Our interview this week is with another great, in this case Chema Alonso, who was the subject of our questions . He kindly took the time to answer us exclusively, something we appreciate given his busy schedule.
I think Chema Alonso, one of our most popular national hackers , needs no introduction, and I believe you should understand the true meaning of the word "hacker." For those who don't know him, you can find out more by Googling him, and I encourage you to visit his blog, where you'll find interesting posts about security. You know, Elladodelmal is waiting for you. In the meantime, you can read what he replied to us.
Linux Addicts: 1- The first question is a must… Pablo Motos, Jordi Évole, Mamen Mendizábal and now me. What happened to you, Chema?
Chema Alonso: I try to get to everyone. I answer all the emails and messages I receive. It's true that I'm overwhelmed. I get messages on Twitter, Facebook, Google+, YouTube, Instagram, the blog, email, and so on, and it's completely impossible for me to find the time to answer them all, but I swear I try. As for journalists, the truth is I've had the pleasure of working with some very good ones on television, but also some very good ones in print and online. If I find the time, I answer the interview requests.
LxA: 2-I understand that you have been a Linux professor and have worked with Linux distributions throughout your career. What do you like about it and what would you like to change?
CA: Yes, that's true. I've been a GNU/Linux instructor for many years and have taught many Red Hat courses—Red Hat was the most advanced in the late 90s. What I like about GNU/Linux is that you can build so many things with these systems, the modularity that allows you to customize it to your liking, and the sheer number of tools available. Distributions like Kali Linux, CentOS, Ubuntu, or Debian are examples of how a single core can be adapted to many different environments. I don't like the religious fervor some people have for free software and the lack of certain enterprise management tools and user environments. In those areas, I still prefer Microsoft Windows or macOS.
LxA: 3- As is often the case, open source evokes both support and hatred. Some believe it is of poor quality or less secure than closed source. What would you say to those who hold this opinion?
CA: Any of these statements, in and of itself, is a mistake. The important thing isn't whether the code is open or closed, but what is done with it. There are very elaborate and well-developed open-source software projects, and others that are not. Thinking that a project, simply because it's open source, will be audited by everyone is not true. Much more than that is required. Furthermore, even with access to the source code, discovering security bugs is something that may only appear when the code is compiled for a specific architecture and executed in a specific environment. That's why fuzzing techniques are used.
On the other hand, publishing the source code and security updates in Open Source projects, opens a window of opportunity for 0days search engines when it comes to generating exploits before there is a patch that solves it in the distributable binary. We have seen it in many cases. My opinion is that, whether OpenSource or not, what matters is the quality of the software and if we have made the software in our companies for our security, in addition to auditing it well, I prefer that the source code stays at home} :).
LxA: 4-You own 0xWord . I have several of your titles on security and I recommend everyone take a look at the website. It's a somewhat atypical bookstore because you give opportunities to new writers who want to publish their book on security or other topics. Free software also offers many opportunities and I think it's vital for education. Don't you think that companies that develop proprietary software should reconsider opening their code?
CA: Many already do it, but I don't think it should be the norm. These days, huge amounts of published source code are available, which is a great help for learning. I believe a company should open-source its code in certain circumstances, but I don't think it should be the only way. A small company might open-source its code, and then a large company might take advantage of it, improving and exploiting it without the small company being able to compete. I think that for a student or a professional, writing open-source software is a great way to showcase their skills, and for companies, it can be a way to build community and better position their product, but it's not the only way.
LxA: 5-Y, following up on the previous question. Our blog focuses on free software and Linux, but lately we've been writing quite a bit about Microsoft. They've opened up some of their projects, made some surprising statements, released .NET Core and Visual Studio Code for Linux, and there are rumors of internal discussions about an open-source Windows. Would you like to see an open-source Windows?
CA: Microsoft already has a large portion of its code open source, and it's likely they'll open more in the future. Perhaps they'll release it as open source in the future, but I don't think they'll do it anytime soon—I might be wrong. As of today, the Windows operating system still has a lot of sales compared to its competitors, largely due to how they do things in the kernel and the operating system layer. It's a competitive advantage they want to leverage to compete against other systems like Android, iOS, or macOS, which have different competitive advantages.
LxA: 6- You're behind Eleven Paths, a digital security company that emerged from Informática 64 and Telefónica. The latter company, with which you have a relationship, invested in the Firefox OS operating system for mobile devices. What do you think of Firefox OS and what advantages do you see it has over iOS, Android, Tizen, etc.?
CA: I don't just have a relationship with Telefónica, I work there. The company has long been committed to user freedom of choice and net neutrality. And while some companies talk about net neutrality to create services with equal opportunities, they make their systems less interoperable every day. Moving your digital life from iOS to Android or from Android to Windows Phone is a pain. They're not interoperable at all. Telefónica's commitment is to support a broader, less closed ecosystem, which is why they invested in Firefox OS and continue to support it. The advantage is that the Mozilla Foundation is behind it, creating an ecosystem of web apps that can run on any system. That's the advantage the "madmen" at Mozilla want to promote.
LxA: 7- Let's talk about FOCA now. It's a wonderful piece of software, but from our point of view, it has a bug that hasn't been fixed. It's not available for Linux! We can run it from Wine, use other tools, or MetaShield Analyzer, but we still miss it. There are many tools for pentesting, forensics, etc., for Linux. There are also many distributions like Kali, Parrot OS, Santoku, DEFT, and many more. Linux is undoubtedly very important in this area. Why did you decide not to port FOCA?
CA: We never ported FOCA due to a lack of resources. Now we're thinking about releasing the code in .NET and letting people decide whether they want to compile it for Linux with Microsoft's new announcement or improve it day by day. You'll have to wait a little while.
LxA: 8-NeXT decided to create a Unix operating system, which would later become the foundation of Mac OS X when Apple acquired the company. Unix is undoubtedly a great system, and Microsoft flirted with it with Xenix. But ultimately, Windows NT (OS/2) appeared. Do you think that if Windows were a *nix system today, it would be better?
CA: No, not at all. Microsoft didn't "flirt" with UNIX; Microsoft built XENIX, which was sold to Santa Cruz Operations, and SCO UNIX became the most widely deployed UNIX in the world. The Windows kernel is a marvel, as demonstrated by the performance and user experience of the 6.x kernels.
Anyway, to think that the Windows kernel and the UNIX kernel differ greatly ... is a mistake. There's a great lecture by Mark Russinovich called "A Tale of Two Kernels" where he looks at what Windows NT kernels and Linux kernels have, and it's surprising how nearly accurate they are.
In fact, I love a phrase Linux Torvalds said years ago at a conference where he was asked why kernel developers were a community that changed faces so little and incorporated few new people. He said that, in addition to not being the friendliest community, the time for simple solutions to simple problems in creating monolithic kernels is years past.
LxA: 9-I always hear you say that antivirus software should be used. Not only on Windows, but also on other platforms like Mac OS X. Many say that antivirus software on Linux only slows down the computer. What advice do you give to Linux users about this, and what antivirus software do you recommend?
CA: If the issue is slowing down the system, they should remove the firewall, all the operating system protections... just run it! :)
LxA: 10 – And the last one, the most difficult of all. Was this the worst interview of your life? ;p
CA: Nooo, not at all. I've been asked so many silly questions… Once I told a radio journalist, "Please don't ask me that, it's nonsense." Sometimes I write down the questions they're going to ask me so I can explain current events properly. If I told you…
It's a pleasure to have someone like Chema Alonso for our interview series, and in this case, he brings us some good news for the future: we might have FOCA for GNU/Linux…