Sunday, April 16, 2006

We have met the enemy (and he is us)

An article written by George Ou and titled "Linux zombies show platforms don't matter" underscores the peril you take when you decide to point out problems with F/OSS software in general, and Linux distributions in particular. George documented the trials and tribulations of one Richard Stiennon and the trouble he got into when he pointed out how Linux systems running Apache and PHP were compromised and turned into zombies. The ability to hunt down and compromise these types of systems were documented by Richard this way:
The hacker used a common mis-configuration in PHP scripts to take over Linux machines and use them for his army of zombies. What is scary about this is that these machines are typically web servers on broadband connections, unlike the usual collection of PCs on college campuses that are part of a bot-herd. So they are much more deadly, especially when combined into a single force. The PHP script is easily searchable on Google so the hacker automated his harvesting activity by having each infected machine search for more machines to infect using Google results to seed the search.
When he attempted to point out this flaw he was flamed by some of the Linux zealots for being a Windows 'fanboy' and being incompetent. Excuse me? Since when does pointing out a serious flaw in the configuration of an important software stack such as LAMP constitute being a stooge for Microsoft? If it had been Windows and IIS that had suffered this security issue you can be assured that those self same zealots would have been all over the story like ugly on an ape, hooting like apes that here was yet another example showing the dangers of using Microsoft software.

It's behavior like this exhibited by the Linux zealots that over time damage the reputation and erode the credibility of the overall Linux community. And if Linux supporters such as Richard Stiennon can't write about issues and offer constructive criticism of important problems, then fewer will bother to raise their voices on other equally important issues when they appear. Linux is not perfect. Windows, whether the Linux zealots want to admit it or not, is a good alternate choice to Linux (remember how Linux is about choice?). Shooting the messenger is not the answer. Listening to the messenger is the right choice. Acting on the message to fix Linux and make it better is the best choice of all.

No comments:

Post a Comment

All comments are checked. Comment SPAM will be blocked and deleted.

Note: Only a member of this blog may post a comment.