts to save the Sprint-Clearwire nationwide WiMax wireless data network scheme.

However, while the WiMax effort from Sprint et al would appear to help cover the companies' broadband bases, and while I'd love to see another broadband option emerge, I'm not convinced that a national WiMax network will manage to succeed.

The trouble is that all the telephone, cable, satellite, and wireless companies are in the same business--that of data delivery. If today's bit barons are paying attention, they should be able to see that the average consumers of data delivery services are spending their money very inefficiently.

Exchange Interop for the Rest of Us

Apple's announcement yesterday that it plans to add support for Microsoft's Exchange groupware server on iPhone and iPod Touch devices has gotten me thinking about Exchange support (or lack thereof) on other platforms, such as Linux and, strangely enough, Apple's own OS X. It's possible now to link up pretty much any mail client on any platform with Exchange via IMAP, but in order to access all the non-mail data that makes Exchange worthwhile, you need to find another route.

iPhone Goes Enterprise, Treos and BlackBerrys Go Away?

Come this June, in enterprises across the country, I expect that Treos will begin to wither in the eyes of one-time loyalists, and that erstwhile thumb-keyboard addicts will start to judge their BlackBerrys to be significantly sourer. That's because June is the month in which Apple has promised to ship an enterprise and third-party application embracing the 2.0 version of the firmware that drives its popular but so-far solidly consumer-focused iPhone and iPod Touch devices.

Apple's iPhone will be far from the first mobile device to offer the enterprise connectivity and management features that Steve Jobs announced today. However, from a hardware perspective, the iPhone and the iPod Touch are, by far, the most impressive mobile devices I've ever laid hands on...

Google's Got Your Workgroup in Its Sites

Today, Google rolled a much-anticipated new component into its family of online applications: Google Sites.

The new service is the fruit of Google's 2006 purchase of hosted wiki provider JotSpot, and I've been looking forward for some time now to see what the search giant would do with its purchase, and to see how well it would integrate it with the rest of the Google Apps suite.

I've only spent a short time with Sites so far, but the service looks impressive.