GNU/Linux: Is it immune to Malware?

When someone switches to GNU/Linux, one of the attributes assigned to GNU/Linux and other Open Source Operating Systems (that are free [as in freedom]) is that GNU/Linux is VIRUS or Malware free.

I have been answering (some of the misunderstandings in this respect) at multiple forums and lists, but here is the comprehensive answer.

The truthful answer is YES, writing and enabling malware executing within GNU/Linux is possible.

I prefer the term Malicious Software (abbreviated Malware), rather than the obscure and rather obsolete term 'Vital Information Resources Under Siege' (VIRUS that sounds like a poorly named movie. )

The Linux Juggernaut

The awesome growth of GNU/Linux from 1992 till date is a huge demonstration of the impact of Open Source and the principles behind it. The Linux kernel itself has been growing, much to the chagrin of some, it has become bloatware.

Linux Unleashed (2011)

Over a decade ago, the landscape of open source was predominantly GNU/Linux with Mozilla and the Apache foundation. Teamed up with MySQL, the server scape was slowly assimilated. The Desktop was young with Slackware, Debian, Redhat, Mandrake making early in-roads. Few saw Linux as a solution for the desktop where usability translated to simplicity. Hackers (programmers), sysadmins adopted GNU/Linux in whatever form it was available. At the same time, IBM was demonstrating Linux on its mainframes and packing it onto a wristwatch. They had proven that it was practically scalable. The impact at that time was subtle, but a revolution had begun.

In the early days of GNU/Linux, there were frequent comparisons of Linux with Microsoft's Windows and Mac OS (many serving as flame-bait in mailing lists and forums.) Computing devices were not yet commodity and the OS/System Software space was presumed to be an oligopoly. The "OS" was seen as a product, an end in itself, rather than the means to an application (which is easier from today's perspective.) To be fair today, Linux does not have a single perspective (or personality) to project it as a 'de facto' desktop OS alternative. Ubuntu, Knoppix, Linux Mint, Arch, CentOS, Fedora, OpenSuSE and the list goes on.

I remember a discussion in 2001 with my then CEO (Codito), Harshad Pathak. We were a group of hackers trying to define data abstraction, data hiding and data encapsulation. He came up with lines of wisdom, "I don't care what Operating System my Phone is running as long as I can make calls and use it for texting. Embedded Linux, Windows CE - it really doesn't matter." As techies, to us, the OS was sacred, and that transformed the discussion into an argument. An Operating System must facilitate the user to accomplish something, which could be done only through an application or service or a mix of both.



Today, we are precisely in the scenario where the GNU/Linux ecosystem has facilitated end-user productivity through applications, platforms and cohesive technology. Google uses data centres powered by the GNU/Linux ecosystem. Android derives from a Linux kernel. Chrome-OS derives from a Linux kernel. Facebook runs scalable servers powered by GNU/Linux. Desktop options powered by GNU/Linux are innumerable as this infographic reveals. Alternate OS platforms including Sun (now Oracle)'s OpenSolaris, OpenStorage, BSD's contributions as FreeBSD (forked as Darwin became a part of Mac OS), OpenBSD and NetBSD offer a much larger palette to choose from.

Android users are clearly using a phone, empowered with applications and web services from google. The Internet has many businesses providing services in a SaaS model, a good number of them powered by the ongoing Open Source revolution. Business models have undergone radical changes. Semiconductor companies (Intel, AMD, ARM, TI, FreeScale - to name a few) have gone out of the way to ensure System Software (compiler, OS) level support for new Silicon solutions through the Open Source Community. As this has gradually happened, there is a perceived reduction in solution costs that have been passed on to the end user. The spectrum of smart-phones and tablets at CES 2011 was more than proof of how semiconductor majors worked on reducing time-to-market and system-software costs.

Businesses are increasingly adapting and learning to use community source (rather than roll their own code for everything,) wherever it gives them a significant advantage. The businesses having understood the potential, have also begun to reciprocate to the community. It's happening right now, almost oblivious to the glitz and glamour of a Consumer gadget show or a Technology forum.
Proprietary stand-alone platforms are quickly revising and re-inventing. To name a few, Microsoft Live, Microsoft Azure have been Microsoft's answer to the changing technology scape. Rumour mills suggest Apple Sabertooth could be Apple's answer to the change.

Ultimately, what began as the GNU revolution, and then the GNU/Linux revolution, to a full-fledged ecosystem expanding with options as new players joined has changed Information Technology irreversibly. 'The Cloud' is often compared with earlier ideas proposing 'Network Computers', later 'Network Computing.' Yet, the cloud solutions available rely on the evolved Open Source ecosystem. Community Source / Open Source has finally emerged as part of the change and catalyst to the change. The entire system has evolved without serving goals or targets of its own original projects by allowing itself and therefore impact, goal and user-base to change. The business model of the Open Internet Venture is here to stay. Corporate Entities and Governments are also embracing Open Source (WSJ).

Startups, Open Source and Revenue - Myth vs Truth

Many believe that if you release your software product with the source open, any customer can procure it, better it and sell it thereby eliminating you in the market outright. This is one of the frequent arguments against opening source code and therefore to "Open Source" that many businesses quote.

I believe they will need to cite a case here. Buy Product Once, Get Source and Kill; sounds too easy to be true.

Actually I have source code of some game engines released by id software, and I know gaming companies who compete who have this, yet, I don't see anyone killing "id". I also have pieces of OpenSolaris and OpenStorage from SUN. IBM shouldn't have even made that $7b bid after expressing interest in OpenStorage among other areas from Sun.

I could even do this with "proprietary software" where source is offered whenever I pay (a much smaller sum than net worth of a company.) There are tons of companies who are willing to part with source for higher costs.

Sun wouldn't have "bought out" Virtual Box and MySQL if they could just use the source instead. Buying Out is one of the available "exit strategies" for a cash-strapped startup.

Clearly someone has to prove that Redhat's profits have dropped because Canonical and almost everyone else who has taken on pieces of code has cut into a static pie of consumer market. The truth is software markets are closely linked to a lot of other markets including service markets. These markets grow or shrink dynamically. The whole pie however depends on user base which has been constantly expanding.

For OpenOffice, I think resurrection of Lotus with the OpenOffice source is proof enough that an entirely different company used this. Transgaming's Wine is open-source except for a portion of the DirectX (not all of it) libraries. You could potentially run your own company and beat them, or a "Giant" can have them without buying source. Transgaming emulates Windows libraries on Unixes (starting with Linux and now on Mac OS X.) Does an Apple certified vendor or Apple actually sell proprietary Microsoft Windows Games support? (Not to my knowledge.)

Revenues: Eric Raymond probably has a few tips. Product Engineering outfits do widget frosting, the model that's simple to understand. Some "violate" Open Source citing that they cannot make profits; on similar arguments raised here. Savings as revenue is an oft cited case. Today it is far more relevant. If your cost to create something is potentially reduced you can reduce the price a customer has to pay while you still make a profit.

My former employer did buy software for incorporating into products. My former employer is a profitable product company. However, because we could not modify one small piece of the bought-in black box (with no possibilities to acquire source at any cost) we just had a 25% increase in development life-cycle. That was "Loss." We decided never again to consume anything from "closed source" companies as it potentially created black boxes of uncertainty within our own products.

Open Source is not Free(dom) Software always nor is it Free (Beer.)

Source code (which is open,) is a more primitive formal expression of the binary format of the product which is re-usable and easier to modify than the binary format of the product.

The binary format (executable files) of many products can also be reverse engineered. (Remember Borland!? They did not advocate Open Source but where caught up with Sidekick.) This is also easy for a heavy-weight as opposed to a smaller group.

Myth: "Open Source makes a startup vulnerable to acquisition."
Truth: "Low on Cash makes anything vulnerable to acquisition."

Myth: "Open Source companies suffer a handicap while trying to make revenue."
Truth: "Companies unprepared to serve their customers suffer a handicap while trying to make revenue."

Time, the press stopped incorrect interpretation of Open Source as non Revenue Generating.

Watch this video (at youtube) for Guy Kawasaki's take on "Revenue from Open Source" and "Open Source enabling Startups."

A Weekend that wasn't so gloomy

This weekend, I have been following up with everything that I've been doing over the week in my spare time. I decided to do some real coding and come up with something creative that I could probably deploy even at work. The result is something quite nice where I've pieced together the initial ingredients for what should become a useful toolbox for embedded system/user-space applications. Part of my drive was to create a usable replacement for busybox which almost stands out as the single swiss-army-knife that embedded linux deployments use.

At this stage I haven't started a project page and involved more people, but through the next week that should be possible.

I was also tweaking the iwp3945 drivers as I had quite some trouble getting my custom kernel working on my laptop with wireless access enabled. Pairing with the AP wasn't ever happening. While all this was on, I needed to move a heavy table near my desktops and pulled a muscle and probably tore a ligament in my back. I took some rest finally and feeling much better am just trying to cruise on with the code after reading some interesting articles on anthropology.

It seems that the product I've been working on at office would finally hit the road after one last weekend of stress testing. I haven't heard someone screaming for help which means there is a stable set of system software that should be able to take it without surprises.

On Saturday, I met up with a friend after quite a while having some time to have a long conversation with both of us not too busy. I did experience the horrific traffic on MG Road in Bangalore in an Auto (Driving my Car was out of the question.) This being a Saturday, it was probably amplified thanks to the inching work on the Bangalore metro project.

Foss.in

Today, I spent time actually listening to people on Free/Libre Open Source Software (FOSS/FLOSS) at the Foss.in Conference. It was a nice experience listening to many of the speakers. I enjoyed Rusty's talk more than anything else. The event had some strange things. The sponsors (including IBM, Sun, Google, ABB, GMI/Trolltech, Redhat and others) were seriously headhunting.

The organisation (of the event) had its share of technical snags. The one thing that did function right was WiFi access to all the delegates. The rest was a bit shabby but better than all the earlier events. I also got to meet a few old friends and acquaintances. In some ways my hacker (MIT sense of the word, wanting to write code that adds features/solve problems in a cool way) side was ignited.

It was also different from a normal day at work which also added up. I am feeling a bit bad that I wouldn't be attending a "want to be there" talk tomorrow by Harald Welte. But hopefully that should be doing something nice at work.