The Security Confirmation Bubble

I know, I know, that sounds like the title of an episode of "The Big Bang Theory".

To better understand what I mean by this you first have to understand what a confirmation bubble is. When you have a certain view on a topic, you lean to only accept information that confirms this view. A logical fallacy that can be made worse with the selection of like minded social circles or even more so with Googles search algorithms that tailor search results to ones preferences.

So it's basically a problem securing that you develop blind spots to important information.

With my recent outreach to use more minority operating systems demonstrated to me a very dangerous one. The obliviousness of Apple and Linux users to threads to their systems security, usually combined with scapegoating Windows as the sole problem child. This arrogance pretty much leads to evangelists outright praising their respective systems for how it is not necessary to even think about security - and making their systems a feast for hacks.

You see, obviously people often think of security problems only as viruses and adware. Things that make their presence known pretty fast, and you won't find that many on either Mac OS X and Linux. But while those are pretty nasty for the desktop users, trojans that hijack your system to add part of their computing power to botnets, and part of that combined power is used to automatically hack the next system are IMHO worse.

Actually I lived pretty secure with my windows desktop, always being aware of security risks, but as soon as I had a Linux server directly connected to the internet, it was hacked. Two times actually. The first time a bot found a weakness in a badly configured Samba Server that was accidentally open to the internet, the second time a friendly hacker manipulated my system finding a security whole in a well known Open Source PHP solution. He only changed the starting page and left his contact. And these are the ones I knew about. Actually I stopped to use that machine to use it for anything other than using it as a firewall, and started using a Windows Server for any service I needed.

Sure, each time the problems were not directly related to the operating system, but it didn't automatically secure the system either. The Samba problem was so common that it was one of those selfhacking bots I mentioned, and we quickly found out about it, because it was so active that it used up the full bandwidth and I later learned that my machine hacked others by reviewing the protocols. That thing was badly constructed, while it nailed the hacking part it failed to keep its presence hidden.

Can you see why this Security Confirmation Bubble is so dangerous? It makes people of oblivious to the fact that, while the systems can be very secure, you always need to keep an eye on security, just using a certain operating system doesn't give you a "get out of that hell" card. Espacially Linux, while not so common on the desktop, runs most webservers. Rarely watched closely. Very yummie for hacks, like the Windows Desktop attracts spambots. If you get lazy because everyone tells you how secure your operating systems are and maybe even belittle windows users, in fact, you're not only contributing to your own insecurity, but to those of others as well, open up your system to criminal misuse.

Don't fall for it only because it is so uplifting and comforting. Just don't!

I did it...

... I built a triple boot Hackintosh (, Windows 8 and Ubuntu 12.04) installation on my workhorse. Does it make sense? Yes, for frontend development, no for pretty much everything else. And so my pride that I managed it is mixed with mourning for a "wasted" workweek. This project was hellish and straining. First of all the Hackintosh installation was neigh impossible until I found out that with this special combination of board and gpu I had to active the onboard VGA graphics to be able to install it. I accidently found out about it when I was ready to give up. Up to that point I tried various bootmedia variants, including one that got me kicked from a very important forum when I mentioned it, and dis - and reassembled the GPU several times. At least, after I finally got it, I knew what two post installation tasks got the system stable and I could go on.

Next was the Windows installation. I bought the Update for about 40 USD last November, and while you could download a complete ISO, I was in for a bad surprise after making a clean install. A clean install didn't accept the update key, you had to install a Windows 7 before. Thankfully I found a small registry hack online the must be done directly after installation, and that came back to bite me, because I had to reinstall it so often. And I was pretty angry about the "Honest Customer paradoxon" here (meaning: As honest customer you get treated like a criminal with a lot of unneccessary, complicated copyprotection, while the pirate gets an easy to use version without all that hassle)

In that order, the final system is Ubuntu, and yes, that one isn't that complicated, but you have to be very carefull with some installation option, and I wasn't the first time, got it wrong the second time, and after reaching my third installation I had to reinstall the others several times, espacially Windows, as that registry hack only worked about half the time.

After the Linux installation you have to repair what seems to be an unholy mess of different partitioning types, but that did go surprisingly well. But there was the last step (or so I thought) of setting the OS X installation the active partition, because there would be a bootloader for all three systems. At first I tried it by the book with Windows. Didn't work, the options were grayed out, even after I activated the Administrator account to do it from there. So I tried Linux again, that system being the swiss army knife of OSes should easily do this task - but it didn't. Well it might be that there is the perfect commandline tool out there to do it, but fdisk warned my that it might mess up that aforemented unholy partitioning table thing. And I tried a desktop - discmanagement software, but that showed no information where it should, so I didn't trust it. Fdisk actually recommended one of the old GNU commandline tools, but its "man"-page was a reminder of the bad old days and did not tell how I could activate a partition, only that it could be done.

But I found a description on how I could make it from... no not the OS X installation, but its installation media, which boots to a configuration desktop that allows you to use a commandline, and there was an fdisk that could handle that complicated matter.

I needed two tries though, because OS-X has a small boot partition and my first try was to activate that, but its really the main partition that you have to activate.

I thought I was finished, but I didn't allow myself to feel too happy, because the whole process had tought me that it ain't over till its over...

... and I found out that I had no bootloader installed. So I installed one, but that one, like the OS-X installation itself, only worked with enabled onboardvga, which I had to decativate for the two other systems, so that too, needed another try (switching from Chameleon to Chimera was what worked out).

And than the final test. I booted to Mac OS X, Ubuntu, no problems, than to Windows 8 - and my PS/2 connected mouse and keyboard where missing (USB did work). Not my precious Windows installation! Again a few restarts to assure myself that I didn't just accidently deactivated something in the bios or destroyd it somehow with that shiny new bootloader but the others worked perfect, and there wasn't even an option in the BIOS that could affect the PS/2 connectors.

So I loaded the chipset drivers and installed them. And then, finally, everything seemed to work out.

But at least I have a very fine system now, and I do not only mean my machine, but the others too. I will configure the standalone Ubuntu as (partially versioning) fileserver, mediaserver and as my permanent access to all that social media. I won't install those on windows this time, hopefully helping me not to get distracted too easily.