On 7/20/24 6:08 AM, Nuno Silva wrote:
> As far as both are Turing-complete, there's probably not much difference
> in capabilities for this discussion. Windows does not hold a monopoly in
> the capability to run code with errors.
>
> (In fact, given that Broadcom has their own wireless linux drivers,
> possibly with the same quality level as their firmware...)

For thirty years people have been saying stupid and meaningless stuff
like this. It is garbage.

The Windows situation... OBVIOUSLY... would never happen in a Linux
evironment although systemd makes a huge step forward to make it possible.

It has nothing to do with turing machines and advanced theoretical
calculations. It has to do with the more secure Unix level design for
Linux based systems and the way decisions are made in Linux development
and how updates are run and generated.

Does this make Linux perfect.. No. But it gives it a shot. MS makes
insecure decisions from the ground up for business decisions. We have
spent a lift time watch MS systems doing things they just should be able
to do making them rich targets for visues big and small, and malware...
things like runnng fucking email as an executable binary and autoruning
DVD software etc etc. I can't even begin to discuss what it does to the
browser.

So please... put your bullshit away.

THis was inevitable and it is inevitable to happen again.

On Sat, 20 Jul 2024 06:08:50 -0400, Nuno Silva <nunojsilva@invalid.invalid> wrote:
<snip>
> But immediately ruling out this scenario for Linux systems sounds quite
> unrealistic to me. (And, from what I've read yesterday, I got the
> impression that there had been a similar incident with Linux systems,
> but I didn't study that further.)

The failure was caused by one company that provides security software that
runs with the windows equivalent of root privileges, that failed to properly
test an update.

Pushing an update for privileged software to tens of thousands of systems
all at once is never a good idea. It should have been done in stages starting
with a small number of systems, with verification that it was working properly
at each stage of the roll out.

The are very few cases where an update can not be done in stages, and in those
cases the testing in a simulated environment must be extra careful.

In this case it came back to destroy the reputation of the security software
provider. A company that is supposed to be security oriented should is
expected to do better. I'll be surprised if the lawsuits from this don't put
them into bankruptcy.

The os doesn't matter. Anyone can make a mistake. It's the lack of testing and
the bad deployment strategy combined with the large number of mission critical
systems that were impacted that made the problem more severe.

Microsoft is also at fault for allowing updates to be pushed to their cloud
customer's systems without staged roll out and testing. That's why the update
was able to impact so many systems, with so many of them being mission critical.
Many companies migrated to using cloud systems specifically to avoid situations
like this.

From what little has been disclosed, my guess is that the problem was a false
positive in malware detection, likely from what was thought to be a minor
signature update. While stuff like that happens easily, it should be expected
to possibly happen. Proper testing and update roll out procedures would have
mitigated the damage instead of causing the impact it did cause.

This will remind everyone that no update is minor when the systems being updated
are mission critical, and to always stage roll outs when a large number of
systems are impacted.

Regards, Dave Hodgins

On 7/20/24 1:43 PM, Charlie Gibbs wrote:
> On 2024-07-20, 26yh.0712 <26yh.0713@e6t5y.net> wrote:
>
>> Do we, the world, WANT
>> to be stuck with naught but M$ and the wormy
>> apple ???
>
> "Ooooh, shiny!"

I do get that reference :-)

> (In other words, for suitable values of "the world",
> the answer is a resounding yes.)

I have less care for MOST of the world in this
respect ... if they want "shiny", well, fine -
but they can't bitch when it all goes to hell.

But for Big Biz, banks, hospitals, industry, NONE
should be using M$.

Not 100% sure about Mac ... it's a Unix under the
hood, but they've added SO much to it ... is it
really any more secure/stable than M$ anymore ?

>> If so, the cyber-villains have
>> already won and we'll be back to exchanging
>> pigs for chickens again.
>
> I'll raise you two hens and a rooster.

I'll see that with a basket of turnips.

>> As for Biz ... I'd still say to go with some kind
>> of Unix at this time. Some of the apps might have
>> that 80s terminal/curses look but they'd be SOLID.
>
> I still see curses-style screens in some commercial
> venues. They're not only solid but lightning-fast.
> But all they give you is what you need, so I don't
> see them getting far in the mass market...

I never curse curses screens. It is possible to make
them very nice and STILL use like one percent the
processor/code of a GUI equiv. Even GWBASIC that
came with the old IBM-PCs had x-y cursor placement
and text color (you could do the same with the BIOS
routines). That made it possible to create nice
displays.

Didja notice how much of a pain it is these days to get
at those line/corner/bracket/etc ASCII chars these days -
UNICODE !

On 7/20/24 12:25 PM, Andy Burns wrote:
> The Natural Philosopher wrote:
>
>> I remember US robotics sold future proof modems that could be upgraded.
>
> Only the "Courier" model had DSP upgrades, other models like "Sportster"
> only had firmware upgrades.
>
>> No one ever did.
>
> When I bought mine, Demon supported 14.4kbps, that modem was upgraded
> all the way to 56kbps.
>
>> They threw them and bought the newer modems instead
>
> Still have a couple here.

I remember doing Compuserve Forums with a USR plugged
into a dumb terminal - 9600 baud - and the BBS's even
earlier - 300 baud. At 300 you can read the text real
time as it comes in :-)

ATTD ...

On 7/20/24 12:18 PM, Andy Burns wrote:
> Lawrence D'Oliveiro wrote:
>
>> Don’t like those “GUI bells and whistles”? Don’t install them. That’s not
>> a choice Windows gives you.
>
> Oh?  Windows Server Core.

True.

But it's still full of M$ code.

I note that even today's news is still dwelling
on the CrowdStrike debacle and beyond. This hit
SUCH a broad range and volume of vital biz interests
that nobody's been able to sweep it under the rug.

An actual Russian/Chinese cyber-hit would be likely
ten times as bad - and hit industrial/utility systems
as well. Hard to download yer patches when the lights
are out ....

On Sat, 20 Jul 2024 16:05:05 -0400, David W. Hodgins wrote:

> Pushing an update for privileged software to tens of thousands of
> systems all at once is never a good idea. It should have been done in
> stages starting with a small number of systems, with verification that
> it was working properly at each stage of the roll out.

Canary testing is definitely beneficial. Even worse, our support people
are indoctrinated from Day One that unless the system is completely broken
and can't get any worse never push out updates on Friday when everyone is
headed to the beach.

Harold Stevens <wookie@aspen.localdomain> wrote:
> In Message-ID: <-7CcndX6lpSstAb7nZ2dnZfqnPudnZ2d@earthlink.com> 26yh.0712:
>
> [Snip...]
>
>> Bill Gates learned early on to keep his pols WELL greased.
>
> Quoting ProPublica:
>
> A full, public accounting of what happened in the Solar Winds case would
> have been devastating to Microsoft. ProPublica recently revealed that
> Microsoft had long known about -- but refused to address -- a flaw used
> in the hack. The tech company's failure to act reflected a corporate
> culture that prioritized profit over security and left the U.S. government
> vulnerable, a whistleblower said.
>
> Please excuse any snits slrn had about this reference URL:
>
> https://www.propublica.org/article/cyber-safety-board-never-investigated-solarwinds-breach-microsoft

That was very interesting. Although following the link to the
article about the whistleblower who quit Microsoft, guess who hired
them next?

""The decisions are not based on what's best for Microsoft's
customers but on what's best for Microsoft," said Harris, who now
works for CrowdStrike, a cybersecurity company that competes with
Microsoft." ...
https://www.propublica.org/article/microsoft-solarwinds-golden-saml-data-breach-russian-hackers

So it indeed seems like you can't really rely on any company in
this market.

--
__ __
#_ < |\| |< _#

On Sat, 20 Jul 2024 17:18:11 +0100, Andy Burns wrote:

> Lawrence D'Oliveiro wrote:
>
>> Don’t like those “GUI bells and whistles”? Don’t install them. That’s not
>> a choice Windows gives you.
>
> Oh? Windows Server Core.

Lots of things don’t work under that. Call it “Windows Server Crippled Core”.

On Sat, 20 Jul 2024 11:08:50 +0100, Nuno Silva wrote:

> But immediately ruling out this scenario for Linux systems sounds quite
> unrealistic to me. (And, from what I've read yesterday, I got the
> impression that there had been a similar incident with Linux systems,
> but I didn't study that further.)

Sure. But remember, the various pieces of a Linux system are just
inherently put together in a more modular, flexible fashion, and that
includes systemd. That does reduce the chance for trouble quite
significantly.

On Sat, 20 Jul 2024 14:21:03 -0400, Popping Mad wrote:

> The Windows situation... OBVIOUSLY... would never happen in a Linux
> evironment although systemd makes a huge step forward to make it
> possible.

systemd myth number 1: “systemd is monolithic”

<http://0pointer.de/blog/projects/the-biggest-myths.html>

On Sat, 20 Jul 2024 16:05:05 -0400, David W. Hodgins wrote:

> Pushing an update for privileged software to tens of thousands of
> systems all at once is never a good idea. It should have been done in
> stages starting with a small number of systems, with verification that
> it was working properly at each stage of the roll out.

They probably did exactly that. They almost certainly followed exactly the
same testing and rollout procedure they had followed a hundred or a
thousand times before. But with Windows, that is no longer a guarantee of
success.

On 20 Jul 2024 23:23:08 GMT, rbowman wrote:

> Even worse, our support people
> are indoctrinated from Day One that unless the system is completely
> broken and can't get any worse never push out updates on Friday when
> everyone is headed to the beach.

What happens when the malware folks start releasing their zero-days on a
Friday?

On 21 Jul 2024 10:17:55 +1000, Computer Nerd Kev wrote:

> That was very interesting. Although following the link to the article
> about the whistleblower who quit Microsoft, guess who hired them next?

What is that supposed to be suggesting, exactly? Is it saying something
about the ethics of the whistleblower, or of the company who hired them?
If so, what?

On 7/20/24 8:55 PM, Lawrence D'Oliveiro wrote:
> systemd myth number 1: “systemd is monolithic”
>
> <http://0pointer.de/blog/projects/the-biggest-myths.html>

yeah that is bullshit.

You can **SEE** it is monolithic .... it is not a guess. You are a
fucking idiot.

On 7/20/24 8:55 PM, Lawrence D'Oliveiro wrote:
> and that
> includes systemd.

Umm no it doesn't And don't cross post you trolling prick.

Pottering systematricaly folded numerous parts into a single whole. It
still has parts, but it is still monolithic and designed to be that way.
It is not designed to be flexible or pluggin friendly, and it is not.

On 7/20/24 8:55 PM, Lawrence D'Oliveiro wrote:
> On Sat, 20 Jul 2024 11:08:50 +0100, Nuno Silva wrote:
>
>> But immediately ruling out this scenario for Linux systems sounds quite
>> unrealistic to me. (And, from what I've read yesterday, I got the
>> impression that there had been a similar incident with Linux systems,
>> but I didn't study that further.)
>
> Sure. But remember, the various pieces of a Linux system are just
> inherently put together in a more modular, flexible fashion, and that
> includes systemd. That does reduce the chance for trouble quite
> significantly.

BTW - you are now in my kill fly, so you can troll the back of the hand
now...

On Sun, 21 Jul 2024 00:44:47 -0400, Popping Mad wrote:

> On 7/20/24 8:55 PM, Lawrence D'Oliveiro wrote:
>>
>> and that includes systemd.
>
> Umm no it doesn't

systemd myth 1: “systemd is monolithic”

<http://0pointer.de/blog/projects/the-biggest-myths.html>

On Sun, 21 Jul 2024 00:41:53 -0400, Popping Mad wrote:

> On 7/20/24 8:55 PM, Lawrence D'Oliveiro wrote:
>
>> systemd myth number 1: “systemd is monolithic”
>>
>> <http://0pointer.de/blog/projects/the-biggest-myths.html>
>
> You are a fucking idiot.

systemd-haters are like the anti-fluoridationists of the Open-Source world.

Lawrence D'Oliveiro <ldo@nz.invalid> wrote:
> On 21 Jul 2024 10:17:55 +1000, Computer Nerd Kev wrote:
>> That was very interesting. Although following the link to the article
>> about the whistleblower who quit Microsoft, guess who hired them next?
>
> What is that supposed to be suggesting, exactly? Is it saying something
> about the ethics of the whistleblower, or of the company who hired them?
> If so, what?

As is so often the case replying to you, I meant what I said in the
bit of my text that you snipped. The fact the whistleblower took up
a job at CrowdStrike after quitting M$ due to their management
culture suggested that CrowdStrike would be more responsible. But
the way this bug slipped out on such a wide scale contradicts that
now. I'm meerly commenting that the business of trying to protect
Windows systems from attack seems to be dodgy wherever you turn.

--
__ __
#_ < |\| |< _#

On 2024-07-20, Popping Mad wrote:

> On 7/20/24 6:08 AM, Nuno Silva wrote:
>> As far as both are Turing-complete, there's probably not much difference
>> in capabilities for this discussion. Windows does not hold a monopoly in
>> the capability to run code with errors.
>>
>> (In fact, given that Broadcom has their own wireless linux drivers,
>> possibly with the same quality level as their firmware...)
>
>
> For thirty years people have been saying stupid and meaningless stuff
> like this. It is garbage.

(Are you dismissing computer science as garbage?)

> The Windows situation... OBVIOUSLY... would never happen in a Linux
> evironment although systemd makes a huge step forward to make it
> possible.

Not only it has reportedly happened already *on Linux systems*, it has
happened also with CrowdStrike, which highlights the obvious: the
problem isn't necessarily the system, but the bad code and the lack of
testing:

https://www.neowin.net/news/crowdstrike-broke-debian-and-rocky-linux-months-ago-but-no-one-noticed/

However, it is true that some systems, including Linux, may offer
something that avoids this risk altogether, see
https://nondeterministic.computer/@mjg59/112816011370924959

But the problem is still CrowdStrike, and they could always have choosen
to ignore this mechanism and continue with the same approach.

> It has nothing to do with turing machines and advanced theoretical
> calculations.

If you choose to ignore computer science, your loss. Turing completeness
does allow an abstraction here: bad code that runs on one Turing machine
can run on another Turing machine. It doesn't matter much if it's
Microsoft or not.

This is certainly one of the tools in the toolbox computer science
provides, and might even help avoiding some heated debates of "my
tool/language is better than yours", which sometimes are much less
rooted in actual technical differences and more in emotion. (There are
differences in features and interfaces that do matter, differences in
kernel design too, of course, but when it comes to the ability of
running GIGO code, that tends to be quite omnipresent.)

> It has to do with the more secure Unix level design for
> Linux based systems and the way decisions are made in Linux development
> and how updates are run and generated.

No, CrowdStrike seems to have intentionally made their own update
handling system. The fact that many Linux distros have decent package
management wouldn't have mattered here.

> Does this make Linux perfect.. No. But it gives it a shot. MS makes
> insecure decisions from the ground up for business decisions. We have
> spent a lift time watch MS systems doing things they just should be able
> to do making them rich targets for visues big and small, and malware...
> things like runnng fucking email as an executable binary and autoruning
> DVD software etc etc. I can't even begin to discuss what it does to the
> browser.
>
>
> So please... put your bullshit away.
>
> THis was inevitable and it is inevitable to happen again.

Yeah, but the Microsoft you blame has had for some years the ability to
save restore points and roll back if needed in Windows NT. And, from
what I've observed, this seems to be invoked with software installation
and possibly Windows updates too.

It might be painful to watch a Windows machine spending quite long to
install an update and then fail and roll back (they *do* need to improve
dependency management in this, because quite often they just don't pull
an update that is a dependency), but, at least as of NT 6.1, it *does*
do that.

I might not like Windows nor Microsoft, but... calling reality
"bullshit"...

--
Nuno Silva

On 2024-07-21, Lawrence D'Oliveiro wrote:

> On Sat, 20 Jul 2024 11:08:50 +0100, Nuno Silva wrote:
>
>> But immediately ruling out this scenario for Linux systems sounds quite
>> unrealistic to me. (And, from what I've read yesterday, I got the
>> impression that there had been a similar incident with Linux systems,
>> but I didn't study that further.)
>
> Sure. But remember, the various pieces of a Linux system are just
> inherently put together in a more modular, flexible fashion, and that
> includes systemd. That does reduce the chance for trouble quite
> significantly.

Well, there is one notable piece of software in Linux systems that's
quite monolithic, unless something has changed and I didn't get the
memo: the kernel itself.

If you write a bad quality module that crashes the kernel, what
mechanisms are there to recover from that?

--
Nuno Silva

On Sun, 21 Jul 2024, Popping Mad wrote:

> On 7/20/24 8:55 PM, Lawrence D'Oliveiro wrote:
>> On Sat, 20 Jul 2024 11:08:50 +0100, Nuno Silva wrote:
>>
>>> But immediately ruling out this scenario for Linux systems sounds quite
>>> unrealistic to me. (And, from what I've read yesterday, I got the
>>> impression that there had been a similar incident with Linux systems,
>>> but I didn't study that further.)
>>
>> Sure. But remember, the various pieces of a Linux system are just
>> inherently put together in a more modular, flexible fashion, and that
>> includes systemd. That does reduce the chance for trouble quite
>> significantly.
>
>
> BTW - you are now in my kill fly, so you can troll the back of the hand
> now...
>

Wise choice! I also discovered that Lawrence was just a troll and choose
the same action. He really has nothing of value to say in my opinion.

In <669c53b2@news.ausics.net> Computer Nerd Kev wrote:

[Snip...]

> That was very interesting. Although following the link to the
> article about the whistleblower who quit Microsoft, guess who
> hired them next?
>
> ""The decisions are not based on what's best for Microsoft's
> customers but on what's best for Microsoft," said Harris, who now
> works for CrowdStrike, a cybersecurity company that competes with
> Microsoft." ...

[Snip...]

> So it indeed seems like you can't really rely on any company in
> this market.

.... and IMO that's why creeping featurism is more than simply an
inconvenient complication in FOSS.

It's a slippery slope into a semi-proprietary environment, where
cutting corners inevitably takes priority over reliability.

For example Red Hat, getting all pissy with Alma about access to
source code and libraries:

Impact of RHEL changes to AlmaLinux
....
Jun 22, 2023
https://almalinux.org/blog/impact-of-rhel-changes/

A related example in smart TV reliabilty (note slrn line-wrap):

Will the new judicial ruling in the Vizio lawsuit strengthen the GPL?
....
January 16, 2024
https://blog.tidelift.com/will-the-new-judicial-ruling-in-the-vizio-lawsuit
-strengthen-the-gpl

--
Regards, Weird (Harold Stevens) * IMPORTANT EMAIL INFO FOLLOWS *
Pardon any bogus email addresses (wookie) in place for spambots.
Really, it's (wyrd) at att, dotted with net. * DO NOT SPAM IT. *
I toss GoogleGroup (http://twovoyagers.com/improve-usenet.org/).

Popping Mad <rainbow@colition.gov> wrote:
> The Windows situation... OBVIOUSLY... would never happen in a Linux
> evironment although systemd makes a huge step forward to make it possible.

Ah, but, not so "obviously", given that a a few months back,
CrowdStrike's Linux kernel module caused crashes and non-booting.

CrowdStrike broke Debian and Rocky Linux months ago, but no one noticed
https://www.neowin.net/news/crowdstrike-broke-debian-and-rocky-linux-months-ago-but-no-one-noticed/

The above article includes this quote, which just might be on the path
to the true problem:

"Crowdstrike's model seems to be 'we push software to your machines
any time we want, whether or not it's urgent, without testing it',"
lamented the team member.

This quote comes after these two bits:

The update proved incompatible with the latest stable version of
Debian, despite the specific Linux configuration being supposedly
supported.

...
It took them weeks to provide a root cause analysis after
acknowledging the issue a day later. The analysis revealed that the
Debian Linux configuration was not included in their test matrix.

Nuno Silva <nunojsilva@invalid.invalid> wrote:
> Well, there is one notable piece of software in Linux systems that's
> quite monolithic, unless something has changed and I didn't get the
> memo: the kernel itself.
>
> If you write a bad quality module that crashes the kernel, what
> mechanisms are there to recover from that?

Boot into single user mode (hopefully the module is not autoloaded by
the kernel itself) and remove/rename the module file.