Practical Technology

for practical people.

August 10, 2009
by sjvn01
1 Comment

How to save the Internet from Windows

After last week’s near-collapse of the social networks, such as Twitter, due to a Windows-based, botnet DDoS attack, I made a modest proposal: Throw Windows off the Internet. Here’s how we can do it. Or, at the very least, force Windows users to maintain basic security standards.

Is the problem really so bad that ISPs (Internet Service Providers) must start encouraging users to abandon Windows or enforce Windows security? I think so.

Think about it. Besides last week’s attack, in early July many South Korean and American government and business sites were knocked out, In May, it was Google’s turn to be battered. Massive attacks that knock out part of the Internet are becoming commonplace. Since Windows-based botnets, are what’s strangling the Internet, I don’t see that we have any choice but to start, at the least, regulating the use of Windows.

More >

August 7, 2009
by sjvn01
0 comments

It’s time to get rid of Windows

I thought that the massive DDoS (Distributed Denial of Service) attacks that knocked Twitter and other social networks out was because of Iran’s government trying to shut down its protesters. I was wrong. Hundreds of millions of Internet users were annoyed because of Windows botnet-based DDoS aimed at one (1) person.

According to security company McAfee’s director of security research Dave Marcus, “This was a very targeted attack, and what the research shows is that it was aimed at one particular person, and that person’s accounts on Twitter, Facebook, YouTube and LiveJournal.” The target is a pro-Georgian blogger, but he’s still just one man.

Let me spell this out for you. Some people out there used no fewer than six Windows botnets to go after this one guy. And, in the process, they knocked out, for hours at a time, most of the major social networks.

How did this happen? It happened because Windows is an insecure piece of junk. Anyone who knows anything about security knows that this kind of disaster was only a matter of time. Windows botnets are responsible for DDoS attacks and most of e-mail spam.

More >

August 6, 2009
by sjvn01
0 comments

How Twitter was killed

The morning ritual: Get your cup of coffee, open up your e-mail, switch your Web browser to Twitter… ARGH!

That was how the morning went for many people when they turned to Twitter only to find that the wildly popular social-networking site was dead in the water. How dead was it? There wasn’t even a fail-whale to be seen.

So what happened? Twitter is still working it out. But, the site’s official blog reported that “We are defending against a denial-of-service attack, and will update status again shortly.” As of 12:46 PM Eastern, Twitter was up, still staggered, but working again.

Well, working for now anyway.

More >

August 5, 2009
by sjvn01
2 Comments

Shuttleworth wants Debian/Ubuntu co-operation

Many Debian developers, one of the oldest of the Linux distributions, still have trouble dealing with Ubuntu, one of the most popular Linux distributions and also a Debian descendant. Mark Shuttleworth, CEO of Canonical, the company behind Ubuntu, recently tried to heal the breech, but it doesn’t seem to be taking.

The Debian/Ubuntu battles started almost as soon as it became clear that Ubuntu was winning the mass popularity that had always eluded Debian. The war of words had calmed down, but recently they’ve caught fire again. This time around the spark, from what I can see, was when the Debian community "decided to adopt a new policy of time-based development freezes for future releases, on a two-year cycle."

That may not sound like anything to most of you, but many Debian’s developers dislike any but the loosest kind of organization. This is, after all, a group that includes some people who refused to work on the distribution because some developers got paid to work on Debian.

So what does this have to do with Ubuntu? One former Debian project leader, Anthony Towns, put it this on the Debian Project mailing list, "It’d be fascinating to know why it’s a two year cycle starting about one year from the last release instead of about two. I’m presuming the answer is ‘It’d be awkward for Ubuntu to sync with, given their last LTS release was early 2008 and they’ve kind-of promised two year cycles.’"

And, if you didn’t get that he was lashing out at Ubuntu, Towns continued, "And, umm, presuming Debian manages a five month freeze (ie, 1.5 = months less than lenny’s), and it releases in April, as presumably does Ubuntu 10.04 LTS (leisuresuit lorikeet?), why bother running Debian stable? Ubuntu comes with paid, full-time security support ; it’ll have pretty much everything Debian does, and probably a bit more; its popularity will probably provide better hardware support including pre-installed systems in some cases."

There’s nothing like throwing a little Ubuntu jealousy into any Debian discussion for the fight to start. And, of course, that’s what happened.

This quickly lead to the ever popular Debian whine of how Ubuntu developers are living easy off the hard work of Debian developers. Shuttleworth addressed this in a note on the Debian Project list where he wrote, "When you have two large, complex, passionate organizations there will always be plenty of opportunities to find fault with one another. … Nevertheless, we never let those incidents poison our commitment to working better with Debian. On balance, when I look at the huge effort that has gone into better collaboration with Debian, from many core and MOTU (Masters of the Universe) developers in Ubuntu, I think we should celebrate those successes and inspire people to do more of that, rather than taking every opportunity to find fault."

Well, it was a nice idea, but the flame war had caught and it was burning nicely.

Later, as the flames went hither and yon, it started burning a subject near and dear to Shuttleworth’s heart: Distribution cadence. By this, Shuttleworth means that if all the Linux distributions would try to co-ordinate their distribution release dates it would make life much easier for upstream developers to support multiple Linux distributions.

Today, if I’m an upstream developer, say the Mozilla Foundation with Firefox, I have to work hard to make sure my application will work with multiple Linux distributions since each has slightly different components. As an end-user, you don’t see this. But, for an ISV (independent software vendor), this has always been a real problem. Mozilla has the programmer resources to handle the problem, many smaller ISVs don’t have that luxury. But, large or small, whether an upstream developer is big as Google or just a guy with one, small useful program, the more work they have to put in to supporting multiple Linux distributions the less they like it.

So, Shuttleworth wrote a long post to the Debian Project list on the virtues of cadence. After laying out the problem I describe above, he wrote, "I hear this story all the time from upstreams. "We’d like to help distributions, but WHICH distribution should we pick?" That’s a very difficult proposition for upstreams. They want to help, but they can’t. And they shouldn’t have to pick favorites."

Therefore, Shuttleworth argues, "Adopting a broad pattern of cadence and collaboration between many distributions won’t be a silver bullet for ALL of those problems, but it will go a very long way to simplifying the life of both upstreams and distribution maintainers. If upstream knows, for example, that MANY distributions will be shipping a particular version of their code and supporting it for several years then they are more likely to be able to justify doing point releases with security fixes for that version… which in turn makes it easier for the security teams and maintainers in the distribution."

It makes sense to me. And, the new Debian release freezes would go a long way to helping this to happen.

But, it won’t happen. As usual, the Debian developers who seem to spend more time flaming than programming are toasting the idea with the same old, same old of how evil Ubuntu has stolen Debian’s goodness.

This makes me so tired. It’s no wonder that Debian has so much trouble working with businesses and other organizations. The Debian community can’t even agree that having a real release schedule is a good idea.

It’s not like there’s anything new here. Heck, Ian Murdock, one of Debian’s founders, wrote in 2005, that "Debian should have two overarching priorities for the next release … putting a timed release cycle in place." The Debian community didn’t pay any attention to him then, and they certainly won’t pay attention to Shuttleworth now.


A version of this story first appeared in ComputerWorld.