My Friend Alan Rocker and I often discuss ideas about technology and tradeoffs. Alan asked about SSDs for Linux:
> I haven’t been following hardware developments very closely for a while, so I
> find it hard to judge the arguments. What’s important?
Ultimately what’s important is the management software, the layer above the drivers, off to one side. That applies regardless of the media and means that the view the applications take of storage is preserved regardless of changes in the physical media.
> The first question is, what areas are currently the bottlenecks and
> constraints, at what orders of magnitude?
I’ve worked in places where the policy was that you’re not allowed to bring a camera in; that was before cell phones, I admit, but I imagine there are places where such is enforced today. My current cell phone doesn’t have the resolution of a spy-era Minox, but there are better available, and a phone has a lot more storage and fair bit of image processing power.
At the very least, this will apply a ‘many eyes’ to some of the SSL code and so long as the ssh pruning isn’t wholesale slash-and-burn that cutting it back may prove efficacious for two reasons.
Less code can be simpler code, with decreased likelihood of there being a bug due to complexity and interaction.
If this is simply to be a ‘mirror’ of the regular file system, a 1:1
file mapping then there is no need for some specific optimizations as there would be if, for example, each snapshot were to be a single large file, a TAR or CPIO image say. You then have to look at what you are archiving: small files, large files …. Archiving mail a mbox is going to be different from archiving as maildir. For example the later is going to consume a LOT of inodes and that affects how one would format a ext2, est3 r ext4 file system but not be relevant on a ReiserFS or BtrFS.
b) the demand for retrieval from the archive
This is actually a can of worms. You might not think so at first but I’ve seen businesses put out of service because their ‘backup’ indexing was inadequate when the time came to retrieve a specific archive file of a specific date, as oppose to restore the whole backup. You need to be driven by your business methods here and that in turn will determine your indexing and retrieval which will determine your storage format.
Its business drive, not technology driven. Why else would you be archiving?
Now while (b) is pretty much an ‘absolute’, (a) can end up being flexible. You HAVE to have a clear way of retrieval otherwise your
archive is just a ‘junk room’ into which your file system overflows.
That (a) can be flexible also means that the optimization curve is not clearly peaked. Why else would you be asking this question? What’s the worst situation if you choose ReiserFS rather than extN? The size of the file system? The number of inodes?
But if your indexing broken or inadequate you’ve got a business problem.
I’m dubious.
On the one hand I recall a book titled “In Search of Stupidity“, which I strongly recommends reading, its about the hi-tech years that this article covers and takes a different view of how “quality” addressed market share.
On the gripping hand, I also lived though the years that book describes and can add detail. One detail is this. MS-Word was crap. Most offices/secretaries preferred WordPerfect, but MS-Word outsold WP by aggressive marketing – nothing else. The quality of MS-Word was the pits and its still full of bugs. Each release formatted historic documents in a different way, which is no-no in the legal (and other) profession. Its handling of nested indents in style sheets is a mess, so much so that many industries such as MILSPEC contractors simply don’t use style sheets.
I’m dubious about his claim that Linux has fewer add-on products.
Heinlein has a comment about democracy being like adding zeros.
If you look at those supposed products or Windows you’ll find many of them are “me-too” duplicates. We haven’t reached that stage yet with portable devices but we are getting there. When you get there, yes you do have one market leader; when people are spoilt for choice like that then a review or a friend’s recommendation can trip the balance, and that too can propagate. This has little to do with ‘quality’ and a lot to do with a cross between humans ‘herd instinct‘ and the way crystals form in a super-saturated medium.
Faced with an attack surface that seems to be growing at an overwhelmingrate, many security professionals are beginning to wonder whether their jobs are too much for them, according to a study published last week.
Right. If you view this from a technical, bottom-up POV, then yes.
Conducted by Frost & Sullivan, the 2011 (ISC)2 Global InformationSecurity Workforce Study (GISWS) says new threats stemming from mobile devices, the cloud, social networking, and insecure applications have led to “information security professionals being stretched thin, andlike a series of small leaks in a dam, the current overworked workforce may be showing signs of strain.”
Patching madness, all the hands-on … Yes I can see that even the octopoid whiz-kids are going to feel like the proverbial one-armed paper-hanger.
Which tells me they are doing it wrong!
Two decades ago a significant part of my job was installing and configuring firewalls and putting in AV. But the only firewall I’ve touched in the last decade is the one under my desk at home, and that was when I was installing a new desk. Being a Linux user here I don’t bother with AV.
“Hands on”? Well yes, I installed a new server on my LAN yesterday.
No, I think I’ll scrub it, I don’t like Ubuntu after all. I’m putting
in Asterix. That means re-doing my VLAN and the firewall rules.
So yes, I do “hands on”. Sometimes.
At client sites I do proper security work. Configuring firewalls, installing Windows patches, that’s no longer “security work”. The IT department does that. Its evolved[1] into the job of the network admin and the Windows/host admin. They do the hands-on. We work with the policy and translate that into what has to be done.
Application vulnerabilities ranked as the No. 1 threat to organizationsamong 72 percent of respondents, while only 20 percent said they are involved in secure software development.
Which illustrates my point.
I can code; many of us came to security via paths that involved being coders, system and network admins. I was a good coder, but as a coder I had little “leverage” to “Get Things Done Right”. If I was “involved” in secure software development I would not have as much leverage as I might have if I took a ‘hands off’ roles and worked with management to set up and environment for producing secure software by the use of training and orientation, policy, tools, testing and so forth. BTDT.
There simply are not enough of us – and never will be – to make security work “bottom up” the way the US government seems to be trying We can only succeed “top down”, by convincing the board and management that it matters, by building a “culture of security”.
One view of Enterprise Information Security Architecure (EISA) Framework.
This is not news. I’m not saying anything new or revolutionary, no matter how many “geeks” I may upset by saying that Policy and Culture and Management matter “more”. But if you are one of those people who are overworked, think about this:
Wouldn’t your job be easier if the upper echelons of your organizations, the managers, VPs and Directors, were committed to InfoSec, took it seriously, allocated budget and resources, and worked strategically instead of only waking up in response to some incident, and even then just “patching over” instead of doing things properly?
Information Security should be Business Driven, not Technology Driven.
We’ve been putting many computer eggs in one hardware basket for a long, long time.
What do you think mainframes running MVS and VM/CMS were?
What were things like air traffic control?
The ‘desktop’ is a fuzz concept that gets confused with a GUI.
Those mainframes – think airline ticket and reservation – could handle many hundreds of remote terminals, keeping them updated.
“According to a report in the Financial Times, Google are phasing
out the use of Microsoft‘s Windows within the company because of
security concerns. Citing several Google employees, the FT report
reports that new hires are offered the option of using Apple Mac
systems or PCs running Linux. The move is believed to be related to a
directive issued after Google’s Chinese operations were attacked in
January. In that attack, Chinese hackers took advantage of
vulnerabilities in Internet Explorer on a Windows PC used by a Google
employee and from there gained deeper access to Google’s single sign
on service.
Security as a business decision?
Don’t make me laugh!
Look at what precedence they’ve shown!
Look at Microsoft’s attitude and approach to security (no matter how flawed the end result) and compare it with the public stance Google has taken.
No, this is about Business Politics.
Microsoft has been ‘staggering’ this last decade and now Apple is on the ascendency and the real battle will no longer be in the PC world but in the consumer world with embedded systems.
On the surface this will be Android vs Apple, but since embedded Linux goes so much further, embedded in TVs, GPS units, traffic light controllers, and perhaps it will even replace UNIX in telephone
exchanges (ha-ha-ha!) there’s more potential.
(Freudian slip: I just wrote portential.)
Yes, Microsoft hasn’t been asleep in the embedded market, or the phone/PDA market, but compared to Linux its a resource hog. To top that, its also proprietary, so vendors rely on Microsoft for the porting to new processor/hardware and for support. Linux/Android doesn’t have that limitation. And there are plenty of ‘kiddies’ eager to play with Android (source) on a new toy.
No, this isn’t a security issue, its a business and political issue.
If Google is pushing its range of Android products then it doesn’t want to have people – journalists, investors, bloggers – saying “yes, but you USE Windows even though you preach Linux”.
Or perhaps you though Google was taking the “High Moral Ground”?
No, I think they are taking the advice of Sun T’Zu and applying it to business
“For them to perceive the advantage of defeating the enemy, they must
also have their rewards.”
Betcha Google will be supplying Android phones/slates/pads to its workers.
“He who knows when he can fight and when he cannot, will be victorious.”
Look at that ZDNet article and think about the timing of Google’s announcement.
“It is essential to seek out enemy agents who have come to conduct
espionage against you and to bribe them to serve you. Give them
instructions and care for them. Thus doubled agents are recruited and used.”
Think about that one.
“Opportunities multiply as they are seized.”
And look how Android is spreading.
Balmer said Linux was a virus – yes a “meme”.
“Thus, what is of supreme importance in war is to attack the enemy’s strategy.”
Indeed. Microsoft has proclaimed a commitment to “security”. Bill Gates said so. That is their “strategy”. But Google is working on the fact that Microsoft products still have security flaws. Regardless of the reality, that is “voice” of this announcement. They are saying that Microsoft’s strategy isn’t working. They are attacking it in the minds of the consumers.
The price of recordable DVDs is now under $0.22 each That’s roughly 60 times cheaper than the current price for equivalent-size pen drives and more than 25 times the cost of the cheapest pen drives now being sold. And at most trade shows even the more expensive form, the credit card/business card format is being handed out like candy.
Yes, USB sticks are being handed out too, but not so eagerly.
Until pendrives can get Blank-DVD-level cheap — maybe inevitable, but not at least for five years or so — it will be cheaper to pass around bootable DVD media than bootable pen drives. Right now the USB-as-demo works fine so long as you hang around for the demo but is useless for a “try it on your own time” leave-behind (unless you like spending that kind of money for leave-behind, which may work for a reseller but not volunteer advocates).
All media is on a price curve. Its not the price of blank CDs/DVDs that counts, its that they can be printed. Yes, I can download and burn onto a blank, but if I’m in business I’ll get 10,000 printed and silk screened, and because of the way printing works the set-up is amortized over volume and that can never be approached by pen drives.
This was the same economics that meant a cassette tape album was often more expensive than a vinyl one and the CD was even cheaper!
You know all this … But its the price CURVES that are interesting. Blank CDs/DVDs are comparable to blank pen drives, so the price curves CAN be compared. CDs are ahead (in time) and the question is will their price bottom out as the cost of memory falls?
The falling cost of system memory makes the slow speed of LiveCD irrelevant. The $2,000 high end laptop of three years ago now costs under $700 and has 3G or 4G of memory rather then 1/2G. The compressed file system is loaded into memory and the dual (quad?) core CPU running 50% faster (3GHz rather than 2GHz) is so fast that this actually beats out installing on the hard drive!
![Reblog this post [with Zemanta]](http://img.zemanta.com/reblog_e.png?x-id=385bc731-2ca2-4f0c-840f-87ccc367aa04)
![Reblog this post [with Zemanta]](http://img.zemanta.com/reblog_e.png?x-id=4e874efc-a453-4260-81b6-b04a7142fad6)