Weekly output: e-mail security (x2), MacBook webcam

This week’s work involved the Virginia countryside, a space capsule, robots playing soccer, and some quality time with drones. And yet none of those things showed up in this week’s articles. But there’s always next week…

Yahoo Tech TLS post6/10/2014: Explained: How ‘TLS’ Keeps Your Email Secure, Yahoo Tech

I enjoyed crafting the photo for this, and not just because it gave me an excuse to flip through old postcards. I did not enjoy reading the comments as much: the repeated assertion there that nothing online can be made secure is both incorrect on a technical level and fundamentally defeatist.

6/10/2014: 4 Ways Your Email Provider Can Encrypt Your Messages, Yahoo Tech

I wrote a short sidebar–something we’ve taken to doing more often at Yahoo Tech–outlining how e-mail encryption has advanced over the last decade or so… at least at some providers.

6/15/2014: Revisiting a fix for your MacBook webcam, USA Today

Yes, you read about this topic earlier this year in my USAT column. But this time around the remedy may work a little more reliably. There’s also a tip about watching Netflix on a computer without Microsoft’s Silverlight plug-in–if you’re running Windows 8.1.

About these ads

Heartbleed and bleeding-heart open-source advocacy

For at least the last decade, I’ve been telling readers that open-source development matters and helps make better software. If everybody can read the code of an application or an operating system, there can’t be any hidden backdoors; if anybody can rewrite that code to fix vulnerabilities and add features, the software’s progress can’t be thwarted by any one company’s distraction, fraud or bankruptcy.

OpenSSL pitchMy glowing endorsement of Mozilla Firefox 1.0 in November 2004 set the tone:

…the beauty of an open-source product like this is that you can participate in its evolution. Firefox’s code is open for anybody to inspect and improve...

Since then, I’ve recommended open-source operating systems, office suites, anti-virus utilitiessecure-deletion tools, file-encryption software, two-factor authentication apps, PDF exporters, DVD rippers and video-playback toolkits. And I’ve had one phrase in mind each time: Given enough eyeballs, all bugs are shallow.

My experience using open-source software tells me this is true–even if that doesn’t guarantee a constant rate of improvement or an elegant interface.

And if any genre of software should benefit from this method of development, it ought to be code that Web sites use to secure their interactions with users from eavesdropping: Everybody sending or storing private information needs this feature, billions of dollars of transactions are at stake, and you don’t even have to worry about wrapping a home-user-friendly UI around it.

True, right? Except Heartbleed happened. Two years ago, an update to the widely-used OpenSSL encryption library added a “heartbeat” function that made it easier for sites to keep an encrypted session going. But it also harbored an disastrous vulnerability to buffer-overflow attacks that would cause a site to return 64 kilobytes of whatever happened to be adjacent in the server’s memory to an attacker: usernames, passwords, e-mail content, financial transactions, even the private key the site uses to encrypt the session. And the attacked site can’t check afterwards to see if it got hit. I defy the NSA to script a better hack.

And despite buffer overflows being a well-known risk with documented defenses, nobody caught this for two years. Two years! It took a Google researcher and engineers at the Finnish security firm Codenomicon to find the bug separately and report it to the OpenSSL team.

How bad is this? Ask security researcher Bruce Schneier:

“Catastrophic” is the right word. On the scale of 1 to 10, this is an 11.

It seems that everything that could go right in open source development went wrong in this case. As an excellent story from Craig Timberg in the Post outlines, the free nature of OpenSSL made it an obvious choice for hundreds of thousands of sites and something of a natural monopoly, that same enormous deployment of OpenSSL encouraged people to assume that they themselves didn’t need to inspect the code that carefully, and OpenSSL developers got so little financial support from the corporations relying on their work that they couldn’t even subject their code to a proper security audit.

The stupid thing is, we knew this could happen. See John Viega’s 2000 essay, “The myth of open source security,” in which he outlines how thousands of users failed to catch “a handful of glaring security problems” in code he’d contributed to the Mailman mailing-list manager:

Everyone using Mailman, apparently, assumed that someone else had done the proper security auditing, when, in fact, no one had.

That doesn’t mean that closed-source development suddenly looks better. (When all this is done, Microsoft’s proprietary and hideous Internet Explorer 6 may still have greased the skids for more successful attacks than OpenSSL.) But it does mean that selfishness/laziness/distraction and open source can become a toxic mix, one we should have seen coming.

Updated, 10:25 a.m., to add a link to Viega’s prescient article.

Weekly output: CNET and CBS, Internet Freedom Day, Tech Night Owl, Java, Yahoo Mail

For once, I did not come home from CES with a cold. Instead, I picked up one from our toddler a few days later.

CBS CNET post1/15/2013: CBS, CNET And How To Kill Tech Journalism Through Big-Media Denial, Disruptive Competition Project

This is a story I kind of missed during the show, but it also took me a day or two to realize how dangerous CBS’s rationales for interfering with CNET’s editorial decisions would be for tech journalism in the traditional (read: media conglomerate-owned) media. I was glad this little rant got as much attention as it did; I wish that had been followed by accountability for the twit or twits in CBS’s executive suite who thought this stunt would work.

1/18/2013: Internet Freedom Day’s Unfinished Business, Disruptive Competition Project

Friday marked the first anniversary of the Internet rearing up and kicking Big Copyright in the hindquarters during the battle to quash the Stop Online Piracy Act. That’s worth celebrating, but a week after the death of net-freedom advocate Aaron Swartz I also thought it necessary to point out all the items remaining on the tech-policy to-do list if you value a more open Internet and technology economy. I hope the results doesn’t make me sound like a total Eeyore.

1/19/2013: January 19, 2013 – Kirk McElhearn and Rob Pegoraro, Tech Night Owl Live

I discussed the things I saw at CES, Apple’s stock price and other tech-news topics on Gene Steinberg’s podcast. I haven’t heard Kirk McElhearn‘s segment yet, but I’m sure that Macworld and TidBITS contributor had insightful things to say too.

1/20/2013: Q&A: Is Java safe to use?, USA Today

I returned to the topic I covered in my USAT column last spring, this time with more context about what Java was supposed to do and how it became the nuisance it is–plus a few remaining, non-Web uses for this software I hadn’t addressed in detail in that earlier piece. There’s also a tip about enabling a security feature Yahoo finally added to its Yahoo Mail service, some five years after Google had provided the same option to Gmail users.

I also held forth on the mini-blogging site Sulia, as my experiment with that site continues. Among this week’s posts: a review of Facebook’s new, airtime-free voice-calling service (and one of an Android app that does the same thing through Google Voice); documentation of some new Twitter features; a call for editors and publishers to post those newsroom-wide memos that always wind up getting published elsewhere.