Cloud, buducnost, prevara ili zabluda?

@pisac: Taj bug o kojem pricas je dosta zanimljiv, u njemu se user id umjesto provjere UID == 1, brisanjem samo jednog znaka jednako postaje root, UID = 1; mislim da je ta promjena usla u par developer git repositorija, ali su je ukapirali dok nije dosla do linusove. Samo jedan obicni znak. Neznam koliki je source od cijelog windowsa i sta oni daju strankama na analizu, ali ako se radi o cijelom sustavu kao sto svi instaliraju, sa GUI-jem i ostalim nebitnim stvarima onda bi bila potrebna vojska programera i milijuni sati da se samo povrsno sve analizira. Dali daju source od visual studio compilera, backdoorovi mogu biti plantani tokom kompajliranja. Ako je OS potreban za neki specificni zadatak na linuxu se moze samo staviti kernel, shell, ssh, security software, potrebni software njegovi libovi i libovi od sustava, mnogo je lakse za analizirati, nadgledati i znati tocno sta sve ima, koja mu je svrha i kako se ponasa.
Windows je mnogo osjetljiviji na malware, npr. Stuxnet, da nije slucajno presao na civilni laptop nebi se vjerovatno niti do sada otkrio.

Sve u svemu F/LOSS je mnogo transparentniji po tome pitanju.

^ Mislim da si u pravu.

Trebalo bi da ima mrezni pristup, pa nece valjda usb stickom (iz posta gore) da update-uje bazu npr. nekog server-a koji hostuje web service i web aplikacije ili da opsluzuje zaposlene ili/i musterije.

Think outside the box :)

Core banking i aktivni terminali nemaju nikakav fizicki ulaz/izlaz na internet, ne postoji nikakav prikljucak izmedju DMZa i core-a. I tu negde mislim da pocinje moj NDA, recimo samo da ethernet i OSI model nisu jedini nacin da se povezu dve masine.

Potpis

Sloba je za 12 godina promenio antropološki kod srpskog naroda. On je od jednog
naroda koji je bio veseo, pomalo površan, od jednog naroda koji je bio znatiželjan, koji
je voleo da vidi, da putuje, da upozna,
od naroda koji je bio kosmopolitski napravio narod koji je namršten, mrzovoljan,
sumnjicav, zaplašen, narod koji se stalno nešto žali, kome je stalno neko kriv - Z.Đinđić

I tu krece na posao DUQU

Specijalno napisani trojanci koji mogu pristupiti svim podacima, cak iako masina nije na internetu...

Doduse, ovo zahteva ogromne resurse da bi se implementiralo. A cloud je... sve na tacni.

Pade mi baš na pamet danas, primetili ste i sami da već par godina i Google i Yahoo (a možda i drugi, ali ih ja ne koristim) strašno smaraju sa time da im ostavite mobilni telefon, zbog eto tako... radi vaše sigurnosti

Naravno da sam bio ubeđen da im to treba za špijuniranje, mada nisam bio siguran na koji način bi špijunirali one koji ne koriste android/iphone i slične prepametne telefone.

E, sada je slika najzad kompletirana: to uopšte nije bilo potrebno ni guglu ni jahuu nego NSA lično, da lakše naprave agregaciju svih podataka o svakome na planeti, odnosno mrežu svih kontakata i celokupne komunikacije.

Dobrodošli u 21.vek

Moment in time. Cisto da posle 5 godina opet vidim dokle stigao thread. tj da li je cloud prevara koja je prsla ili buducnost :)

Potpis

www.yanado.com
www.startupscave.com
www.e-75.rs
www.twitter.com/mojsilo_

I jedno i drugo, cloud je prevera koja je buducnost.

Postavio sam link na jednoj drugoj temi, ali vezano je za cloud i vredi procitati, pogotovo ako vas brine sigurnost podataka:

http://www.networkworld.com/co...e-government-breaks-your-cloud

Hehehe, kako za koga :). Ima i onih kome je to sadasnjost i to jedina moguca :). Danas, 2013. godine preko 40% svih CRM sistema su cloud resenja i trend je takav da se tu nece zaustaviti. Najveci CRM vendor je danas cloud resenje. Sve vise i vise entreprise kompanija se odlucuje za takva resenja, sto "pratioci" u bransi oponasaju i tocak se vrti sve brze i brze, meni se cini nezaustavljivo. Videcemo da li ce ovaj skandal nesto promeniti.

^ pa to ti kazem. Nece nista promeniti samo gledaj.

Ne bih da ucestvujem u diskusiji za i protiv jer sam "biased" sto bi rekli ameri, ali pitanje za @mmx vezano za cirenje podataka iz FBI konkurentima:
zbog cega mislis da si ti sigurniji od FBI agenata?

Zbog cega je teze potkupiti tebe negko nekog FBI agenta?

Potpis

www.yanado.com
www.startupscave.com
www.e-75.rs
www.twitter.com/mojsilo_

Kad kupiš jednog FBI agenta imaš sve na pladnju, ovako moraš da podkupljuješ N (gdje je N prirodan broj) kojekakvih sitnih administratora ili već koga. Nisam paranoičan i nemam ništa posebno da krijem ali jako iritira činjenica da im sve serviramo na izvolite. Pa nekada su kopali tunele do komunikacionih kablova i šta ti ja znam a sada klik klik. Pa kopaj malo bato, ne može to tako lako.

Ne treba zanemariti ni momenat patriotizma pa će tako neki amer dosta olako prodati podatke njemačke firme francuzima ili obrnuto. Tu je još i pravni momenat, čak i da zanemarimo da su u pitanju teško dostupni službenici tajnih službi, amer je praktično nedohvatljiv nijemcu ili francuzu dok oni koji bi to uradili u lokalu mogu i te kako da odgovaraju.

Rezime, ja da imam nešto baš bitno, lično ili poslovno, ne bi bilo dostupno tako lako, neka kopaju malo tunele :-)

Revealed: how Microsoft handed the NSA access to encrypted messages

• Secret files show scale of Silicon Valley co-operation on Prism
• Outlook.com encryption unlocked even before official launch
• Skype worked to enable Prism collection of video calls
• Company says it is legally compelled to comply

Glenn Greenwald, Ewen MacAskill, Laura Poitras, Spencer Ackerman and Dominic Rushe
The Guardian, Thursday 11 July 2013 18.53 BST


Skype worked with intelligence agencies last year to allow Prism to collect video and audio conversations.

Microsoft has collaborated closely with US intelligence services to allow users' communications to be intercepted, including helping the National Security Agency to circumvent the company's own encryption, according to top-secret documents obtained by the Guardian.

The files provided by Edward Snowden illustrate the scale of co-operation between Silicon Valley and the intelligence agencies over the last three years. They also shed new light on the workings of the top-secret Prism program, which was disclosed by the Guardian and the Washington Post last month.

The documents show that:

• Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal;

• The agency already had pre-encryption stage access to email on Outlook.com, including Hotmail;

• The company worked with the FBI this year to allow the NSA easier access via Prism to its cloud storage service SkyDrive, which now has more than 250 million users worldwide;

• Microsoft also worked with the FBI's Data Intercept Unit to "understand" potential issues with a feature in Outlook.com that allows users to create email aliases;

• In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism;

• Material collected through Prism is routinely shared with the FBI and CIA, with one NSA document describing the program as a "team sport".

http://www.guardian.co.uk/worl...ft-nsa-collaboration-user-data

Pa moto im je:


"Your privacy is our priority" :D

http://www.eatliver.com/i.php?n=10761

The crux of the NSA story in one phrase: 'collect it all'

The actual story that matters is not hard to see: the NSA is attempting to collect, monitor and store all forms of human communication


Glenn Greenwald
guardian.co.uk, Monday 15 July 2013 11.40 BST


The Washington Post this morning has a long profile of Gen. Keith Alexander, director the NSA, and it highlights the crux - the heart and soul - of the NSA stories, the reason Edward Snowden sacrificed his liberty to come forward, and the obvious focal point for any responsible or half-way serious journalists covering this story. It helpfully includes that crux right in the headline, in a single phrase:


What does "collect it all" mean? Exactly what it says; the Post explains how Alexander took a "collect it all" surveillance approach originally directed at Iraqis in the middle of a war, and thereafter transferred it so that it is now directed at the US domestic population as well as the global one:

"At the time, more than 100 teams of US analysts were scouring Iraq for snippets of electronic data that might lead to the bomb-makers and their hidden factories. But the NSA director, Gen. Keith B. Alexander, wanted more than mere snippets. He wanted everything: Every Iraqi text message, phone call and e-mail that could be vacuumed up by the agency's powerful computers.

"'Rather than look for a single needle in the haystack, his approach was, 'Let's collect the whole haystack,' said one former senior US intelligence official who tracked the plan's implementation. 'Collect it all, tag it, store it. . . . And whatever it is you want, you go searching for it. . . . .

"It also encapsulated Alexander's controversial approach to safeguarding Americans from what he sees as a host of imminent threats, from terrorism to devastating cyberattacks.

"In his eight years at the helm of the country's electronic surveillance agency, Alexander, 61, has quietly presided over a revolution in the government's ability to scoop up information in the name of national security. And, as he did in Iraq, Alexander has pushed hard for everything he can get: tools, resources and the legal authority to collect and store vast quantities of raw information on American and foreign communications."

Aside from how obviously menacing and even creepy it is to have a state collect all forms of human communication - to have the explicit policy that literally no electronic communication can ever be free of US collection and monitoring - there's no legal authority for the NSA to do this.

http://www.guardian.co.uk/comm...jul/15/crux-nsa-collect-it-all

Evo jednog dobrog teksta o tome kako je jeftino imati infrastrukturu u cloud-u

Why Some Startups Say the Cloud Is a Waste of Money

Istina je da u jednom trenutku moze biti jeftnije imati svoj DC, ali to je poprilicno dalek trenutak za vecinu firmi.

Ono sto je kod AWS sjajno nije cena, vec fleksibilnost. Mozete imati desetine (neki i hiljade) servera u setup-u i ukoliko ga ispravno podesite sistem sam odstranjuje instance koje su u kvaru i zameljuje ih novim, sam gasi broj servera ukoliko imate seznoske peak-ove i slicno.

Da ne pominjem backup ako se radi kako treba (a mnogi ne rade).

To je ono sto je meni fascinatno. Voleo bih kad bi se javio neko ko je radio u brzo rastucim firmama pa da podeli iskustvo skaliranja.

Potpis

www.yanado.com
www.startupscave.com
www.e-75.rs
www.twitter.com/mojsilo_

http://www.theregister.co.uk/2013/08/15/salesforce_data_outage/

Salesforce je izgubio 1 sat podataka odredjenih klijenata.

Izgleda nisu culi za transaction-log ;-) Ali nema veze, korisnike ce grejati toplo oko srca to sto su u Cloud-u.

Potpis

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

Dobro je sto nije bilo na na5 i na4, naje*ao bi im se mile majke Imali su skoro i raspad na na5 kad su radili neki update pa su zakucali celu instancu i niko nije mogao da se uloguje. Srecom nisu nam izgubili nikakve podatke.



Inace, pocinje procena fallout-a

http://www.theregister.co.uk/2.../prism_revenue_wobble_worries/

Neverovatno kako sam se prepoznao u ovome

"Non-US cloud companies have been able to sow fear, uncertainty, and doubt (FUD) about US clouds due to the data-slurping provisions in the USA PATRIOT Act, but the NSA revelations now give these cloud naysayers more ammunition than ever before."

Potpis

Sloba je za 12 godina promenio antropološki kod srpskog naroda. On je od jednog
naroda koji je bio veseo, pomalo površan, od jednog naroda koji je bio znatiželjan, koji
je voleo da vidi, da putuje, da upozna,
od naroda koji je bio kosmopolitski napravio narod koji je namršten, mrzovoljan,
sumnjicav, zaplašen, narod koji se stalno nešto žali, kome je stalno neko kriv - Z.Đinđić

Naravno, taj NSA fijasko ce se meriti desetinama milijardi dolara a mozda i vise ako ne bude nekako doslo do povracaja poverenja.

Gradualno ce firme koje su pod obavezama maticnih drzava / saveza (kao sto je EU) svoju infrastrukturu drzati tamo gde imaju zakonsku sigurnost. USA je bukvalno za kratko vreme sebe dovela u poziciju da se na njih gleda ne tako razlicito od Kine i sl... sto se tice pravne nesigurnosti podataka.

Kako se sve veci % infrastruktura seli u "cloud" to ce neminovno jako brzo dovesti do sukoba komercijalnog i "defense" lobija u kongresu i senatori. To ce biti zanimljivo za gledanje - jadni mali kongresmeni i senatori, posto kinticu dobijaju i od jednih i od drugih - bice nezgodno :)

Potpis

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey