What comes next after the Cyber Security Strategy?
Here are some insights from Europe: http://www.neurope.eu/article/what-comes-after-cyber-security-strategy -- *----------------------------------------------------Kind Regards,Evans Ikua,* lanetconsulting.com, lpi-eastafrica.org, Skype: evans.ikua Twitter: @ikuae Cell: +254-722-955831
####snip##### The United States Computer Emergency Readiness Team, a part of Homeland Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system. read more http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec... ########snip##### Funny - I keep feeling that the US Gov KNEW about this hole for many years :-) Meanwhile, use the Internet Explorer browser only if you think you have nothing important to lose. No wonder President Putin has been a worried man and wants to move his staff back to typewriters :-) walu.
Well put Walu. This is the strategic dilemma of using closed source proprietary software. I am sure the lessons that Russia learns from this will inform other governments that you are only as free as the technology that you use. Evans On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet < kictanet@lists.kictanet.or.ke> wrote:
####snip#####
The United States Computer Emergency Readiness Team, a part of Homeland Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system.
read more
http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
########snip#####
Funny - I keep feeling that the US Gov KNEW about this hole for many years :-)
Meanwhile, use the Internet Explorer browser only if you think you have nothing important to lose. No wonder President Putin has been a worried man and wants to move his staff back to typewriters :-)
walu.
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/ikua.evans%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- *----------------------------------------------------Kind Regards,Evans Ikua,* lanetconsulting.com, lpi-eastafrica.org, Skype: evans.ikua Twitter: @ikuae Cell: +254-722-955831
But Mr. Ikua, The equally open source software known as OpenSSL had a glaring hole for years, which some suspect the US government might have known about too. For as long as we have had software, so have we had software bugs, be it open, closed or ajar :-) On Tuesday, 29 April 2014, Evans Ikua via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Well put Walu. This is the strategic dilemma of using closed source proprietary software. I am sure the lessons that Russia learns from this will inform other governments that you are only as free as the technology that you use.
Evans
On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet < kictanet@lists.kictanet.or.ke<javascript:_e(%7B%7D,'cvml','kictanet@lists.kictanet.or.ke');>
wrote:
####snip#####
The United States Computer Emergency Readiness Team, a part of Homeland Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system.
read more
http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
########snip#####
Funny - I keep feeling that the US Gov KNEW about this hole for many years :-)
Meanwhile, use the Internet Explorer browser only if you think you have nothing important to lose. No wonder President Putin has been a worried man and wants to move his staff back to typewriters :-)
walu.
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke<javascript:_e(%7B%7D,'cvml','kictanet@lists.kictanet.or.ke');> https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/ikua.evans%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
--
*----------------------------------------------------Kind Regards,Evans Ikua,* lanetconsulting.com, lpi-eastafrica.org, Skype: evans.ikua Twitter: @ikuae Cell: +254-722-955831
-- with Regards: blog.denniskioko.com <http://www.denniskioko.com/>
Thats not the issue. There is no software that is absolutely secure, open or closed source. The issue is being able to get into the code and find out if there are backdoors where someone else is snooping on your systems and data, especially if you are a Government. On Tue, Apr 29, 2014 at 3:20 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
But Mr. Ikua, The equally open source software known as OpenSSL had a glaring hole for years, which some suspect the US government might have known about too.
For as long as we have had software, so have we had software bugs, be it open, closed or ajar :-)
On Tuesday, 29 April 2014, Evans Ikua via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Well put Walu. This is the strategic dilemma of using closed source proprietary software. I am sure the lessons that Russia learns from this will inform other governments that you are only as free as the technology that you use.
Evans
On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet < kictanet@lists.kictanet.or.ke> wrote:
####snip#####
The United States Computer Emergency Readiness Team, a part of Homeland Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system.
read more
http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
########snip#####
Funny - I keep feeling that the US Gov KNEW about this hole for many years :-)
Meanwhile, use the Internet Explorer browser only if you think you have nothing important to lose. No wonder President Putin has been a worried man and wants to move his staff back to typewriters :-)
walu.
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/ikua.evans%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
--
*----------------------------------------------------Kind Regards,Evans Ikua,* lanetconsulting.com, lpi-eastafrica.org, Skype: evans.ikua Twitter: @ikuae Cell: +254-722-955831
-- with Regards:
blog.denniskioko.com <http://www.denniskioko.com/>
-- *----------------------------------------------------Kind Regards,Evans Ikua,* lanetconsulting.com, lpi-eastafrica.org, Skype: evans.ikua Twitter: @ikuae Cell: +254-722-955831
Again as Dennis said, there are loopholes even in open source software and so that argument is moot. If governments such as the Canadian one with practically unlimited resources couldnt find the holes then what good is making the code open source? Open sourcing doesn't make the code more secure by virtue of the action. On Tue, Apr 29, 2014 at 3:49 PM, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Thats not the issue. There is no software that is absolutely secure, open or closed source. The issue is being able to get into the code and find out if there are backdoors where someone else is snooping on your systems and data, especially if you are a Government.
On Tue, Apr 29, 2014 at 3:20 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
But Mr. Ikua, The equally open source software known as OpenSSL had a glaring hole for years, which some suspect the US government might have known about too.
For as long as we have had software, so have we had software bugs, be it open, closed or ajar :-)
On Tuesday, 29 April 2014, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Well put Walu. This is the strategic dilemma of using closed source proprietary software. I am sure the lessons that Russia learns from this will inform other governments that you are only as free as the technology that you use.
Evans
On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet <kictanet@lists.kictanet.or.ke> wrote:
####snip#####
The United States Computer Emergency Readiness Team, a part of Homeland Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system.
read more
http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
########snip#####
Funny - I keep feeling that the US Gov KNEW about this hole for many years :-)
Meanwhile, use the Internet Explorer browser only if you think you have nothing important to lose. No wonder President Putin has been a worried man and wants to move his staff back to typewriters :-)
walu.
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/ikua.evans%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- ---------------------------------------------------- Kind Regards, Evans Ikua, lanetconsulting.com, lpi-eastafrica.org, Skype: evans.ikua Twitter: @ikuae Cell: +254-722-955831
-- with Regards:
blog.denniskioko.com
-- ---------------------------------------------------- Kind Regards, Evans Ikua, lanetconsulting.com, lpi-eastafrica.org, Skype: evans.ikua Twitter: @ikuae Cell: +254-722-955831
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/mwangy%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- Regards, Mark Mwangi markmwangi.me.ke
Mark, What open source gives you is the freedom and choice to check for yourself whether the code is secure or not. While it is not a guarantee, at least it puts the onus on you. If we are to discuss security & NSA there are very many commercial cryptography applications that have long been suspected of having backdoors that would be of use to certain governments. Last I chceked NSA pays an annual retainer running into hundreds of millions to ensure commercial vendors introduce backdoors they can use. On top of that, remember when US firms couldn't export cryptography that used more than 1024 bits? The problem with closed source, you have no liberty to check for yourself. You just hope! Back to OpenSSL; yes it had a serious bug for long, and I am sure not the last one, but if you look at how the HeartBleed bug came to be discovered and fixed, it was the openness that made this possible. Coming closer home, and regarding our recently implemented PKI Infrastructure by Koreans, how many would bet we have similar bugs in that implementation? How many would bet that no security audit was done based on the sources and that there is no guarantee of a backdoor in the system? Again, we can only hope! Regards On Tue, Apr 29, 2014 at 4:21 PM, Mark Mwangi via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Again as Dennis said, there are loopholes even in open source software and so that argument is moot. If governments such as the Canadian one with practically unlimited resources couldnt find the holes then what good is making the code open source?
Open sourcing doesn't make the code more secure by virtue of the action.
Thats not the issue. There is no software that is absolutely secure, open or closed source. The issue is being able to get into the code and find out if there are backdoors where someone else is snooping on your systems and data, especially if you are a Government.
On Tue, Apr 29, 2014 at 3:20 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
But Mr. Ikua, The equally open source software known as OpenSSL had a glaring hole for years, which some suspect the US government might have known about too.
For as long as we have had software, so have we had software bugs, be it open, closed or ajar :-)
On Tuesday, 29 April 2014, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Well put Walu. This is the strategic dilemma of using closed source proprietary software. I am sure the lessons that Russia learns from
will inform other governments that you are only as free as the technology that you use.
Evans
On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet <kictanet@lists.kictanet.or.ke> wrote:
####snip#####
The United States Computer Emergency Readiness Team, a part of
Homeland
Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system.
read more
http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
########snip#####
Funny - I keep feeling that the US Gov KNEW about this hole for many years :-)
Meanwhile, use the Internet Explorer browser only if you think you
have
nothing important to lose. No wonder President Putin has been a worried man and wants to move his staff back to typewriters :-)
walu.
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at
https://lists.kictanet.or.ke/mailman/options/kictanet/ikua.evans%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder
for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect
On Tue, Apr 29, 2014 at 3:49 PM, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote: this platform privacy, do
not spam, do not market your wares or qualifications.
-- ---------------------------------------------------- Kind Regards, Evans Ikua, lanetconsulting.com, lpi-eastafrica.org, Skype: evans.ikua Twitter: @ikuae Cell: +254-722-955831
-- with Regards:
blog.denniskioko.com
-- ---------------------------------------------------- Kind Regards, Evans Ikua, lanetconsulting.com, lpi-eastafrica.org, Skype: evans.ikua Twitter: @ikuae Cell: +254-722-955831
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/mwangy%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- Regards,
Mark Mwangi
markmwangi.me.ke
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/ngigi%40at.co.ke
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- *Regards,* *Wait**haka Ngigi* Chief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000 www.at.co.ke
What stops the NSA from hiring independent devs to contribute to open source code? Does open source run in a vacuum? No. We still download closed sourced Chrome, Flash, Java etc to run on our open source installations. Do these have backdoors? How many people actually take the time to go through open source code looking for bugs and backdoors? On Tue, Apr 29, 2014 at 16:52 PM, Ngigi Waithaka via kictanet < kictanet@lists.kictanet.or.ke> wrote: Mark, What open source gives you is the freedom and choice to check for yourself whether the code is secure or not. While it is not a guarantee, at least it puts the onus on you. If we are to discuss security & NSA there are very many commercial cryptography applications that have long been suspected of having backdoors that would be of use to certain governments. Last I chceked NSA pays an annual retainer running into hundreds of millions to ensure commercial vendors introduce backdoors they can use. On top of that, remember when US firms couldn't export cryptography that used more than 1024 bits? The problem with closed source, you have no liberty to check for yourself. You just hope! Back to OpenSSL; yes it had a serious bug for long, and I am sure not the last one, but if you look at how the HeartBleed bug came to be discovered and fixed, it was the openness that made this possible. Coming closer home, and regarding our recently implemented PKI Infrastructure by Koreans, how many would bet we have similar bugs in that implementation? How many would bet that no security audit was done based on the sources and that there is no guarantee of a backdoor in the system? Again, we can only hope! Regards On Tue, Apr 29, 2014 at 4:21 PM, Mark Mwangi via kictanet < kictanet@lists.kictanet.or.ke<javascript:_e(%7B%7D,'cvml','kictanet@lists.kictanet.or.ke');>
wrote:
Again as Dennis said, there are loopholes even in open source software
and so that argument is moot. If governments such as the Canadian one with practically unlimited resources couldnt find the holes then what good is making the code open source?
Open sourcing doesn't make the code more secure by virtue of the action.
Thats not the issue. There is no software that is absolutely secure, open or closed source. The issue is being able to get into the code and find out if there are backdoors where someone else is snooping on your systems and data, especially if you are a Government.
On Tue, Apr 29, 2014 at 3:20 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
But Mr. Ikua, The equally open source software known as OpenSSL had a glaring hole for years, which some suspect the US government might have known about too.
For as long as we have had software, so have we had software bugs, be it open, closed or ajar :-)
On Tuesday, 29 April 2014, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Well put Walu. This is the strategic dilemma of using closed source proprietary software. I am sure the lessons that Russia learns from
On Tue, Apr 29, 2014 at 3:49 PM, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote: this
will inform other governments that you are only as free as the technology that you use.
Evans
On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet <kictanet@lists.kictanet.or.ke> wrote:
####snip#####
The United States Computer Emergency Readiness Team, a part of
Homeland
Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system.
read more
http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
########snip#####
Funny - I keep feeling that the US Gov KNEW about this hole for many years :-)
Meanwhile, use the Internet Explorer browser only if you think you
have
nothing important to lose. No wonder President Putin has been a worried man and wants to move his staff back to typewriters :-)
walu.
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at
https://lists.kictanet.or.ke/mailman/options/kictanet/ikua.evans%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder
platform
for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/ngigi%40at.co.ke
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- *Regards,* *Wait**haka Ngigi* Chief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000 www.at.co.ke -- Sent from MetroMail
On Tue, Apr 29, 2014 at 8:09 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
What stops the NSA from hiring independent devs to contribute to open source code?
No one, they could hire any developer to contribute to open source code, same way no one would stop NSA from hiring a developer to go work at Microsoft. At least if they hire someone to work on open source code, I could always review their work if I deemed it necessary. But then again, why hire the individual developer, when you can pay off the whole company to put in back doors for you?
Does open source run in a vacuum? No. We still download closed sourced Chrome, Flash, Java etc to run on our open source installations. Do these have backdoors?
I don't get the point of this apart maybe from mentioning that Chrome & Java are open source...
How many people actually take the time to go through open source code looking for bugs and backdoors?
Well, how many engineers does Google, Facebook, Twitter, Yahoo, WhatsApp have? Most of these firms ran on open source stacks and are leading contributors to open source technologies. Put IBM, Oracle and recently Microsoft that has started to release open source code to that list as well.
On Tue, Apr 29, 2014 at 16:52 PM, Ngigi Waithaka via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Mark,
What open source gives you is the freedom and choice to check for yourself whether the code is secure or not. While it is not a guarantee, at least it puts the onus on you.
If we are to discuss security & NSA there are very many commercial cryptography applications that have long been suspected of having backdoors that would be of use to certain governments. Last I chceked NSA pays an annual retainer running into hundreds of millions to ensure commercial vendors introduce backdoors they can use. On top of that, remember when US firms couldn't export cryptography that used more than 1024 bits?
The problem with closed source, you have no liberty to check for yourself. You just hope!
Back to OpenSSL; yes it had a serious bug for long, and I am sure not the last one, but if you look at how the HeartBleed bug came to be discovered and fixed, it was the openness that made this possible.
Coming closer home, and regarding our recently implemented PKI Infrastructure by Koreans, how many would bet we have similar bugs in that implementation? How many would bet that no security audit was done based on the sources and that there is no guarantee of a backdoor in the system?
Again, we can only hope!
Regards
On Tue, Apr 29, 2014 at 4:21 PM, Mark Mwangi via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Again as Dennis said, there are loopholes even in open source software
and so that argument is moot. If governments such as the Canadian one with practically unlimited resources couldnt find the holes then what good is making the code open source?
Open sourcing doesn't make the code more secure by virtue of the action.
Thats not the issue. There is no software that is absolutely secure, open or closed source. The issue is being able to get into the code and find out if there are backdoors where someone else is snooping on your systems and data, especially if you are a Government.
On Tue, Apr 29, 2014 at 3:20 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
But Mr. Ikua, The equally open source software known as OpenSSL had a glaring hole
for
years, which some suspect the US government might have known about too.
For as long as we have had software, so have we had software bugs, be it open, closed or ajar :-)
On Tuesday, 29 April 2014, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Well put Walu. This is the strategic dilemma of using closed source proprietary software. I am sure the lessons that Russia learns from
On Tue, Apr 29, 2014 at 3:49 PM, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote: this
will inform other governments that you are only as free as the technology that you use.
Evans
On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet <kictanet@lists.kictanet.or.ke> wrote:
####snip#####
The United States Computer Emergency Readiness Team, a part of
Homeland
Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system.
read more
http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
########snip#####
Funny - I keep feeling that the US Gov KNEW about this hole for many years :-)
Meanwhile, use the Internet Explorer browser only if you think you
have
nothing important to lose. No wonder President Putin has been a worried man and wants to move his staff back to typewriters :-)
walu.
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at
https://lists.kictanet.or.ke/mailman/options/kictanet/ikua.evans%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder
platform
for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/ngigi%40at.co.ke
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- *Regards,*
*Wait**haka Ngigi* Chief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building
T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000
www.at.co.ke
-- Sent from MetroMail
-- *Regards,* *Wait**haka Ngigi* Chief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000 www.at.co.ke
The second point means that people still rely on a number of closed source applications even on open source systems. Google Chrome is a closed source distribution based on the Chromium Open source app, same way Android is based on the Android Open Source Project (which excludes the apps you mostly use). I have also seen a number of advisories for open source users to verify the authenticity of their installations after the Russians and others started inserting compromised open source packages in distributions. I doubt many verify what they download. Then, those who use open source solutions here, do you distribute open source solutions to your customers too ie, if you wrote an app with an open source language, do you supply it alongside source code. Again, if people want anything from your computers, they will probably get it, especially if you are online, see a related discussion here http://www.quora.com/Anonymity/What-are-the-best-ways-to-leak-information-an... Lastly, someone politely pointed me to Mr. Ikua's LinkedIn profile which indicates he is a consultant in the implementation of closed sourced solutions for the government of Kenya. As taxpayers, should we be worried, Mr. Ikua? Conclusion. Any software you use largely faces the same issues. In 2014, the Open source versus Closed Source debate shouldn't be based on Fear, Uncertainty and Doubt. On Tuesday, 29 April 2014, Ngigi Waithaka <ngigi@at.co.ke> wrote:
On Tue, Apr 29, 2014 at 8:09 PM, Dennis Kioko <dmbuvi@gmail.com<javascript:_e(%7B%7D,'cvml','dmbuvi@gmail.com');>
wrote:
What stops the NSA from hiring independent devs to contribute to open source code?
No one, they could hire any developer to contribute to open source code, same way no one would stop NSA from hiring a developer to go work at Microsoft. At least if they hire someone to work on open source code, I could always review their work if I deemed it necessary. But then again, why hire the individual developer, when you can pay off the whole company to put in back doors for you?
Does open source run in a vacuum? No. We still download closed sourced Chrome, Flash, Java etc to run on our open source installations. Do these have backdoors?
I don't get the point of this apart maybe from mentioning that Chrome & Java are open source...
How many people actually take the time to go through open source code looking for bugs and backdoors?
Well, how many engineers does Google, Facebook, Twitter, Yahoo, WhatsApp have? Most of these firms ran on open source stacks and are leading contributors to open source technologies. Put IBM, Oracle and recently Microsoft that has started to release open source code to that list as well.
On Tue, Apr 29, 2014 at 16:52 PM, Ngigi Waithaka via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Mark,
What open source gives you is the freedom and choice to check for yourself whether the code is secure or not. While it is not a guarantee, at least it puts the onus on you.
If we are to discuss security & NSA there are very many commercial cryptography applications that have long been suspected of having backdoors that would be of use to certain governments. Last I chceked NSA pays an annual retainer running into hundreds of millions to ensure commercial vendors introduce backdoors they can use. On top of that, remember when US firms couldn't export cryptography that used more than 1024 bits?
The problem with closed source, you have no liberty to check for yourself. You just hope!
Back to OpenSSL; yes it had a serious bug for long, and I am sure not the last one, but if you look at how the HeartBleed bug came to be discovered and fixed, it was the openness that made this possible.
Coming closer home, and regarding our recently implemented PKI Infrastructure by Koreans, how many would bet we have similar bugs in that implementation? How many would bet that no security audit was done based on the sources and that there is no guarantee of a backdoor in the system?
Again, we can only hope!
Regards
On Tue, Apr 29, 2014 at 4:21 PM, Mark Mwangi via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Again as Dennis said, there are loopholes even in open source software and so that argument is moot. If governments such as the Canadian one with practically unlimited resources couldnt find the holes then what good is making the code open source?
Open sourcing doesn't make the code more secure by virtue of the action.
Thats not the issue. There is no software that is absolutely secure, open or closed source. The issue is being able to get into the code and find out if there are backdoors where someone else is snooping on your systems and data, especially if you are a Government.
On Tue, Apr 29, 2014 at 3:20 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
But Mr. Ikua, The equally open source software known as OpenSSL had a glaring hole for years, which some suspect the US government might have known about too.
For as long as we have had software, so have we had software bugs, be it open, closed or ajar :-)
On Tuesday, 29 April 2014, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Well put Walu. This is the strategic dilemma of using closed source proprietary software. I am sure the lessons that Russia learns from
On Tue, Apr 29, 2014 at 3:49 PM, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote: this
will inform other governments that you are only as free as the technology that you use.
Evans
On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet <kictanet@lists.kictanet.or.ke> wrote:
####snip#####
The United States Computer Emergency Readiness Team, a part of
Homeland
Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system.
read more
http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
########snip#####
Funny - I keep feeling that the US Gov KNEW about this hole for many
-- *Regards,*
*Wait**haka Ngigi* Chief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000 www.at.co.ke
-- with Regards: blog.denniskioko.com <http://www.denniskioko.com/>
I also don't think open sourcing is the solution to all our ills. I mean its nice if I can keep tabs on the source code of all my apps but it doesn't make it useful or effective. The US is the biggest spender of technology as far as we know and if there is anyone with the skill of resources to fully audit all the source code running their systems its them. They are however routinely infiltrated by the Chinese or so they claim. China at some point managed to redirect most of the webs traffic through their servers. My point is having access to the source code doesn't guarantee it will be audited and if audited that the flaws will be found. Windows XP is still leaking with flaws 13 years on. I am sure if Ubuntu had the same install base it would be hemorrhaging as well. On Tue, Apr 29, 2014 at 9:31 PM, Dennis Kioko via kictanet < kictanet@lists.kictanet.or.ke> wrote:
The second point means that people still rely on a number of closed source applications even on open source systems. Google Chrome is a closed source distribution based on the Chromium Open source app, same way Android is based on the Android Open Source Project (which excludes the apps you mostly use).
I have also seen a number of advisories for open source users to verify the authenticity of their installations after the Russians and others started inserting compromised open source packages in distributions. I doubt many verify what they download.
Then, those who use open source solutions here, do you distribute open source solutions to your customers too ie, if you wrote an app with an open source language, do you supply it alongside source code.
Again, if people want anything from your computers, they will probably get it, especially if you are online, see a related discussion here http://www.quora.com/Anonymity/What-are-the-best-ways-to-leak-information-an...
Lastly, someone politely pointed me to Mr. Ikua's LinkedIn profile which indicates he is a consultant in the implementation of closed sourced solutions for the government of Kenya. As taxpayers, should we be worried, Mr. Ikua?
Conclusion. Any software you use largely faces the same issues. In 2014, the Open source versus Closed Source debate shouldn't be based on Fear, Uncertainty and Doubt.
On Tuesday, 29 April 2014, Ngigi Waithaka <ngigi@at.co.ke> wrote:
On Tue, Apr 29, 2014 at 8:09 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
What stops the NSA from hiring independent devs to contribute to open source code?
No one, they could hire any developer to contribute to open source code, same way no one would stop NSA from hiring a developer to go work at Microsoft. At least if they hire someone to work on open source code, I could always review their work if I deemed it necessary. But then again, why hire the individual developer, when you can pay off the whole company to put in back doors for you?
Does open source run in a vacuum? No. We still download closed sourced Chrome, Flash, Java etc to run on our open source installations. Do these have backdoors?
I don't get the point of this apart maybe from mentioning that Chrome & Java are open source...
How many people actually take the time to go through open source code looking for bugs and backdoors?
Well, how many engineers does Google, Facebook, Twitter, Yahoo, WhatsApp have? Most of these firms ran on open source stacks and are leading contributors to open source technologies. Put IBM, Oracle and recently Microsoft that has started to release open source code to that list as well.
On Tue, Apr 29, 2014 at 16:52 PM, Ngigi Waithaka via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Mark,
What open source gives you is the freedom and choice to check for yourself whether the code is secure or not. While it is not a guarantee, at least it puts the onus on you.
If we are to discuss security & NSA there are very many commercial cryptography applications that have long been suspected of having backdoors that would be of use to certain governments. Last I chceked NSA pays an annual retainer running into hundreds of millions to ensure commercial vendors introduce backdoors they can use. On top of that, remember when US firms couldn't export cryptography that used more than 1024 bits?
The problem with closed source, you have no liberty to check for yourself. You just hope!
Back to OpenSSL; yes it had a serious bug for long, and I am sure not the last one, but if you look at how the HeartBleed bug came to be discovered and fixed, it was the openness that made this possible.
Coming closer home, and regarding our recently implemented PKI Infrastructure by Koreans, how many would bet we have similar bugs in that implementation? How many would bet that no security audit was done based on the sources and that there is no guarantee of a backdoor in the system?
Again, we can only hope!
Regards
On Tue, Apr 29, 2014 at 4:21 PM, Mark Mwangi via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Again as Dennis said, there are loopholes even in open source software and so that argument is moot. If governments such as the Canadian one with practically unlimited resources couldnt find the holes then what good is making the code open source?
Open sourcing doesn't make the code more secure by virtue of the action.
Thats not the issue. There is no software that is absolutely secure, open or closed source. The issue is being able to get into the code and find out if there are backdoors where someone else is snooping on your systems and data, especially if you are a Government.
On Tue, Apr 29, 2014 at 3:20 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
But Mr. Ikua, The equally open source software known as OpenSSL had a glaring hole
for
years, which some suspect the US government might have known about too.
For as long as we have had software, so have we had software bugs, be it open, closed or ajar :-)
On Tuesday, 29 April 2014, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Well put Walu. This is the strategic dilemma of using closed source proprietary software. I am sure the lessons that Russia learns from
On Tue, Apr 29, 2014 at 3:49 PM, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote: this
will inform other governments that you are only as free as the technology that you use.
Evans
On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet <kictanet@lists.kictanet.or.ke> wrote:
####snip#####
The United States Computer Emergency Readiness Team, a part of
Homeland
Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead to "the complete compromise" of an affected system.
read more
http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
########snip#####
Funny - I keep feeling that the US Gov KNEW about this hole for many
-- *Regards,*
*Wait**haka Ngigi* Chief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000 www.at.co.ke
-- with Regards:
blog.denniskioko.com <http://www.denniskioko.com/>
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/mwangy%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- Regards, Mark Mwangi markmwangi.me.ke
Mark, Dennis, Seems that I am answering to like minded listers here so I might as well combine my answer on this. I haven't said or even implied that open source is the answer to all ills, but IMO, it helps a lot in terms of code audit. Trying to audit software without access to source code is akin to an account audit without source documents. Infact, auditing without source documents is what we normally call forensic audit. You can finally get at the truth, but everything will be that much harder. Secondly. open source is not a Religion! In technology and/or academia, you can be both 'Christian' and/or 'Muslim' at the same time. It doesn't mean because someone is a proponent of open source that he/she is anathema to using other technologies non open source technologies. Finally, how someone chooses to make a living, is a personal choice and I think we ought to respectfully refrain from commenting on such and discuss technology issues, which I believe is what this forum is for. Regards On Tue, Apr 29, 2014 at 10:14 PM, Mark Mwangi via kictanet < kictanet@lists.kictanet.or.ke> wrote:
I also don't think open sourcing is the solution to all our ills. I mean its nice if I can keep tabs on the source code of all my apps but it doesn't make it useful or effective. The US is the biggest spender of technology as far as we know and if there is anyone with the skill of resources to fully audit all the source code running their systems its them.
They are however routinely infiltrated by the Chinese or so they claim. China at some point managed to redirect most of the webs traffic through their servers.
My point is having access to the source code doesn't guarantee it will be audited and if audited that the flaws will be found. Windows XP is still leaking with flaws 13 years on. I am sure if Ubuntu had the same install base it would be hemorrhaging as well.
On Tue, Apr 29, 2014 at 9:31 PM, Dennis Kioko via kictanet < kictanet@lists.kictanet.or.ke> wrote:
The second point means that people still rely on a number of closed source applications even on open source systems. Google Chrome is a closed source distribution based on the Chromium Open source app, same way Android is based on the Android Open Source Project (which excludes the apps you mostly use).
I have also seen a number of advisories for open source users to verify the authenticity of their installations after the Russians and others started inserting compromised open source packages in distributions. I doubt many verify what they download.
Then, those who use open source solutions here, do you distribute open source solutions to your customers too ie, if you wrote an app with an open source language, do you supply it alongside source code.
Again, if people want anything from your computers, they will probably get it, especially if you are online, see a related discussion here http://www.quora.com/Anonymity/What-are-the-best-ways-to-leak-information-an...
Lastly, someone politely pointed me to Mr. Ikua's LinkedIn profile which indicates he is a consultant in the implementation of closed sourced solutions for the government of Kenya. As taxpayers, should we be worried, Mr. Ikua?
Conclusion. Any software you use largely faces the same issues. In 2014, the Open source versus Closed Source debate shouldn't be based on Fear, Uncertainty and Doubt.
On Tuesday, 29 April 2014, Ngigi Waithaka <ngigi@at.co.ke> wrote:
On Tue, Apr 29, 2014 at 8:09 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
What stops the NSA from hiring independent devs to contribute to open source code?
No one, they could hire any developer to contribute to open source code, same way no one would stop NSA from hiring a developer to go work at Microsoft. At least if they hire someone to work on open source code, I could always review their work if I deemed it necessary. But then again, why hire the individual developer, when you can pay off the whole company to put in back doors for you?
Does open source run in a vacuum? No. We still download closed sourced Chrome, Flash, Java etc to run on our open source installations. Do these have backdoors?
I don't get the point of this apart maybe from mentioning that Chrome & Java are open source...
How many people actually take the time to go through open source code looking for bugs and backdoors?
Well, how many engineers does Google, Facebook, Twitter, Yahoo, WhatsApp have? Most of these firms ran on open source stacks and are leading contributors to open source technologies. Put IBM, Oracle and recently Microsoft that has started to release open source code to that list as well.
On Tue, Apr 29, 2014 at 16:52 PM, Ngigi Waithaka via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Mark,
What open source gives you is the freedom and choice to check for yourself whether the code is secure or not. While it is not a guarantee, at least it puts the onus on you.
If we are to discuss security & NSA there are very many commercial cryptography applications that have long been suspected of having backdoors that would be of use to certain governments. Last I chceked NSA pays an annual retainer running into hundreds of millions to ensure commercial vendors introduce backdoors they can use. On top of that, remember when US firms couldn't export cryptography that used more than 1024 bits?
The problem with closed source, you have no liberty to check for yourself. You just hope!
Back to OpenSSL; yes it had a serious bug for long, and I am sure not the last one, but if you look at how the HeartBleed bug came to be discovered and fixed, it was the openness that made this possible.
Coming closer home, and regarding our recently implemented PKI Infrastructure by Koreans, how many would bet we have similar bugs in that implementation? How many would bet that no security audit was done based on the sources and that there is no guarantee of a backdoor in the system?
Again, we can only hope!
Regards
On Tue, Apr 29, 2014 at 4:21 PM, Mark Mwangi via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Again as Dennis said, there are loopholes even in open source software and so that argument is moot. If governments such as the Canadian one with practically unlimited resources couldnt find the holes then what good is making the code open source?
Open sourcing doesn't make the code more secure by virtue of the action.
Thats not the issue. There is no software that is absolutely secure, open or closed source. The issue is being able to get into the code and find out if there are backdoors where someone else is snooping on your systems and data, especially if you are a Government.
On Tue, Apr 29, 2014 at 3:20 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
But Mr. Ikua, The equally open source software known as OpenSSL had a glaring hole
for
years, which some suspect the US government might have known about too.
For as long as we have had software, so have we had software bugs, be it open, closed or ajar :-)
On Tuesday, 29 April 2014, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Well put Walu. This is the strategic dilemma of using closed source proprietary software. I am sure the lessons that Russia learns from
On Tue, Apr 29, 2014 at 3:49 PM, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote: this
will inform other governments that you are only as free as the technology that you use.
Evans
On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet <kictanet@lists.kictanet.or.ke> wrote: > > ####snip##### > > The United States Computer Emergency Readiness Team, a part of Homeland > Security known as US-CERT, said in an advisory released on Monday morning > that the vulnerability in versions 6 to 11 of Internet Explorer could lead > to "the complete compromise" of an affected system. > > read more > > > http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
> > ########snip##### > > Funny - I keep feeling that the US Gov KNEW about this hole for many
-- *Regards,*
*Wait**haka Ngigi* Chief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000 www.at.co.ke
-- with Regards:
blog.denniskioko.com <http://www.denniskioko.com/>
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/mwangy%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- Regards,
Mark Mwangi
markmwangi.me.ke
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/ngigi%40at.co.ke
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- *Regards,* *Wait**haka Ngigi* Chief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000 www.at.co.ke
Thats not the issue. There is no software
Well said Ngigi, Being a supporter of Open-Source (eg Linux) does not mean you cannot use Closed-Source (e.g. Microsoft). As an academic, I actually use and teach both :-) However, the Open-source products tend to give students more freedom to "hack" in the sense that they can drill deeper into the software constructs/code - and hence be in a better position to create knew knowledge/customized solutions. Put bluntly, one approach gives you a constant supply of "fish" while the other teaches you how to fish. In life, you probably need both, but it is always better to be able to fish since one day, the fish supplier may not show up :-) walu. -------------------------------------------- On Wed, 4/30/14, Ngigi Waithaka via kictanet <kictanet@lists.kictanet.or.ke> wrote: Subject: Re: [kictanet] U.S.: Stop using Internet Explorer until security holes are fixed To: jwalu@yahoo.com Cc: "KICTAnet ICT Policy Discussions" <kictanet@lists.kictanet.or.ke> Date: Wednesday, April 30, 2014, 12:26 AM Mark, Dennis, Seems that I am answering to like minded listers here so I might as well combine my answer on this. I haven't said or even implied that open source is the answer to all ills, but IMO, it helps a lot in terms of code audit. Trying to audit software without access to source code is akin to an account audit without source documents. Infact, auditing without source documents is what we normally call forensic audit. You can finally get at the truth, but everything will be that much harder. Secondly. open source is not a Religion! In technology and/or academia, you can be both 'Christian' and/or 'Muslim' at the same time. It doesn't mean because someone is a proponent of open source that he/she is anathema to using other technologies non open source technologies. Finally, how someone chooses to make a living, is a personal choice and I think we ought to respectfully refrain from commenting on such and discuss technology issues, which I believe is what this forum is for. Regards On Tue, Apr 29, 2014 at 10:14 PM, Mark Mwangi via kictanet <kictanet@lists.kictanet.or.ke> wrote: I also don't think open sourcing is the solution to all our ills. I mean its nice if I can keep tabs on the source code of all my apps but it doesn't make it useful or effective. The US is the biggest spender of technology as far as we know and if there is anyone with the skill of resources to fully audit all the source code running their systems its them. They are however routinely infiltrated by the Chinese or so they claim. China at some point managed to redirect most of the webs traffic through their servers. My point is having access to the source code doesn't guarantee it will be audited and if audited that the flaws will be found. Windows XP is still leaking with flaws 13 years on. I am sure if Ubuntu had the same install base it would be hemorrhaging as well. On Tue, Apr 29, 2014 at 9:31 PM, Dennis Kioko via kictanet <kictanet@lists.kictanet.or.ke> wrote: The second point means that people still rely on a number of closed source applications even on open source systems. Google Chrome is a closed source distribution based on the Chromium Open source app, same way Android is based on the Android Open Source Project (which excludes the apps you mostly use). I have also seen a number of advisories for open source users to verify the authenticity of their installations after the Russians and others started inserting compromised open source packages in distributions. I doubt many verify what they download. Then, those who use open source solutions here, do you distribute open source solutions to your customers too ie, if you wrote an app with an open source language, do you supply it alongside source code. Again, if people want anything from your computers, they will probably get it, especially if you are online, see a related discussion here http://www.quora.com/Anonymity/What-are-the-best-ways-to-leak-information-an... Lastly, someone politely pointed me to Mr. Ikua's LinkedIn profile which indicates he is a consultant in the implementation of closed sourced solutions for the government of Kenya. As taxpayers, should we be worried, Mr. Ikua? Conclusion. Any software you use largely faces the same issues. In 2014, the Open source versus Closed Source debate shouldn't be based on Fear, Uncertainty and Doubt. On Tuesday, 29 April 2014, Ngigi Waithaka <ngigi@at.co.ke> wrote: On Tue, Apr 29, 2014 at 8:09 PM, Dennis Kioko <dmbuvi@gmail.com> wrote: What stops the NSA from hiring independent devs to contribute to open source code? No one, they could hire any developer to contribute to open source code, same way no one would stop NSA from hiring a developer to go work at Microsoft. At least if they hire someone to work on open source code, I could always review their work if I deemed it necessary. But then again, why hire the individual developer, when you can pay off the whole company to put in back doors for you? Does open source run in a vacuum? No. We still download closed sourced Chrome, Flash, Java etc to run on our open source installations. Do these have backdoors? I don't get the point of this apart maybe from mentioning that Chrome & Java are open source... How many people actually take the time to go through open source code looking for bugs and backdoors? Well, how many engineers does Google, Facebook, Twitter, Yahoo, WhatsApp have? Most of these firms ran on open source stacks and are leading contributors to open source technologies. Put IBM, Oracle and recently Microsoft that has started to release open source code to that list as well. On Tue, Apr 29, 2014 at 16:52 PM, Ngigi Waithaka via kictanet <kictanet@lists.kictanet.or.ke> wrote: Mark, What open source gives you is the freedom and choice to check for yourself whether the code is secure or not. While it is not a guarantee, at least it puts the onus on you. If we are to discuss security & NSA there are very many commercial cryptography applications that have long been suspected of having backdoors that would be of use to certain governments. Last I chceked NSA pays an annual retainer running into hundreds of millions to ensure commercial vendors introduce backdoors they can use. On top of that, remember when US firms couldn't export cryptography that used more than 1024 bits? The problem with closed source, you have no liberty to check for yourself. You just hope! Back to OpenSSL; yes it had a serious bug for long, and I am sure not the last one, but if you look at how the HeartBleed bug came to be discovered and fixed, it was the openness that made this possible. Coming closer home, and regarding our recently implemented PKI Infrastructure by Koreans, how many would bet we have similar bugs in that implementation? How many would bet that no security audit was done based on the sources and that there is no guarantee of a backdoor in the system? Again, we can only hope! Regards On Tue, Apr 29, 2014 at 4:21 PM, Mark Mwangi via kictanet <kictanet@lists.kictanet.or.ke> wrote: Again as Dennis said, there are loopholes even in open source software and so that argument is moot. If governments such as the Canadian one with practically unlimited resources couldnt find the holes then what good is making the code open source? Open sourcing doesn't make the code more secure by virtue of the action. On Tue, Apr 29, 2014 at 3:49 PM, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote: that is absolutely secure, open or
closed source. The issue is being able to get into the code and find out if
there are backdoors where someone else is snooping on your systems and data, especially if you are a Government.
On Tue, Apr 29, 2014 at 3:20 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
But Mr. Ikua, The equally open source software known
as OpenSSL had a glaring hole for
years, which some suspect the US government might have known about too.
For as long as we have had software, so have we had software bugs, be it
open, closed or ajar :-)
On Tuesday, 29 April 2014, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Well
put Walu. This is the strategic dilemma of using closed source
proprietary software. I am sure the lessons that Russia learns from this
will inform other governments that you are only as free as the technology
that you use.
Evans
On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet <kictanet@lists.kictanet.or.ke> wrote:
####snip#####
The United
States Computer Emergency Readiness Team, a part of Homeland
Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead
to "the complete compromise" of an affected system.
read more
http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
########snip#####
Funny - I keep feeling that
the US Gov KNEW about this hole for many
-- Regards, Waithaka NgigiChief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000 www.at.co.ke -- with Regards: blog.denniskioko.com _______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/mwangy%40gmail.com The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development. KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications. -- Regards, Mark Mwangi markmwangi.me.ke _______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/ngigi%40at.co.ke The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development. KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications. -- Regards, Waithaka NgigiChief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000 www.at.co.ke -----Inline Attachment Follows----- _______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/jwalu%40yahoo.com The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development. KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
@Walubengo mwalimu, here is a postulate that you can give your students to research. *Given enough time, any software discussion eventually degenerates into
an open source vs closed source argument*
On Wed, Apr 30, 2014 at 8:42 AM, Walubengo J via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Well said Ngigi,
Being a supporter of Open-Source (eg Linux) does not mean you cannot use Closed-Source (e.g. Microsoft). As an academic, I actually use and teach both :-) However, the Open-source products tend to give students more freedom to "hack" in the sense that they can drill deeper into the software constructs/code - and hence be in a better position to create knew knowledge/customized solutions.
Put bluntly, one approach gives you a constant supply of "fish" while the other teaches you how to fish. In life, you probably need both, but it is always better to be able to fish since one day, the fish supplier may not show up :-)
walu.
-------------------------------------------- On Wed, 4/30/14, Ngigi Waithaka via kictanet < kictanet@lists.kictanet.or.ke> wrote:
Subject: Re: [kictanet] U.S.: Stop using Internet Explorer until security holes are fixed To: jwalu@yahoo.com Cc: "KICTAnet ICT Policy Discussions" <kictanet@lists.kictanet.or.ke> Date: Wednesday, April 30, 2014, 12:26 AM
Mark, Dennis,
Seems that I am answering to like minded listers here so I might as well combine my answer on this.
I haven't said or even implied that open source is the answer to all ills, but IMO, it helps a lot in terms of code audit. Trying to audit software without access to source code is akin to an account audit without source documents.
Infact, auditing without source documents is what we normally call forensic audit. You can finally get at the truth, but everything will be that much harder.
Secondly. open source is not a Religion! In technology and/or academia, you can be both 'Christian' and/or 'Muslim' at the same time. It doesn't mean because someone is a proponent of open source that he/she is anathema to using other technologies non open source technologies.
Finally, how someone chooses to make a living, is a personal choice and I think we ought to respectfully refrain from commenting on such and discuss technology issues, which I believe is what this forum is for.
Regards
On Tue, Apr 29, 2014 at 10:14 PM, Mark Mwangi via kictanet < kictanet@lists.kictanet.or.ke> wrote:
I also don't think open sourcing is the solution to all our ills. I mean its nice if I can keep tabs on the source code of all my apps but it doesn't make it useful or effective. The US is the biggest spender of technology as far as we know and if there is anyone with the skill of resources to fully audit all the source code running their systems its them.
They are however routinely infiltrated by the Chinese or so they claim. China at some point managed to redirect most of the webs traffic through their servers.
My point is having access to the source code doesn't guarantee it will be audited and if audited that the flaws will be found. Windows XP is still leaking with flaws 13 years on. I am sure if Ubuntu had the same install base it would be hemorrhaging as well.
On Tue, Apr 29, 2014 at 9:31 PM, Dennis Kioko via kictanet <kictanet@lists.kictanet.or.ke> wrote:
The second point means that people still rely on a number of closed source applications even on open source systems. Google Chrome is a closed source distribution based on the Chromium Open source app, same way Android is based on the Android Open Source Project (which excludes the apps you mostly use).
I have also seen a number of advisories for open source users to verify the authenticity of their installations after the Russians and others started inserting compromised open source packages in distributions. I doubt many verify what they download.
Then, those who use open source solutions here, do you distribute open source solutions to your customers too ie, if you wrote an app with an open source language, do you supply it alongside source code.
Again, if people want anything from your computers, they will probably get it, especially if you are online, see a related discussion here http://www.quora.com/Anonymity/What-are-the-best-ways-to-leak-information-an...
Lastly, someone politely pointed me to Mr. Ikua's LinkedIn profile which indicates he is a consultant in the implementation of closed sourced solutions for the government of Kenya. As taxpayers, should we be worried, Mr. Ikua?
Conclusion. Any software you use largely faces the same issues. In 2014, the Open source versus Closed Source debate shouldn't be based on Fear, Uncertainty and Doubt.
On Tuesday, 29 April 2014, Ngigi Waithaka <ngigi@at.co.ke> wrote:
On Tue, Apr 29, 2014 at 8:09 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
What stops the NSA from hiring independent devs to contribute to open source code? No one, they could hire any developer to contribute to open source code, same way no one would stop NSA from hiring a developer to go work at Microsoft. At least if they hire someone to work on open source code, I could always review their work if I deemed it necessary.
But then again, why hire the individual developer, when you can pay off the whole company to put in back doors for you?
Does open source run in a vacuum? No. We still download closed sourced Chrome, Flash, Java etc to run on our open source installations. Do these have backdoors?
I don't get the point of this apart maybe from mentioning that Chrome & Java are open source...
How many people actually take the time to go through open source code looking for bugs and backdoors?
Well, how many engineers does Google, Facebook, Twitter, Yahoo, WhatsApp have? Most of these firms ran on open source stacks and are leading contributors to open source technologies. Put IBM, Oracle and recently Microsoft that has started to release open source code to that list as well.
On Tue, Apr 29, 2014 at 16:52 PM, Ngigi Waithaka via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Mark,
What open source gives you is the freedom and choice to check for yourself whether the code is secure or not. While it is not a guarantee, at least it puts the onus on you.
If we are to discuss security & NSA there are very many commercial cryptography applications that have long been suspected of having backdoors that would be of use to certain governments. Last I chceked NSA pays an annual retainer running into hundreds of millions to ensure commercial vendors introduce backdoors they can use. On top of that, remember when US firms couldn't export cryptography that used more than 1024 bits?
The problem with closed source, you have no liberty to check for yourself. You just hope!
Back to OpenSSL; yes it had a serious bug for long, and I am sure not the last one, but if you look at how the HeartBleed bug came to be discovered and fixed, it was the openness that made this possible.
Coming closer home, and regarding our recently implemented PKI Infrastructure by Koreans, how many would bet we have similar bugs in that implementation? How many would bet that no security audit was done based on the sources and that there is no guarantee of a backdoor in the system?
Again, we can only hope!
Regards
On Tue, Apr 29, 2014 at 4:21 PM, Mark Mwangi via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Again as Dennis said, there are loopholes even in open source software and so that argument is moot. If governments such as the Canadian one
with practically unlimited resources couldnt find the holes then what good is making the code open source?
Open sourcing doesn't make the code more secure by virtue of the action.
On Tue, Apr 29, 2014 at 3:49 PM, Evans Ikua via kictanet
Thats not the issue. There is no software
<kictanet@lists.kictanet.or.ke> wrote: that is absolutely secure, open or
closed source. The issue is being able to get into the code and find out if
there are backdoors where someone else is snooping on your systems and data, especially if you are a Government.
On Tue, Apr 29, 2014 at 3:20 PM, Dennis Kioko <dmbuvi@gmail.com> wrote:
But Mr. Ikua, The equally open source software known
as OpenSSL had a glaring hole for
years, which some suspect the US government might have known about too.
For as long as we have had software, so have we had software bugs, be it
open, closed or ajar :-)
On Tuesday, 29 April 2014, Evans Ikua via kictanet <kictanet@lists.kictanet.or.ke> wrote:
Well
put Walu. This is the strategic dilemma of using closed source
proprietary software. I am sure the lessons that Russia learns from this
will inform other governments that you are only as free as the technology
that you use.
Evans
On Mon, Apr 28, 2014 at 7:27 PM, Walubengo J via kictanet <kictanet@lists.kictanet.or.ke> wrote:
####snip#####
The United
States Computer Emergency Readiness Team, a part of Homeland
Security known as US-CERT, said in an advisory released on Monday morning that the vulnerability in versions 6 to 11 of Internet Explorer could lead
to "the complete compromise" of an affected system.
read more
http://www.chicagotribune.com/business/technology/chi-microsoft-explorer-sec...
########snip#####
Funny - I keep feeling that
the US Gov KNEW about this hole for many
--
Regards,
Waithaka NgigiChief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building
T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000
www.at.co.ke
-- with Regards: blog.denniskioko.com
_______________________________________________
kictanet mailing list
kictanet@lists.kictanet.or.ke
https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/mwangy%40gmail.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- Regards,
Mark Mwangi
markmwangi.me.ke
_______________________________________________
kictanet mailing list
kictanet@lists.kictanet.or.ke
https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/ngigi%40at.co.ke
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
-- Regards,
Waithaka NgigiChief Executive Officer | Alliance Technologies | MCK Nairobi Synod Building
T + 254 (0) 20 2333 471 |Office Mobile: +254 786 28 28 28 | M + 254 737 811 000
www.at.co.ke
-----Inline Attachment Follows-----
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/jwalu%40yahoo.com
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
_______________________________________________ kictanet mailing list kictanet@lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet
Unsubscribe or change your options at https://lists.kictanet.or.ke/mailman/options/kictanet/conradakunga%40gmail.c...
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.
participants (6)
-
Dennis Kioko -
Evans Ikua -
Mark Mwangi -
Ngigi Waithaka -
Rad! -
Walubengo J