Security – Open Source vs. Closed: It’s a matter of eyes

For years there has been the whole what is more secure, Open or Closed source? Microsoft has and still takes a beating over this. Truth, though, is a different thing.

We all have heard of Heartbleed by now. The 2 year old security gap in OpenSSL has been all over the news. During all of this, a hole in the much loved Chrome browser that will allow websites to turn on your microphone and record what you are saying was announced. Another bug that had been around for a while (August 2013). Meanwhile, the hated entity known as Microsoft has been pretty much unaffected by these issues. Maybe it is time to remove our preconceived and ancient thought over security in the Open vs. Closed Source world.

The argument has been, from what I have heard and can tell, that Open Source is more secure because you have more eyes looking at it. The code is open and out there so people can find the issues faster and with the collaborative nature of Open Source, will be patched faster. Truth of the matter, as has been shown over the past week, is that it is not the case, and security holes can get past this set of checks and balances just as they can in any Closed Source system. The surprising thing is how long it has taken to find Heartbleed. One would think, with all those eyes looking at the code, that it would have been found much sooner. Of course this has led to the theories of the bug being an NSA backdoor. True or not, the code was still out there for everyone to see.

Chrome is a slightly different issue. Here is a bug that was found over 6 months ago, that still hasn’t been patched. It was brought to Google’s attention and they sat on it. Could this be another NSA (or insert your favorite Government agency here) backdoor? A way to spy on you without warrants? We will never know for sure, but it does show one major hole. Our thinking of Open Source and security is not completely correct. It is not the be all end all.

What has been lost in this is that Microsoft, and its Closed Source implementations of SSL have been free and clear of the Heartbleed problem. Microsoft at one time was awful with security. In this day and age though, it has gotten a lot better. It is responsive to holes, and the amount of out-of-band patches and workarounds for Zero Days is quite speedy. In fact the biggest security holes in Microsoft systems, is usually Java and/or Flash. Flash is still Closed Source, but Java was at one point more open. Java also is embedded in the web very deep. Try using NoScript at it’s tightest levels and see how much of websites get blocked, and how many websites complain about Java not being turned on. Yet through all of this, Microsoft is the one that still takes the blame, especially in the public’s eye. That is because we, the ones in the know, have done little to reeducate the public, and ourselves.

Do not get me wrong. I have nothing but love for the Open Source community. Collaborative efforts are awesome, and the community puts out some fantastic software, and alternatives to Closed Source (and overpriced) programs. It just has to be realized that it is no more secure than Closed Source. In the end it is all about the eyes on the code and the people looking for the holes. Remember Security is a process, not a destination.

Microsoft Surface. Hit and Miss.

Microsoft entered the tablet hardware business with the launch of the Surface line starting with the RT back in October. The timing on it for me was pretty good because my office was getting ready for a technology refresh, and I got to test it. Now, months later, what I call the new shiny syndrome has worn off.

When you look at what works and what doesn’t in the world of technology you come to realize a few things. First, so much is subjective. Second, people tend to dislike change. Third, change is inevitable. With this in mind, looking at the past 9 months with the Surface RT I have found a lot to like about it. There are pitfalls with it also, but it really is a solid tablet.

The Windows 8 interface is perfect for the RT. I find live tiles to be a great idea that matches and surpasses the widgets I have on my Android Tablet. iOS of course does not have anything like widgets or live tiles to compare to. The problem with the live tiles is the way they update, or at times don’t update. I find news stories to be on the older side half the time. I don’t get decent updates often enough for my liking. These problems though I have found to be true of widgets also.  There also is no intuitive way of stopping the live feed on the tiles.

Metro style apps are easy enough to get use to. Gestures for bringing up menus and doing things inside these apps are very consistent, which makes the learning curve a lot simpler than iOS or Android. The issue with Metro Style though is that same thing. If you are use to the way an app works on the other OSes, odds are you will have trouble finding the same features easily. Also the swipe down partially to bring up menus can be a bit trying at times, although not as difficult to master as the swipe completely down to close apps. If you don’t start from the right spot and go at the right speed, closing apps does not work, and I still find myself taking 3 or 4 swipes to close apps.

The biggest plus is the Office apps that come with the Surface RT, and with Outlook being added to that with the 8.1 Windows release, this just becomes better.

The biggest issues for me though come in the touch screen itself. I find it inaccurate. For instance, if I am on Facebook and want to share something on a friends timeline, I find myself going through the steps 4 or 5 times because I think I am tapping on share to friends timeline and it reads it as share to group. I find myself hitting links multiple times before it registers the tap also.

The soft keyboard which I have is decent, but also has its issues. I have found it losing responsiveness when typing, or registering the wrong key. In fact there is no rhyme or reason for this as the keyboard winds up either overly sensitive, or not registering my pressing at random. The Tablet itself will type normal for a moment, then buffer oddly and take 30 second or more to show the next stuff typed, which makes corrections rather difficult and causes delays in getting work done.

The weight and feel of the Surface are my final complaint about it. It shouldn’t feel as heavy as it does. Also the way it is shaped can leave hard marks in ones hand and cause pain if held for extended periods.

Don’t get me wrong, I love the tablet itself, and it gets used way more than my iPad. My ASUS Android tablet is still my primary tablet overall, but the Surface makes a nice backup. People seem to be worried about the amount of apps for the Windows RT environment, but honestly, I find most things I use a tablet for have an app, and most of them are available across the board. A decent free IRC app is all I have not been able to find so far. With the recent price cuts, I would recommend this to most people, although I am sure there are better devices out there from other manufacturers with Windows RT on it.

The catch 22

As I’ve been studying for the 70-410 Microsoft exam, I’ve come to the realization that I’m not ready, and I might not ever be.

Technology is a wondrous thing. It can take care of mundane, repetitive tasks, but only if you set it up and use it properly. It can also take over your world and control you, not quite Matrix style, but its getting there. Those of us that work in the IT field, be they developers, Network Admins, Penetration Testers, or any other number of fields, we do our best to keep up with the constant change of technology, not just for our own sake, but for societies. Someone has to know how to tame the technological beast. Certifications are a way of showing we understand the technologies out there, and have some degree of mastery over them.

Recently, there has been a challenge put forth called 90 Days to MCSA, through Microsoft learning. the goal is to get your MCSA be it in SQL, Server 2010, or Azure, in a 90 day period. I love learning (why else get into the IT field), and I love a good challenge, so I have embarked on the Server 2012 track. Over the last 10 days I have been studying for the Installation and Configuration exam (70-410) with a book from Microsoft press geared toward it. I also have a lab set up at my house for testing and doing the exercises. this should be simple you would think. Study the book, do the exercises, pass the exam. Theoretically, that is how it is supposed to go.

The problem with theories, is just that. They are theories, and real world can be indifferent to them. As I have almost finished the book (all 1600 pages of it) and done the exercises, I honestly do not feel much more ready to take the exam than I did before I started. Some of that could be because of the time frame from start to finish, which I will supplement with some other resources available to me. Some of it is that I don’t have access to any practice exams to gauge how I do on the various parts, and where my weaknesses are. Another portion is due to the face that while Server 2012 is new, and so are the exams, the books to study for it were released back in October, which means they were written while the software was still in Beta, and I have found issues with some of the exercises due to that fact (I won’t get into how many typos were in the book itself). This also leads me to a lack of confidence in taking the exam. When the official material is problematic, one has to wonder what they are actually in for.

The final issue I run into is that I like to know that I can pass the exam itself before I take it. I know others out there are like this also. We don’t want to go into that testing room and come out with a fail, especially with how much the exams cost. So we tend to push it off, time and time again, until there is new technology and new exams to take. In the mean time we get really good with the technology, but have no way of showing that little piece of paper to our employers, even though in the end it shouldn’t matter.

The question is though, when do you jump into the exam itself?