Immutable Security

When I bought a laptop about three years ago, I booted it up, read the Windows Vista EULA and decided it wasn’t for me. A quick reboot and install of Ubuntu took care of my concerns and has served me well since then. So when that laptop bit the dust, I already knew that Windows wouldn’t be on the laptop long enough to boot to the EULA.

Even though I am using predominantly free software, there are trade-offs and decisions to be made. Do I want to use the free ATI driver at the expense of 3D acceleration and performance or the more fully-featured non-free version? Do I want to use the Adobe Flash player (from a company who had Dimitry Sklyarov arrested for legal activities in his own country) or the free-but-somewhat-buggy Gnash player? Would I be willing to give up contributing to OSSEC Windows Agent development, even though the agent, itself, is free?

Perspectives on software freedom range from purists such as Richard Stallman, who believe all software should be free, to people like my wife, who really don’t care and would rather just have it work. For myself, I am most interested in maintaining a healthy marketplace where free and non-free software can offer users viable alternatives–a marketplace that ensures information can be exchanged freely and easily. Using and maintaining proficiency in free software allows me to easily make that choice if the developer of a non-free software application presents unacceptable terms.

We’re entering a new era of computing. It’s an era where phones and tablets are finally making their mark, while desktop computing takes a back seat. It’s also an era where user choice is being annihilated by companies like Apple, who make it abundantly clear that they consider the device they sold to the consumer to still be theirs, and who act as the gatekeeper deciding exactly how you can use your device. It’s an era where the bundling of the browser to the OS is the least of our worries; now the companies control the entire platform.

Freedom is all about choice. It’s also about evaluating the trade-offs. When there is a clear free and non-free solution to my problem, I try to default to the free option. By doing so, I help to keep the ecosystem alive and thriving, which, in some small way, ensures the free flow of our information now and in the future.

Update: A perfect example of Apple trying to control the free flow of information can be found in this article, in which Apple is described as removing the Wikileaks app. It is not for Apple to decide whether or not its customers should be the consumer of such information on devices they own. Enough said.

My wife got an Apple iPhone over the weekend. It’s an amazing piece of technology. Apple has done a fine job adapting a traditional computer into a phone form-factor. It truly sets the bar at an entirely new level for portable computing. Of course, there’s also an integrated phone.

I emphasize that it’s a computer because it has all of the characteristics of a computer. With the iPhone, the phone is simply another application on the computer–not unlike a Skype application might be installed on your Windows computer.

Our models of computers and phones have strong, but mostly disassociated relationships. We have a history of using computers as an important extension of all sorts of information. We understand that allowing others to have total control over our computers in generally a bad thing, whether that someone is a government entity, corporation or script-kiddie. Phones, on the other hand, have traditionally been far less complicated. There is a pretty basic hardware device and a service provider. The risks are well understood.

As I was playing with the iPhone and trying to find ways to meet my wife’s IT needs, it became increasingly clear how little control I had over this computer. Without jailbreaking the phone, I had no way to get a shell, and therefore no way to collect logs, change passwords, harden the underlying OS, install intrusion detection, or do any of the other things I would normally do to a computer I managed. Apple was my only source for applications and only those applications which Apple approved of could be installed. My hands were completely tied.

Unless I jailbreak this phone and accept the risk of something else not working, or Apple breaking it in an update, and explore the ethical questions as a result of doing so, I am completely at the mercy of Apple for the phone security and functionality. My risk assessment is theirs. My acceptance of risk is their acceptance of risk, which undoubtedly is primarily influenced by their bottom line.

This goes far beyond risk management. Imagine the outcry if Microsoft only allowed applications which they permitted to be run on Windows. We would have a world entirely dominated by Microsoft.

We need to lobby our lawmakers to, without equivocation, absolutely require computing platforms to be open enough for fair competition and where one company cannot call all of the shots. This is not about open source, this is simply setting requirements for a heterogenous platform where the risk of total control of data is minimized.

As the world becomes more mobile, this will need to be increasingly recognized as an essential liberty.