This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.
You can find the current article at its original source at http://www.theguardian.com/technology/2013/oct/18/open-xchange-closed-source-security
The article has changed 3 times. There is an RSS feed of changes available.
| Version 1 | Version 2 |
|---|---|
| Open-Xchange wants you to dump closed source – and embrace security | Open-Xchange wants you to dump closed source – and embrace security |
| (35 minutes later) | |
| Users should not trust closed-source services like Apple's iCloud with their personal data, said the chief executive of Open-Xchange, a cloud software firm which provides app suites to some of Britain's biggest service providers. "Really paranoid" users should consider switching to phones running the Firefox OS, he added. | Users should not trust closed-source services like Apple's iCloud with their personal data, said the chief executive of Open-Xchange, a cloud software firm which provides app suites to some of Britain's biggest service providers. "Really paranoid" users should consider switching to phones running the Firefox OS, he added. |
| Rafael Laguna, who co-founded the open-source software firm after having previously worked with Suse Linux, an open-source operating system, says the best way to guarantee security is to let users choose – even if only theoretically – where to host their software, and let them examine the code for flaws and back-doors. | |
| Open-source software makes its source code, the set of instructions which make the program work, available for public inspection and enhancement. The vast majority of commercial software is closed-source, and users must take the integrity of the code on trust. | |
| The philosophy behind open-source programming began as a radical attempt to ensure “that users had rights with respect to their computer programs”, in the words of cyber theorist Evgeny Morozov, but increasingly the security aspects have come to the fore. | The philosophy behind open-source programming began as a radical attempt to ensure “that users had rights with respect to their computer programs”, in the words of cyber theorist Evgeny Morozov, but increasingly the security aspects have come to the fore. |
| If the source of a program is made available, skilled users can examine it to check the promised security is actually attainable. Laguna argues that the same should be true of hardware. | |
| “I feel much better if I can think that some people check whether the stuff that’s being done with my data is decent,” he told the Guardian. “What do I know? I mean, do you know what your iPhone does? You don’t, right, because it’s a closed stack. And it’s doing crazy stuff, you know it’s doing crazy stuff, but you’re still not worried enough to not use it anymore. | “I feel much better if I can think that some people check whether the stuff that’s being done with my data is decent,” he told the Guardian. “What do I know? I mean, do you know what your iPhone does? You don’t, right, because it’s a closed stack. And it’s doing crazy stuff, you know it’s doing crazy stuff, but you’re still not worried enough to not use it anymore. |
| “Something that’s going on, and people know it but nobody really captures what it means, is the fact that these guys know all wireless networks, passwords, over the world. So even your closed, Guardian, private, intranet wireless, right, once you log in, it’s on an Apple server. And the same for Google, of course. | “Something that’s going on, and people know it but nobody really captures what it means, is the fact that these guys know all wireless networks, passwords, over the world. So even your closed, Guardian, private, intranet wireless, right, once you log in, it’s on an Apple server. And the same for Google, of course. |
| “Yeah, they can tell me it’s only for backup purposes, and I love the restore function [to set up a new handset from old settings] too, it’s great, and yeah, it’s encrypted on their servers – yeah, yeah, yeah – but what do we know? What do we know?” | |
| Laguna says: “Trust is personal. Maybe you don’t trust Wordpress.com, and I do – or vice versa. You may not trust BT, but you trust IOMart. Or you trust no one, so you get your own machine and run [Open-Xchange], or put up a virtual machine on your laptop. And you run Linux on the machine, and if you’re really paranoid it’s an open hardware machine, and then you access it on a Firefox OS phone instead of an iPhone.” (Google's implementation of Android is not completely open-source because users can't review the code Google uses for its Mail, Maps and other offerings, though the Android Open Source Platform – used by many Chinese handset makers – is available for download, review and update.) | |
| Open-Xchange attempts to use some of the security features inherent to open-source software to provide a cloud-based app suite without the risks associated with using something like Google Apps, which stores users’ data on servers vulnerable to government seizures. | Open-Xchange attempts to use some of the security features inherent to open-source software to provide a cloud-based app suite without the risks associated with using something like Google Apps, which stores users’ data on servers vulnerable to government seizures. |
| Users of the apps, which include a calendar service, email, file storage and a text editor, can host their data with any company they feel comfortable trusting – and if they lose faith in one provider, it’s easy to port not just data, but the entire software suite. | Users of the apps, which include a calendar service, email, file storage and a text editor, can host their data with any company they feel comfortable trusting – and if they lose faith in one provider, it’s easy to port not just data, but the entire software suite. |
| “The reason Phil [Zimmermann] shut down his service [Silent Circle's encrypted email] is that he was the only service provider that could provide it. And since he was a US company, he said ‘I’m not worth the trust that people have in me, because the NSA could walk in my door at any time and get the data’. And I told him: ‘Phil, the problem is that you had a model where there only is one service provider.’ You could still run this service and tell people: ‘Look, guys, if you’re not worried about the NSA walking into my room, continue using my service. If you are, here’s others that are maybe not based in the US and so forth. And if you’re really paranoid, here’s the software, install it, run it yourself, and be done with it.’” | |
| Laguna argues that cloud applications were beginning to break the natural security features of the open web. “To do what we’ve done so well for the internet, by building it on open source and open protocols … we need to do the same for applications. We’ve been doing it all wrong when it comes to cloud applications, because most of them are only available from one provider. So rule one is make sure you get a service that’s available from many providers.” | |
| The problem with using so few companies to control nearly all of our online presence is that “from a genetic perspective, this is in-bred pure bullshit, this stuff can’t survive … it’s almost like feudalism. You get these inbred kings.” | |
| There are other benefits to moving more of our data to open-source software. “We may never be able to stop websites from crashing or keep bugs from creeping into code. But opening the process would expose what went wrong and why,” argues Paul Ford in Bloomberg Businessweek. | |
| Ford made the case for opening the source code the software behind the disastrous US launch of healthcare.gov, the national site for the American healthcare exchanges. | Ford made the case for opening the source code the software behind the disastrous US launch of healthcare.gov, the national site for the American healthcare exchanges. |
| Laguna’s words come as the cabinet secretary, Francis Maude, was revealed to have bypassed government security in order to create a Wi-Fi network in his office. | |
| The Cabinet Office minster was fed up with the “rubbish” and “clunky” – but secure – network in Westminster, and so started his own, leading security researcher Rik Ferguson to condemn his “willingness to endanger the security of the parliamentary network, systems and data”. | The Cabinet Office minster was fed up with the “rubbish” and “clunky” – but secure – network in Westminster, and so started his own, leading security researcher Rik Ferguson to condemn his “willingness to endanger the security of the parliamentary network, systems and data”. |
| • Even open-source software couldn't have saved Mat Honan, who nearly lost his entire digital life after his iCloud account was hacked. | • Even open-source software couldn't have saved Mat Honan, who nearly lost his entire digital life after his iCloud account was hacked. |
| Our editors' picks for the day's top news and commentary delivered to your inbox each morning. | Our editors' picks for the day's top news and commentary delivered to your inbox each morning. |