Re: Compromised Linux box stories (Re: [SLUG] upgrading complicated installs)

[Kevin Saenz <kevsaenz@xxxxxxxxxxxxxxx>]

> > So how would you develop such a system whilst also allowing for the
> > freedom and low barrier to entry that signifies the Free and Open  
> > Source
> > Software movement?
>
> I expect that when regulation is forced upon us, barriers to entry
> <i>will be the whole point</i>.  Unless we get in first.
>
> Will the parallel be: you get malpractice insurance, or you can have
> your future wages garnished forever if you get sued.  Doctors have to
> pay their malpractice insurance to have their pro-bono work  
> covered.  I
> expect software folks will too.

I think you miss the entire point here. Firstly how are you going to  
police this?
expoits are found in most pieces of software daily. The problem is  
that software
is not perfect you have one flaw that is behind the development of all  
software,
and that is the human brain.

there is a famous quote in IT and that is "no one has been fired for  
buying Microsoft",
but if you installed anything else...
With the amount of Outages experienced why hasn't organisations  
started Class
action for the total outage due to software realted issues? This is  
unworkable you can't do it.

Firstly with issues addressing compromised boxes I squarely place the  
blame at the sys admin or the owner of the box regardless of their  
technical skills. Regular updates are part and parcel of owning a  
system. if your box is compromised it's your fault and no one elses.   
I don't care if it's linux, windows, or OSX if you installed it, it's  
yours to maintain thus your responsibility. Time to reclaim ownership.



> > As a rough and ready idea, could this be something that OSIA could  
> > get
> > involved with? Could OSIA be a partner in such a scheme? Or is it
> > something that should be tackled by an independent body.
>
> I expect that OSIA *is* an independent body, at least as much as ACS  
> is
> if not more so, in this context.

roflmao