Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Software

The Software Monoculture 404

Posted by michael from the dutch-elm-disease dept.
balster neb writes "CNET News.com has a piece titled 'Seeds of Destruction' on monoculture in software and its effect on security. The article talks about similarities between software attacks such as last year's MSBlast, and agricultural catastrophes such as the Irish Potato Famine. Isn't this another good argument against monopolies?"
This discussion has been archived. No new comments can be posted.

The Software Monoculture More

The Software Monoculture

Comments Filter:

  • Not just monopolies (Score:5, Insightful)

    by grasshoppa ( 657393 ) * on Friday January 16, 2004 @01:48PM (#8000422) Homepage
    Isn't this another good argument against monopolies?"

    In a very near sighted way, yes. But we are talking about mono-cultures here, which is a bit more broad than that. And, something that the linux crowd will want to be wary of.

    With all the momentum behind linux right now, it could soon find itself faced with the same problems MS is faced with. While I don't doubt the ability of the linux folks to find better solutions than MS did, it is still a concern that people should be aware of.

    • Re:Not just monopolies (Score:5, Insightful)

      by Carnildo ( 712617 ) on Friday January 16, 2004 @01:56PM (#8000520) Homepage Journal
      Linux can't be a monoculture in the way that Windows is. There are too many variations from box to box -- one worm that targets a buffer overflow in OpenSSL uses over a dozen different attack modes just to handle different versions of RedHat, and this is just to deal with boxes that use standardized, pre-compiled binaries. Once you factor in the fact that there are at least two different programs you can use for a given operation, and that many of these programs are compiled by the end user (using any of a number of different, binary-incompatible compilers), you find you've got a platform that can't be vulnerable to the "one-size-fits-all" attacks that Windows keeps getting hit with.
      • That's true, but all it really means is that the malcontents will have to work harder. You don't really expect them to give up, do you?

      • Re:Not just monopolies (Score:5, Insightful)

        by ManoMarks ( 574691 ) on Friday January 16, 2004 @02:02PM (#8000592) Journal
        As Linux gets more powerful, however, you're more likely to see turn-key solutions, out of box servers that have little or no modification by vender. That's when you'll see the real danger from attacks.
        • Cobolt Raqs, anybody?
        • While that will mean that once a single manufacturer's box is hacked, the rest are vulnerable, it won't mean that every linux box in the world is vulnerable, unless all the manufacturers make the same choices when building their boxen.

        • Re:Not just monopolies (Score:5, Insightful)

          by 31415926535897 ( 702314 ) on Friday January 16, 2004 @02:45PM (#8001103) Journal
          As Linux gets more powerful, however, you're more likely to see turn-key solutions, out of box servers that have little or no modification by vender. That's when you'll see the real danger from attacks.

          So what you're saying is that there are a lot of operator errors? There are a lot of people who install software but then don't change the defaults to secure it. I've seen that happen with RedHat...if you don't install the patches right after you install it (and you allow it in the net), it gets hacked (this was back during version 7 I believe).
          Same thing happens with Microsoft. It does become unsecure for the default install--the default settings. How long did people know about the RPC vulnerabilities before the first worms attacked it, and yet hardly anybody patched their boxes.

          I'm not trying to make a case that Microsoft is as secure as Linux (not by a long shot), but while we have (uneducated) users operating their computers, no matter what the platform, exploits will be successful. I have run many Windows machines over the years, both workstation and server, and not once has one of the machines I'm responsible for been hacked or hit by a virus/worm. However, I have run Linux boxes before, and because I'm not as familiar with them, they have been exploited (remote root exploits--I had to give my machine up to the FBI for investigation, this was back when I worked at a government institution).

          The best you can do is write secure apps, but people will always fail at some point because no one is perfect. Exploits will always exists, and many exploits will be discovered over time. But if you don't have the users updating to covers the holes in the software they are using, it doesn't matter which OS they use, or which culture it came from, they will be hacked. And I believe that even if Linux were to gain 90% overall marketshare, we would still see as many problems as we do with Microsoft because of the users.

      • Re:Not just monopolies (Score:5, Insightful)

        by grasshoppa ( 657393 ) * on Friday January 16, 2004 @02:07PM (#8000664) Homepage
        Sure, that's mostly true right now. However, let's take a look at some of our more popular software packages:

        sendmail: I don't even know how many root exploits there have been in the past 2 years, but I do know that a respectable percentage of MX'ers out there run it. For you folks on sendmail: qmail. Trust me on this one.

        bind: Another of our more charming packages, that should have been replaced years ago due to multiple vulnerabilities. Again, no numbers, and I don't remember seeing any exploits in the past year ( I don't run it, so i don't pay as close of attention ), but this one was a popular attack vector at some point.

        apache www: Fairly secure from my understanding, only mentioned here because it runs over half the websites out there. Ask yourself this: Name one other webserver for linux/*bsd. Most people can't.

        So as you can see, the danger is there. Common software packages, commmon kernel, the potential is there.

        • Re:Not just monopolies (Score:5, Insightful)

          by Carnildo ( 712617 ) on Friday January 16, 2004 @02:17PM (#8000784) Homepage Journal
          apache www: Fairly secure from my understanding, only mentioned here because it runs over half the websites out there. Ask yourself this: Name one other webserver for linux/*bsd. Most people can't.

          Apache for Linux isn't the same as Apache for BSD isn't the same as Apache for Solaris isn't the same as Apache for Windows isn't the same as...

          A worm that can exploit a vulnerability in Apache for BSD might simply crash Apache for Windows, be totally ineffective against Apache for Solaris, and have differing effects against Apache for Linux depending on what compiler was used. A worm that can exploit a vulnerability in a given version of IIS can attack all copies of that version, because all the copies are running from identical binary images on operating systems with identical memory layout schemes. In order to be a monoculture, a program needs to have more than just the source code the same.
        • Medusa - a web server that runs under linux/unix...

  • C|Net (Score:5, Funny)

    by daeley ( 126313 ) * on Friday January 16, 2004 @01:48PM (#8000423) Homepage
    C|Net. C|Net run. C|Net run and bite the hand [microsoft.com] that feeds it. Bad C|Net, bad!

  • Be it Famine or MSBlast (Score:5, Funny)

    by Yoda2 ( 522522 ) on Friday January 16, 2004 @01:49PM (#8000435)
    Luckily there's a remedy for both... Guinness [guinness.com]
  • "Seeds of Destruction" sounds like a typical aspect of nerd monoculture allright.

  • Monopolies (Score:4, Insightful)

    by pantycrickets ( 694774 ) on Friday January 16, 2004 @01:50PM (#8000455)
    Isn't this another good argument against monopolies?

    You could use the same argument against "standards." But you wouldn't. Yes, if everything were made completely different from everything else, sure, it would be harder to mount large scale attacks against anything. You would have to tailor your exploit to all of the different architectures you are interested in. The downside of course is that you will have thousands of people constantly working on different designs for the same wheel. Promoting diversity within even a company like Microsoft would likely accomplish the same thing, but once again, would be highly impractical.

    • Re:Monopolies (Score:3, Interesting)

      by YU Nicks NE Way ( 129084 )
      In fact, the monoculture argument is used all the time against SMTP, just in different words. The difference is that the only way to fix a broken standard is to replace it. Microsoft argues that its operating systems are fixable. Whether or not that's true is still debatable, although the evidence support MS to date.

    • Re:Monopolies (Score:3, Insightful)

      by Daniel Dvorkin ( 106857 ) *
      Silliness. No one is saying, "Make everything different from everything else." They're saying, "Have a few different types of major [crops|systems] so that if something bad happens to one, you can still keep going." Your "thousands of ... designs for the same wheel" world is a straw man.
    • You would've gotten my mod points if I had any.

      We could make a more general argument against not standards, but Bad standards. Think of SMTP versus SSH.

    • Re:Monopolies (Score:5, Insightful)

      by JimDabell ( 42870 ) on Friday January 16, 2004 @02:03PM (#8000612) Homepage

      You could use the same argument against "standards."

      No you couldn't. IIS and Apache both implement the HTTP standard, but only one of them was vulnerable to Code Red et al.

      Avoiding a monoculture doesn't mean making everything as different as possible. It means that one implementation of a standard shouldn't monopolise the marketplace. If anything, open standards promote this, as you are free to use differing implementations rather than the single implementation that can handle a particular proprietary format or protocol.

      • Many different vendors implemented SMTP/POP3 and TCP/IP differently - and yet they were all succeptible to their historical fiascos.

        We got a TTL field, a clean-up of the Ack response, and a reorganization of the old email-handoff architecture - but it still ended up costing a comparable amount of time and resources to deal with as any other hack.

        HTTP, like any technical standard monoculture, is also susceptible to legal problems - just as linux is. The [object] debacle is going to cost more than just mic

    • "De Facto" standards (Score:5, Insightful)

      by hey! ( 33014 ) on Friday January 16, 2004 @02:27PM (#8000875) Homepage Journal
      It is not standards that are a problem, it is "De Facto" standards.

      A "De Facto" standard is really not a standard at all. It's just an implementation that happens to gain critical mass.

      In (economic) theory, such an implementation should be the Darwinian best; in theory the best product always wins. However, we know from engineering experience this is almost always untrue. Another way to put this is that fitness to reach monopoly status is not necessarily fitness for the tasks and uses to which we'd like to put a thing.

      The advantage of real standards over "de facto" standards are that they designed to allow multiple competing implementations, avoiding the monoculture problem. The other advantage is that that they are "designed" rather than just happening.

      The disadvantage of standards over "de facto" standards is that the standards process is less agile at the outset.
      • In (economic) theory, such an implementation should be the Darwinian best; in theory the best product always wins. However, we know from engineering experience this is almost always untrue.

        No. The concepts behind natural selection almost alway hold true.

        The problem is that it's not the case that "the best product always wins", the way you're thinking of it.

        You probably evaluate "best" based on several metrics like performance, price, configurability, etc.

        The problem is that your assumptions are wrong

    • You're being silly (Score:4, Insightful)

      by 2nd Post! ( 213333 ) <gundbear@p[ ]ell.net ['acb' in gap]> on Friday January 16, 2004 @02:27PM (#8000877) Homepage
      False logic: You talk about the weakness of standards, which is valid, and then switch topics. The logic breaks when you do that.

      You talk about the difficulty of diversity in an extremely exaggerated and unrealistic manner as a solution against standards and monoculture, when the realistic solution is neither.

      In real life, you have competing *standards*. DVD-R and DVD+R. Blueray and HD-DVD. uPnP and Zeroconf. POP and IMAP. And often times, in real life, you don't settle for *one* standard, you accept multiple. Of course there are exceptions, like HTTP and BIND or TCP/IP protocols, but your argument has no bearing on reality otherwise.

      So you then talk about diversity being impractical, without supplying any logic whatsover. You just assume because encouraging *no* standards is impractical, that diversity is impractical. They are different.

      Support multiple standards, support open standards, and their implementation is not impractical, highly or otherwise. That is the whole reason standards exist!

      Use different hardware and OSes to protect a company is not 'highly impractical' NetBSD on x86 for firewalls. Solaris on Sparc for servers. Linux on Itanium for compute nodes. OS X on PPC for desktops.

      This is *natural* because each environment and tool have different strengths and weaknesses. It's like having multiple tools in a tool chest!

      You wouldn't use Linux and Itanium for *everything*. Nor would you use OS X on PPC, or Solaris on Sparc. Nor *should* you use Windows on x86. It makes you too vulnerable and weak, and you sacrifice the strengths of each platform and environment!

    • Standards are good (Score:3, Interesting)

      by alispguru ( 72689 )
      Things are at their safest when we have:

      Open specifications

      With multiple implementations

      On multiple platforms

      This is what published standards allow.

      Monopolies tend to produce:

      Closed specifications

      With single implementations

      On single platforms

      which is why they're easier targets for exploits.

      Note that most of the modern scripting languages occupy an intermediate point here, since they tend to have a single implementation which effectively is the specification. Perl/Ruby/tcl are like that. Python i

    • a labrynth (Score:4, Interesting)

      by theCat ( 36907 ) on Friday January 16, 2004 @05:33PM (#8003095) Journal
      "Standards" contribute to the problem of monoculture in much the same way that standardizing on "front door with lock that opens with a key" contributes to home burglary. For that matter, all thieves speaking the same language in their home town makes it easier to discuss burglary. But the same standards also help us get around every day, so there is a tradeoff.

      Now, interestingly enough, I suspect we are heading for an era of fewer such standards! Communication is already in flux due to encryption; my encrypted discussion with another person will appear as complete jibberish when intercepted, like when the Japanese intercepted US Navy transmissions that were actually clear-text conversations between North American Indians working in the radio room. As for locks...what happens when homes lose their locks in favor of AI, and simply recognize who can come in and who cannot? It is much harder to crack a system that is watching you while you attempt to crack it. After all, the house could simply kill you if it had the right weaponry. At the least, it would not be as gullible as a lock.

      OK...my point approaches. Think for a moment about the shifting stairways and jumping rooms (well there was one at least in the last book) in the fabled Hogwarts School of Witchcraft and Wizardry. Ignore for a moment all the spellcraft going on...just look at what you could do with the architecture...can you imagine trying to take that place with a SWAT team? What route would they storm through? What alternates would they plan? What if things started moving even faster during a suspected attack? Further, what if the students and staff knew the rules and could function well enough regardless? An assault would not even bear the attempt. Given a similar kind of approach to software (and it really is just an approach, not magick at all) the best defensive strategy in OSs would be to have them randomize themselves on-the-fly. Most binaries could afford a certain amount of NOP space inserted. During final compile a "deviantC++" compiler could randomly insert busy loops or security trips or even totally bogus code, like whole other apps laying around already (games come to mind) and have them jumped over by properly executing code. We have plenty of RAM on our systems and generally an excess of CPU cycles; let 50% or more of binary be lines of random or calculated diversion codes. And let the code move itself around!

      We're so accustomed to the idea of optimizing code. We even reuse code and data objects and this is seen as a virtue and at present it is. But we could quickly decide that times have changed and it is no longer a virtue. My machine no longer has just 640K RAM, guys, and it has enough spare CPU to run Setiathome. I'm willing to sacrifice some of my slack for an OS and apps that gleefully rewrite themselves every few minutes. If that became very common then the notion of exploiting a computer remotely via known vuls would become a quaint memory of a primitive era in technology.

      And now I will hustle my butt over to the USPTO to patent this scheme for the financial benefit of my heirs. Remember, you read it here first.

  • Not a good connection (Score:5, Insightful)

    by The Terrorists ( 619137 ) on Friday January 16, 2004 @01:51PM (#8000463)
    Potato famine was not deliberate - it was caused by a microorganism. Both the hack and the monopoly are socially constructed. Science can fight the former, but not the latter.

    • Re:Not a good connection (Score:3, Informative)

      by TomQ ( 20220 )
      Not necessarily true; Famine was caused by several factors including:

      * Farms were split between all of the children resulting in smaller and smaller pieces of land, which only potato (-e if you're Dan Quale) farming produced enough food to feed the families.

      * 8 million people on the island (currently around 5.5m) dropped to under 3 after the famine.

      * Best land was taken by mainly absentee landlords. (btw. 1845 was a bumper year for Wheat etc. Much more food was exported that year than usual)

      tom.
    • Potato famine was not deliberate - it was caused by a microorganism. Both the hack and the monopoly are socially constructed.

      I don't understand why you draw a difference. It is either possible or will soon be possible to design a virus to attack a certain plant. Releasing such a virus into a monoculture will devastate it.

      Nature's answer is biodiversity.

    • Re:Not a good connection (Score:5, Insightful)

      by Wandering Hoosier ( 621835 ) on Friday January 16, 2004 @02:30PM (#8000902)
      Potato famine was not deliberate - it was caused by a microorganism. Both the hack and the monopoly are socially constructed. Science can fight the former, but not the latter.

      However, the "monoculture" policy of having an entire population's survival depend on a single crop WAS deliberate. The policy was just as "socially constructed" as a monopoly. Therefore, the connection between the two is a good one.

  • Loss of life... (Score:5, Insightful)

    by AgentOJ ( 320270 ) on Friday January 16, 2004 @01:51PM (#8000467)
    Of course, it is obvious that no computer virus has caused loss of human life (yet). However, it is probably only a matter of time until a virus or computer bug causes a massive loss of human life. Due to our huge reliance on computers, and due to the fact that 90% of the computers out there are running the same OS (including some of those that control critical infrastructures like 911, nuclear reactors, etc), the frightening implication is that in the event of a loss of life, it could be much, much worse than the Irish Potato Famine.

    • Re:Loss of life... (Score:4, Interesting)

      by MsGeek ( 162936 ) on Friday January 16, 2004 @01:59PM (#8000568) Homepage Journal
      The Blaster worm might have slowed reaction to the conditions that precipitated the Blackout of 2003. I believe a handful of people died as the result of the blackout.

      BTW: this is a great article, great to show the PHBs that perhaps having a diversity of platforms is better than "standardizing" on one. Standardizing on one platform, be it Windows, Linux, MacOS X or even Amiga, is bad policy and potentially dangerous.
  • Coming soon: The Irish Potato Virus!

    Kierthos
  • To add to michael's point, Jonathan Wignall [defcon.org] made an excellent presentation [defcon.org](sorry it's PPT) at DefCon 11 last year about how we could fight network worms.

    He basically concluded that we could not launch counter worms (like ones that would patch vulnerable Windows systems). The best solution was to diversify the OS we have our servers running on. A worm can spread in a matter of minutes as the creator of the worm usually chooses a set of powerful vulnerable machines as his first hit.

    Some OS like to keep

  • How do you make the correlation??? (Score:3, Insightful)

    by _PimpDaddy7_ ( 415866 ) on Friday January 16, 2004 @01:54PM (#8000494)
    "People have brought over species that we didn't expect here, just like people have created viruses that Microsoft didn't expect to deal with," said Jeff Dukes, professor of biology at the University of Massachusetts at Boston, who studies diversity and growth in ecological systems. "These introduced species have had a major impact on our forest and have knocked out entire species."

    Excuse me, but how can you compare a biological occurrance to a technological occurrance? There are too many variables in the biological virus. Or can you in fact make a definite comparison?

    Saying people created viruses Microsoft didn't expect to deal with is bogus. That's a cop-out.

    Microsoft was well aware of many of it's security holes. It's been going on for years.

  • There is a significant difference between what's happening in computer security and the potato famine. They didn't know any better than to farm without diversity at the time. We've learned a great deal about agriculture and soil conservation since then... the famine itself was one large, nasty lesson.

    The big difference wrt computer security is that we *do* know better and are still failing to get it right! The phone "Phreaks" from decades past should have taught us a lesson (not to mention the telco's o

  • BIND is also a Monoculture (Score:5, Insightful)

    by Pup5 ( 543611 ) on Friday January 16, 2004 @01:54PM (#8000502)
    I think that this concept also applies to BIND.

    Most DNS servers run either ISC BIND, or a package based on BIND source. Although I am a hostmaster and respect BIND, I often wonder if this isn't one of the reasons that DNS is such a prime hacker target.

    It seems clear that even with this example of an open-source program (although it's not GPL), groups prefer to avoid the cost of development at the expense of security (via the same monoculture argument). I've asked DNS appliance vendors this question (while they're trying to sell me on their product's security), and it's clear that they've never seriously considered the issue.

  • Not the same (Score:4, Insightful)

    by somethinghollow ( 530478 ) on Friday January 16, 2004 @01:54PM (#8000508) Homepage Journal
    "People have brought over species that we didn't expect here, just like people have created viruses that Microsoft didn't expect to deal with"

    The difference here is that we have US Customs doing its best to stop people bringing forigne species over. If US Customs did things like Microsoft, they would hand out culture dishes to exicute your Windows Script code on and implant your cultures into the environment w/o asking the end user.

    It's funny how a company can leave holes in everything, let people get used to being insecure, then tout fixing the problems as an innovation [microsoft.com].

  • Same Argument Applied to Standards (Score:5, Insightful)

    by fiendo ( 217830 ) on Friday January 16, 2004 @01:55PM (#8000511)
    Couldn't this same argument be applied to omnipresent standards and not just monopolies? If everyone uses TCP/IP and a security flaw is found in it, doesn't that amount to the same type of security threat?

    And yes I'm playing devil's advocate, but it's a slow morning :)
    • Couldn't this same argument be applied to omnipresent standards and not just monopolies? If everyone uses TCP/IP and a security flaw is found in it, doesn't that amount to the same type of security threat?

      Yes, it would be. However, consider that if many people implemented TCP/IP independently, one of them might have realized that the protocol is flawed. If we all just borrowed BSD TCP/IP code without even reading it, we would be approximately as vulnerable as a proprietary protocol.

  • Comparing the potato famine and MSBlast is a fucking joke. Whoever comes up with these analogies needs to learn how to communicate better and find more creative uses for their time than to post thinly veiled attacks at Microsoft.

    Give it up already.
    • Comparing the potato famine and MSBlast is a fucking joke

      Only if you can defend the contrary. Arguments, please?
      • Potato Famine: people died by the cartful.
        MSBlast: affected computers were unusable until patched.

        There's one. Comparing computer problems to real-world situations where death is involved is a mistake (aka: a fucking joke.) Just like the comparison of Windows to automobiles.

  • Yes (Score:2, Interesting)

    by drewbradford ( 458480 )
    Yes. It's an argument against monopolies. But it's also an argument against standards and any kind of compatibility.

    With the good comes the bad.

    • Not at all (Score:5, Insightful)

      by 2nd Post! ( 213333 ) <gundbear@p[ ]ell.net ['acb' in gap]> on Friday January 16, 2004 @02:16PM (#8000776) Homepage
      Why is arguing against monopolies arguing against standards or arguing against compatibility?

      The presence of a monopoly *guarantees* a standard, but does not guarantee compatibility. Microsoft can (and has, accidentally) broken compatibility between various versions and flavors of it's various programs.

      The absence of a monopoly does not have any bearing on standards or compatibility. It is, in fact, preferred for there to be a standard in the absence of monopoly; witness the DVD standard, the CD standard, the various interface standards...? It means that people can talk and interact sanely when no one individual has control.

      If you mean diversity argues against standards and compatibility? I don't think that holds either.

      Philips, Panasonic, Samsung, Sony, IBM, Apple, Dell, RCA, Aiwa, and Kenwood all adhere to the CD standard, and thus a CD that can play in one can play in all, without there existing a monoculture or a monopoly. The same holds true of paper, nails, DVDs, and many other things. Of course some products are crappier than other products, which affect compatibility and quality, but it's not due to lack of monoculture, since Microsoft decisively also has crappy products and crappy quality as well.

      Diversity means competition.

      Last I recalled, competition meant progress, and growth, as well as strength and robustness. If one product/method/attempt fails, then another can succeed. If one is suboptimal, and alternative may be optimal.

      In a monoculture, none of that applies. You can't have difference without choice, you can't have competing theories without choice, you can't have flexible strengths without choice.

      You just have no choice.

  • Glossing over the heart of the matter... (Score:5, Insightful)

    by Cap'n Canuck ( 622106 ) on Friday January 16, 2004 @01:58PM (#8000542)
    The article glossed over the heart of the matter...

    Most of it, however, was intended for export to England.

    ...except for that brief mention. The English were the ones that killed the Irish, because they demanded payment in food, even when the Irish could not pay.

    To liken the conditions of the software industry to the Irish Potato(e) famine is ridiculous. To whom or what is the industry beholden to? If we cannot produce code will we starve to death? Is someone occupying our cities and towns, threatening our lives if our code fails to compile? I'm not Irish, (though I do like potatoes), but please think again before you make analogies such as these.

    Sig Hire!

  • Not a new argument (Score:2, Informative)

    by Jokkey ( 555838 )

    This isn't really a new argument. Marcus Ranum's web site [ranum.com], for example, contains a counterargument, links to articles discussing arguments for and against, a link to the paper by Dan Geer that brought the monoculture argument into the limelight, and some sarcastic comments on the new monoculture study that the C|Net article mentions. ("$750,000 to sit around and whine about Microsoft? How do I get a gig like that?!")

  • There is still no substitution for good (that is with the security in mind) programming practices. And of course readily available information about vulnerabilities.

    I think it matters not that much if you have 90% boxes on the net running windows (God forbid, really!) and 10% of "others". Or it breaks down different way. Nmap [insecure.org] does very good job identifying remote operating system nowdays. So for a persistent and dedicated cracker it should not matter that much if you have a "monoculture" or big veriety o

  • what are you talking about? (Score:3)

    by Joe the Lesser ( 533425 ) on Friday January 16, 2004 @01:58PM (#8000549) Homepage Journal
    Boardwalk and Park Place rule! Potatoes have nothing to do with this! And, yes, buy the railroads, you'll need the income.

  • Potato famine fallacy. (Score:5, Informative)

    by lothar123 ( 264370 ) on Friday January 16, 2004 @01:59PM (#8000556)
    Admittedly, this is off-topic. But I did my Ph.D. on the stuff and comments like that perturb me!

    It is a common misconception that the disease known as late blight, caused by the Oomycete (Phytophthora infestans) "caused" the Irish potato famine. Yes it is true that the Irish were growing only a few varieties of potato (monoculture), but the REAL reason was the socio-economic structure put in place by those bastard English. Essentially, most of the Irish farmers (which was damn near everyone), "rented" the land from rich English landowners. This meant that they grew vegetables, wheat, etc. to pay for the rent, and grew potatoes for food because they stored well. Late blight reduces crop yield both before harvest (lost foliage) and after harvest (tuber rot), and by removing potatoes as a food source, the Irish began starving. The English did nothing to help the them during this time. In fact, the rental system stayed in place throughout the whole famine.
    • Abstract a bit.

      The socio-economic structure at the time can be likened to corporate addiction on Microsoft products. Because of the large investment in Word format documents and interoperability needs, your company is stuck with Office and Windows (unable to plant other varieties of potatoes). This monoculture is easily taken down by a single attacker, as we've seen several times now.

      The attack would not have been possible if there was true diversity in both cases. Diversity would've been possible if

    • The English did nothing to help the them during this time.

      I seem to recall that the Queen donated 10 pounds to Irish Famine Relief. Of course, that was also how much she gave to her favorite animal shelter...

      Your point is well-taken, but it has some uncomfortable consequences. Consider that most people on this planet don't get enough to eat. They're not as badly off as the potato-dependent Irish, but they're still pretty badly off. And, like the Irish, they're not starving because there's no food to fee

  • The fact is that copyrights, the "right" restrict what other people copy, is an inherent restriction on peoples freedom. And leads to similar problems.

  • The famine was due to the British, not potatoes (Score:4, Informative)

    by crush ( 19364 ) on Friday January 16, 2004 @02:01PM (#8000589)

    To make my point very clear: British theft of Irish land and the systematic exclusion of the Irish from all occupations except farming and laboring meant that the only crop which was high-yield enough to be viable on the tiny plots of land left to the Irish was the potato.

    All during the famine Ireland exported corn grown on the landlord-owned estates to Britain.

    I realize that this isn't the central point of the post, but the phrasing implies a foolish choice on the part of those who suffered from the forced monopoly.

    • It would be more correct if the post had pointed out that lack of diversity of types of potatoes was a contributing factor to the famine. How the British enforced/controlled/created the narrow use of a few potato varieties is up to debate. If the potatoes hadn't failed everything would have been OK, that is not up to debate. It may be a lowly food to some, but spuds pack an energy wallop.

      • I was unaware of varieties of potatoes resistant to Phytophthora infestans being available at the time. Could you provide a reference for that?

        Your argument seems to insist on ignoring one contributing factor (structural constraints in choice of crop imposed from without) and focusing on another (lack of diversity in crop). That seems partial, especially when there's reason to believe that the "monoculture" would not have occured without the structural constraint. In other words the English misrule was

    • Just to provide a reference to the famine originating in British hands, the Von Mieses institute have a good article on the protectionist corn laws [mises.org]. I don't agree with much of the spin, but in essence it's correct.
  • In organic farming monoculture is anathema. Having a variety of species in the same field reduces exposure to disease. It is more work to farm like this so the product is more expensive but of better quality. The same can be applied to network running open source software, more work to properly maintain but more secure.
  • "There is a difference between biodiversity and computer diversity," said Scott Charney, chief security strategist for the company.

    Yeah, there is: biodiversity actually exists.

  • Hidden risks in agriculture (Score:5, Interesting)

    by Qrlx ( 258924 ) on Friday January 16, 2004 @02:09PM (#8000690) Homepage Journal
    It is a well-known fact that the Irish Potato Famine wasn't caused by a lack of potatoes; rather it was an overabundance of Irishmen.

    Seriously, though, agriculture is a risky proposition. Prior to European conquest of Africa, the natives largely existed as hunter-gatherers. As such they tended to just eke out an existence on what little food they could find. Also, humans naturally become infertile when they're not fed enough, so during a time of scarcity the population stabilized itself, with the standard very-young and very-old dying off.

    The Europeans brought agriculture to Africa. (I'm talking large-scale, tied-to-one-patch-of-dirt agriculture here.) This has upset the "natural balance" by creating subsistence farming. People do tremendously well during good years, but are devastated that much more when a drought comes along. The population swells greatly due to the static nature of life and the need for people to work the farms. Those same populations are routinely eviscerated by famine every decade or so. (Not to mention the social problems as formerly nomadic people have been lumped together in aribtrarty boundaries drawn by their conquerors.) For some reason Sally Struthers seems to think the solution to this problem is to provide more food. It's a short-term fix but it's also a vicious cycle.

    Agriculture can bring tremendous profit and clearly supply much more food than the hunter-gatherer lifestlye. But the risks are greater, too, especially once your society becomes dependent on large-scale farming. I saw on Discovery channel the speculation that years of poor harvests led to the extincion of some Middle American people around 1200 AD. (Mayans? I can't remember.) In modern times, we see these risks introducing themselves in new ways, such as mad cow disease, brought about by imposing a cannibalistic diet on cows, which in turn happens because of market pressures to keep producing cheaper meat for an increasing number of increasingly hungrier (to the point of obesity) population. Something has to give. We are also seeing the depletion of natural fish stocks, and the "latest study" says that farmed fish contain much more mercury and PCBs than wild fish.

    I liked the CNet article a lot; they could have mentioned SQL Slammer's apparent role in the blackouts last year. I guess that hasn't been explicitly proven and overty recognized, it would probably be too costly to Microsoft's share value, and by extension the economy, and by extension Bush's reelection strategy.

  • So what's the answer? (Score:4, Insightful)

    by smccto ( 667454 ) on Friday January 16, 2004 @02:10PM (#8000704)
    Firstly, the snide comment on monopolies is simply unwarranted and certainly not as sarcastically entertaining as I'm sure it was intended. Too often the word "monopoly" is used as merely a code-name for "those-who-are-winning-and-who-aren't-me!" So 'nuf said there.

    Secondly, the ubiquitous nature of the Internet is the single biggest reason behind it's success. While I agree that the "genetic makeup" of the Internet may also be its weakest link, I have to ask, "What's the alternative?"

    Look at how the Internet, much like the telephone, has made communication so much more efficient. It has opened channels across the world, across socio-economic cultures, across demographic diversities that have never been accessible before - at least to the average Joe/Jane. This would have been impossible if, say, every country was forced to use its own network transport layer. Sure, Cisco would love it - they'd be able to sell country-specific routers to automate the traffic translations. They'd make a fortune!

    Is the article suggesting that we create multiple network infrastructure to obfuscate malicious interrogation? If so, how could it be done without public standards - which would defeat the purpose anyway?

    The article's viewpoint is short-sighted. The answer is not to mutate the DNA of the Internet (Ethernet/TCP/IP/etc), but rather to enhance its perimeter defenses, such as SMTP. That protocol itself is way to vulnerable. Outlook is a fine product; I doubt anyone would argue that. But look how much it's been [editorially] attacked recently because it's based on an ancient protocol and has been jerryrigged to overcome the security holes of its communication layer.

    I don't know, maybe I'm rambling, but the article irked me. Just a bad day I guess.

  • Macintosh and French Wine (Score:4, Funny)

    by manganese4 ( 726568 ) on Friday January 16, 2004 @02:10PM (#8000705)
    To take the anology to the next level.

    MacOS X is then a graft of the macintiosh experience on top of good ol unix. Just like the french vineyards are French vines grafted onto american trunks and roots due to the fact a fungus ate all the french roots.

  • weakest link (Score:4, Funny)

    by happyfrogcow ( 708359 ) on Friday January 16, 2004 @02:11PM (#8000709)
    In November, the National Science Foundation granted three university researchers $750,000 to find the location and number of such weak links within the information infrastructure.

    Sure, but if I did an independent study I'd be thrown in jail under the Patriot Act and no one would hear from me again.

  • Never seen slashdoy so united in an opinion (Score:3, Funny)

    by subjectstorm ( 708637 ) on Friday January 16, 2004 @02:15PM (#8000767) Journal
    this is bizarre.

    i've been reading all the posts so far, and all of them appear to be in agreement.

    i'm not sure i've seen this level of agreement even over the SCO case. Once in a while you at least get a decent troll on the SCO topics.

    I feel like it's my duty as a concerned citizen to pick up the slack here, so um . . .

    the software monoculture is in every way exactly identical to the potato famine. in fact, it's so similar that i'm not sure they are different things. damn the irish and and their isecure monoculture. damn it.

    in other news, i think my pc might have SARS.

  • Reminds me of an argument I had... (Score:4, Funny)

    by Misch ( 158807 ) on Friday January 16, 2004 @02:15PM (#8000771) Homepage
    Reminds me of an argument I had with a member of RIT's support staff regarding RIT switching to Exchange for e-mail. Basically, it boiled down to me asking him if the old POP system would remain in effect for people like me who used programs like POPFile [popfile.com] to filter my mail.

    Basically his reply was that I shouldn't depend on one particular means of getting my e-mail. To which I replied "What do you think switching to Exchange/Outlook is doing?"

    Point, me.
  • Mostly,

    its what you like to believe, some say a zillion party democracy (Like most of Europe) is the best way to handle things, some say a two party system is best (The US, in practice).

    Some even think one of those "Great Dictator's" is the best. Them silly really.

    peace

    "/Dread"
  • on whether you believe this tripe or not. Is there a monoculture in the software industry? Are standards bad? Is it bad that my desktop is the same operating system as the guy in the next cube? That I use the same tools as the guy down the street? Is the world ending because I use TCP/IP to communicate over this horrible Internet thing? Does everything have to be black and white? Isn't it POSSIBLE that there are a FEW advantages to my father using the same operating system, etc. that I am? Isn't it
  • I'm a biologist, biatch!

    A biological population can experience genetic bottlenecks. For example, everyone in Iceland is practically genetically identical, since they are descended from a group of about a few dozen (already closely related) Vikings.

    The potatoes in Ireland where a similar example. Not only was everyone growing potatoes - all of these potatoes were descended from a small number of potatoes brought over from the New World. The original population of New World potatoes were genetically diverse - but the potatoes brought to Ireland were all especially susceptible to the fungus that brought on the Irish Potato Famine, so it was catastrophic.

    You can also get a genetic bottleneck in an entire species. The few surviving Andean condors probably only represent a fraction of the genetic diversity the Condor had at the height of its population. The diversity is gone forever.

    The same is not true for rarely used, or even completely unused, software. If some disaster befalls us that makes other operating systems useless, we can resurrect OS/2 Warp even if not a single installation remains anywhere in the world.

    On the other hand, without a population of OS/2 Warp installations, OS/2 Warp cannot evolve. It exists in a form of stasis that, over time, may render OS/2 inviable, in much the same way that environmental changes might drive the andean condor all the way to extinction (while it might have survived with the genetic diversity that the species has already lost.) /RANT

  • Your Government Dollars at Work (Score:4, Interesting)

    by DumbSwede ( 521261 ) <slashdotbin@hotmail.com> on Friday January 16, 2004 @02:31PM (#8000914) Homepage Journal
    The idea that one dominant OS would be bad from a virus susceptibility standpoint is not new. What amused me some years back was the Government charging Microsoft under antitrust laws, while at the same time agencies like NASA where issuing edicts that all software would be migrated to Windows. This in response to the large fraction of NASA engineers and Scientists using Mac, and then have file format inconsistencies.

    With Linux emerging as the platform of choice for scientific applications, I would imagine NASA has had to have changed this policy, so I would like to hear from some NASA people what the current policies are.

    One thing is clear, open source is being demonized by people with vested interests, and are trying to pass actual laws along the lines of "This is Godless and Communistic." I personally think open source is a really good fit for OS and language design. These are foundations on which everything else rests. Without open source you don't know if what you are building lies over a fault line or an artisian well.

    I'm sure Microsoft is cutting deals behind closed doors with various governments about putting in code to "track the bad guys". It's not just a matter of having stuff in there you don't know about, but having it steal your processor cycles, and having unintended interactions. And since it's black box and probably DRM, it will probably become illegal to deactivate it. And since you can't rip it out, or should even know it's in there, someone comes along with a real killer virus exploit that turns on your own DRM against you.

  • Tragedy of the Commons: Market Failure (Score:3, Interesting)

    by gruntled ( 107194 ) on Friday January 16, 2004 @02:33PM (#8000941)
    Monoculturalistic tendencies -- agricultural or technological -- develop because short term, they are more efficient, leading to economic benefits. Long term, of course, they are disasterous, because they lead to a lack of advancement and, if universal, lead to inevitable collapse of the entire system if a vulnerability exists and is exploited. This is a great example of what economists call "market failure," in which market forces drive a specific environment toward the *least* desirable outcome (for a primer on this problem, study articles relating to "the tragedy of the commons"). Eventually, such systems collapse because of these flaws, and are then subject to regulation or restrictive laws (see the government's ongoing oversight of Microsoft).

  • Monocultures in nature (Score:4, Funny)

    by mrogers ( 85392 ) on Friday January 16, 2004 @07:21PM (#8003965)
    One of the reasons that monocultures rarely occur in nature (except in artificially-selected crops) is the genetic crossover that occurs during sexual reproduction. Members of species that reproduce asexually are identical to their parents except for mutations - members of sexually reproducing species are not identical to either parent. Crossover allows a species to maintain a diverse gene pool without a dangerously high level of mutations (most of which are harmful). Sexually reproducing species are therefore less prone to epidemics than asexual species.

    The implications for internet security are clear: we have to teach computers to have sex. Luckily there are plenty of training videos [nebraskacoeds.com] available on the internet. I've been doing my bit for the future of network security by downloading these videos and showing them to my PC - I recommend you do the same.

Slashdot Top Deals

Single tasking: Just Say No.

Close