Linux for defense/security applications - Page 1
Forum section: electronics / general

author: SolarSunrise
author_rank: Regular Contributor
timestamp: April 07, 2014, 08:12:16 pm
content: I have a question that I asked for years. Like in the movies, will Linux ever be used for defense applications like DARPA for security etc? I heard China was integrating Ubuntu as their OS for military, but is Linux really that "secure" as portrayed in the movies? All I know is that WinXP is used by NSA spy programs...As hollywood had taught us, green text scrolling on black terminals is always deadly.... duh.

author: free_electron
author_rank: Super Contributor
timestamp: April 07, 2014, 08:27:31 pm
content: there is such a thing as "windows for warships". ruggedised harware, hardware system supervisor.

author: elgonzo
author_rank: Unknown
timestamp: April 07, 2014, 08:56:22 pm
content: Currently, the vast majority of ATMs worldwide run Windows XP. But there are recent reports telling that financial services companies are looking into switching to Linux in the future (read that as: no decision made yet). Background behind this seems to be that ATM manufacturers/operators currently have limited control over software product upgrade cycles - which are currently dictated by MS, and thus also have limited control over hardware upgrade cycles (which are affected by changing software requirements). The hope is expressed that by migrating away from MS Windows, ATM manufacturers will gain full control over the HW/SW upgrade cycles and thus have less headache about keeping the ATMs compliant and when to do hardware upgrades of existing ATMs in operation.

author: AG6QR
author_rank: Frequent Contributor
timestamp: April 07, 2014, 09:14:36 pm
content: Quote from: SolarSunrise on April 07, 2014, 08:12:16 pmI'll wager that the DoD has at least a few of virtually every type of computing device made. I'm sure they're running many instances of Linux.The military has varying approaches to security. Many of their devices are secured by means of armed guards, fences, faraday cages, and no connections to the outside world. With that kind of security, the operating system security features aren't necessarily very important.Linux has a history of always segregating users by privilege, and not allowing ordinary users to have access to the hardware or to system files. MS-DOS has a history of allowing any user access to everything, with no protection enforced by the operating system. Protections have been retrofitted into newer versions of Windows, but there are still older applications around which require administrative access in order to run properly, so many users make themselves administrators. That's a security disadvantage to Windows in general, but it's not an insurmountable one. That's why I'd generally agree with the statement the "Linux is more secure than Windows", in the same way I'd agree with the statement that, "men are taller than women". It's often true, but we all know of many exceptions.

author: bsahdy
author_rank: Contributor
timestamp: April 07, 2014, 09:24:39 pm
content: Quote from: elgonzo on April 07, 2014, 08:56:22 pmi heard that ATMs use linux already but not sure. i also know that several big security agencies use linux over windows and MAC

author: houdini
author_rank: Regular Contributor
timestamp: April 07, 2014, 09:37:29 pm
content: Almost every super computer runs some form of linux and they are used heavily by the military.

author: johansen
author_rank: Super Contributor
timestamp: April 07, 2014, 09:39:11 pm
content: the problem with windows and Mac is the extra keys.ubuntu and likely many other distributions have the same problem.yes, you can "jackpot" an atm to this day., but no hacker in their right mind is going to use such an exploit for only the $20,000 you might get out of one atm.then again, allegedly this hacker's performance and genius was the result of a lifetime of heroin, cocaine, Benadryl, and Xanax usage among other drugs (wildly speculated that he hasn't slept an hour since 1998), that finally killed him at the age of 36, just days before demonstrating that yes, you really could hack Dick Cheney's pacemaker from 300 yards.

author: gxti
author_rank: Frequent Contributor
timestamp: April 07, 2014, 11:05:34 pm
content: They do more than just use it, they contribute to it. The selinux (security-enhanced linux) subsystem that is part of the mainline kernel and partially enabled by default on many distributions such as Fedora and RHEL was originally contributed by the NSA in 2000. But before you flip your wig, it's certainly one of the most closely inspected features of the kernel.

author: linux-works
author_rank: Super Contributor
timestamp: April 08, 2014, 01:32:07 am
content: Quote from: free_electron on April 07, 2014, 08:27:31 pmdon't those crash in a "blue sea of death"?

author: linux-works
author_rank: Super Contributor
timestamp: April 08, 2014, 01:34:14 am
content: redhat and centos can be locked down so much that it will annoy you no-end! I end up turning most of the SELINUX stuff off since it gets in my way.but you have fine grained control over privs and security weenies like that kind of thing.linux can be quite secure. but it needs some admin skills and you have to keep your installed products to a minimum (the os is quite secure but the apps may be on the sloppy side, if anything).

author: senso
author_rank: Frequent Contributor
timestamp: April 08, 2014, 02:24:14 am
content: How many 0 days are there in linux?..You guys sure saw this:http://arstechnica.com/security/2014/03/critical-crypto-bug-leaves-linux-hundreds-of-apps-open-to-eavesdropping/Its open, any one can review it, well, its almost granted NO one will look to the full kernel source, let alone understand it all.

author: linux-works
author_rank: Super Contributor
timestamp: April 08, 2014, 02:41:41 am
content: its one reason why embedded linux is a stripped down linux. there is less to worry about if there is less stuff installedthat applies to any o/s or install, though.and if you need to do special things, the source is there so you are not held back in any way.I've used a stripped down version of 'voyage' linux for embedded work. I would not start with a redhat or ubuntu unless you need their definition of 'server' or 'workstation'.

author: sleemanj
author_rank: Super Contributor
timestamp: April 08, 2014, 03:18:57 am
content: Quote from: SolarSunrise on April 07, 2014, 08:12:16 pmSELinux was developed by the NSA.Although one could perhaps call the NSA offensive, not defensive.

author: BravoV
author_rank: Super Contributor
timestamp: April 08, 2014, 03:25:45 am
content: Quote from: sleemanj on April 08, 2014, 03:18:57 amI guess once its installed and online, in overnight NSA can even turn your supposed to be a Linux pc into Windoze based if they wanted to, remotely.

author: senso
author_rank: Frequent Contributor
timestamp: April 08, 2014, 03:33:36 am
content: And openSSL also has a small memory leak:http://it.slashdot.org/story/14/04/07/2354258/openssl-bug-allows-attackers-to-read-memory-in-64k-chunks

author: BravoV
author_rank: Super Contributor
timestamp: April 08, 2014, 03:43:07 am
content: Quote from: senso on April 08, 2014, 03:33:36 amWith the Snowden's affair, and recent RSA's scandal, CIA snooping congress PC and so on too many to list, personally I have no doubt any widely used public encryption is basically useless.

author: johansen
author_rank: Super Contributor
timestamp: April 08, 2014, 03:55:29 am
content: i recall reading a report in 2010 that said the FBI found 1 case of criminals using encryption. out of hundreds.they said it wasn't a problem to get around encryption.as far as breaking the keys go, no, that's not yet possible. unless you have a data center that sucks up an entire river for cooling.. oh, wait.

author: BravoV
author_rank: Super Contributor
timestamp: April 08, 2014, 04:06:49 am
content: Quote from: johansen on April 08, 2014, 03:55:29 amWith the annual military's budget if turned into real pile of cash that is so huge in quantity, physically it will flow like a river if you pour the money down the hill.So I don't think that real "watery" river cooling is a big deal.

author: johansen
author_rank: Super Contributor
timestamp: April 08, 2014, 04:10:56 am
content: no, but it is a big deal that the nsa and other agencies have a 50 year track record of paying companies and governments to use broken encryption from the beginning.

author: linux-works
author_rank: Super Contributor
timestamp: April 08, 2014, 04:14:35 am
content: they use quantum computers. that way, they can say they both solved it and didn't solve it, both at the same time! great for plausible denyability

author: free_electron
author_rank: Super Contributor
timestamp: April 08, 2014, 03:33:10 pm
content: Quote from: senso on April 08, 2014, 02:24:14 amThat is something i wonder about. The linux crowd lets us believe it is super secure because they have access to the full source so they can scrutinize it for security holes.If you ask them :" did you actually read it yourself and do you understand it ?", the answer is invariably : no, but others did.<Dr-evil face > riiight ...

author: G7PSK
author_rank: Super Contributor
timestamp: April 08, 2014, 04:06:07 pm
content: Quote from: bsahdy on April 07, 2014, 09:24:39 pmI have recently seen an ATM booting up. It was windows 2000 that was running, I have read that 98 is still in use on some ATM's. I don't think the banks really care who steals your money as long as the profits exceed the losses they will keep an open door to all crooks.

author: linux-works
author_rank: Super Contributor
timestamp: April 08, 2014, 06:15:05 pm
content: Quote from: free_electron on April 08, 2014, 03:33:10 pmas opposed to, say, apple's code or MS's code - who NO ONE (other than some employees) can see.the open source folks at least can review the code and fix bugs. not all bugs are security bugs, either, and many are things that apple and MS refuse to spend time on.sure, all systems will have bugs; but the open source ones will tend to have their exposed bugs fixed FASTER and that's often ignored by the anti-open crowd. there's also no corporation to 'hold back' on fixes if the OS guys find flaws.

author: free_electron
author_rank: Super Contributor
timestamp: April 08, 2014, 07:13:59 pm
content: Quote from: linux-works on April 08, 2014, 06:15:05 pmThey could review code :IF ( they would take interest in it) AND ( they can understand what it does) AND ( are capable of fixing it without introducing new vulnerabilities).The number of people in the linux usage pool that fullfill the above rule is 0.00001% give or take a few zeroes before the 1.Go out there in a random city and find 10000 people that use linux based computers. Ask em the following questions :1) - have you ever read any of the source to track a bug. if yes2) - have you ever modified a part as a bug fix. if yes3) - have you submitted it to become part of the official build. if yes4) - is your fix actually in the official build ?in a pool of 10000 people at the end of question 4 you will be at zero. you'll need a larger pool to find onei agree that for the windows or osx experiment you will always be at zero irrespective of sample size.but : 999999 or 1000000 having no clue is the same.even Torvalds admitted that linux codebase is so large he doesn't understand it anymore and now only focuses on the kernel.having the source is not a guarantee for security. thinking it is safe because 'others' have read it and understand it is not safety. you can only be certain if you personally have checked everything at paranoia setting.operating system programmers at microsoft have read windows source and understand it and fix itoperating system programmers at apple have read osx code and understand it and fix itoperating system programmers at red hat read rhel source code and understand it and fix it.even if i had the source to windows, osx and rhel there is nothing I could do. i don't understand any of that code, i am not a n operating system programmer and my c/c++ skills end at printf 'hello world \n'.If i was asked the question : pick the most secure one based on your understanding of the inner workings of thee systems my answer would be: they are all three unreliable because I <- I personally do not understand how they work nor have i read the code nor do i understand it. so i cannot attest to their security.

author: powerhouse
author_rank: Contributor
timestamp: April 08, 2014, 07:41:58 pm
content: Linux has become the defacto OS in most all of our telecommunication equipment. Since you have access to the entire source code, you can adapt it to your needs and harden it.Compared to closed source software, where you are at the whim of the vendor or at the mercy of his (in)competence, Linux so far fared quite well security wise. It's not perfect, but at least you know what you get. And it's extremely adaptable. You can start with some security-focused distro and modify/configure it to your needs.

author: linux-works
author_rank: Super Contributor
timestamp: April 08, 2014, 07:48:43 pm
content: free-electron: the point was never about end users 'fixing' their linux systems at the code level. but the point is that people CAN, if they want, read the code, extend it, change it and yes, even patch it if they so choose.you don't need every user to do code auditing; but there are certainly enough people who do this just for pleasure alone, that many bugs get uncovered and fixed by the 'community'. there is zero bugfixing for apple and MS by the community.linux is based on unix which has 30+ years of history and development. MS keeps resetting their o/s and they don't have the years of maturity in their own os to compare to unix. apple also makes so many changes, they are not quite unix anymore (its different enough that you can't just sit down and do development on the kernel or userland things unless you know the 'apple way'). but at least they are bsd based, at some level, so they didn't start from total scratch like MS did.finally, closed source can 'pull some funny business' and few will ever know it. open source can't usually get away with blatant bad designs; they will be called out for what they are and either the project will fork or some other will do what they did, but do it right. if you can't examine the code, your bad designs are 'safe' from the public's eyes. not a great way to have quality software..

author: krish2487
author_rank: Frequent Contributor
timestamp: April 08, 2014, 07:52:57 pm
content: QuoteTrue, and the same argument what you offered holds good even for MS/Apple products.If anything atleaseopen source offers the opportunityfor a lot more fresh eyes to scrutinize the code. It is a individuals choice not to do so.I d actually wager that as a percentage the number of folks who can/ are meet all the conditions you mentioned are higher in open source community than in MS/Apple.Even if MS were to release its source tomorrow, I dont think there will be a sudden increase in the number of people who qualify for the criteria you mentioned above.

author: Neverther
author_rank: Regular Contributor
timestamp: April 08, 2014, 07:58:14 pm
content: free_electron: *rises hand 4 times*It was only a music player with broken sanity check for external mediaplayer connection.Had a quick one time workaround (as I found the cause for the bug it was pretty clear), annoyed me and I wanted to know why it did what it did.One of those "seemed good at the time and worked with everything else but one not so special case" bug.The original code checked device status and the method was not tought too much. An oversight from the programmer, kinda common mistake I guess.MS releasing source to public domain would be bad for everyone.Third party consultants would be drowning in money with all the audits.

author: linux-works
author_rank: Super Contributor
timestamp: April 08, 2014, 08:07:58 pm
content: this isn't a security story, but one time I had trouble getting an old ide drive to 'talk' to the controller. turns out there is a blacklist (in all os's) that list 'quirks' that might be needed to init a drive connection. it was not hard to just follow the pattern, edit the array structure (hardcoded) and add a new entry for that make/model and set the right flags so that the drive would not 'be upset' (lol).I don't have a big kernel background, but its not hard to follow patterns and add exceptions for special hardware or change addresses or flags. its not hard to comment-out code that is acting badly. a lot of stuff is not brain surgery to just fix or work-around bugs or even to add features.if I had to wait for MS to add a blacklist entry for that drive, I'd be waiting still...

author: Lukas
author_rank: Frequent Contributor
timestamp: April 08, 2014, 09:14:34 pm
content: The US Drones are operated from Linux systems:http://www.theregister.co.uk/2012/06/08/us_navy_linux_drones/http://www.theregister.co.uk/2012/06/08/us_navy_linux_drones/Concerning the OpenSSL Heartbleed bug: Right after it's disclosurehttp://heartbleed.com/popped up. Although it's not from the OpenSSL team, it's a great help for affected sysadmins out there. I haven't seen anything similar from proprietary software vendors.

author: free_electron
author_rank: Super Contributor
timestamp: April 08, 2014, 11:42:14 pm
content: Quote from: powerhouse on April 08, 2014, 07:41:58 pmyes you have access to the source , but do you actually read it and harden it ?let me guess. you are most likely using one of the commercial industrial linux systems like montavista or wind-river. Using their codebase you select the modules you want and you create a base build. I strongly doubt you delve into the actual kernel code or module code to go off and fix anything there.So you trust an external party to create the security for you. you have not verified this personally. so the statement 'i have the source , i could if i would' is bogus. since it was not done by you you cannot be certain. and even if you did it you still wouldn't be certain as there may be a 5 year old out there doing something really really simple, that none of us can envision because we are too smart, and poof. the thing goes down.there may be 100 people looking for bugs and seriously attempting to fix thegm.meanwhile in a darkened room some devious guys are looking for holes to exploit for malevolent purposes with no intent of notifying the community of the bug.There could be even very clever people writing modules that get accepted in the main strain , but contain very cleverly crafted backdoors that are very hard to find, even by seasoned programmers skilled in the os development. accepting submissions and bolting them in the main code is dangerous as you don't know where it came from.what i'm saying is that the statement 'i have the source so it is safer' is bogus.

author: linux-works
author_rank: Super Contributor
timestamp: April 09, 2014, 12:04:32 am
content: one thing that some people are ignoring is that public code is always cleaner than private code. on average, at least.I've been part of companies that have tiny little groups writing code. if the people suck, their code sucks and since its opaque and hidden, no customer will ever know. until its too late.otoh, public code can (and usually is) reviewed at least at some level. I've seen the so-called code reviews that industry often claims and its a formalism, at best. developers have too many things to do and so its mostly a rubber stamp. otoh, people who do coding for fun and by donation WILL look at the code that is submitted and there will be public discussion about it. this inherently makes it better, again, on average.why do you think most driver code is not made public when its corp-written? because its a POS and they would be embarassed to show it to public. private code is usually the least stable and that's my experience after doing this for a living for over 30 yrs.

author: Monkeh
author_rank: Super Contributor
timestamp: April 09, 2014, 01:10:54 am
content: Quote from: free_electron on April 08, 2014, 11:42:14 pmIndeed.On the other hand, the statement "The source is available and widely reviewed by the community, and the quality and security generally benefit from this" is not.

author: jeremy
author_rank: Super Contributor
timestamp: April 09, 2014, 01:38:14 am
content: hello all,I am one of those people who can answer yes to all four questions.free_electron, I agree with your assessment that most cannot vouch for the security of open source software. However, the inverse is also true; because one cannot vouch for the security, it is also means they cannot vouch for insecurity.Ultimately, we need to rely on the opinions of experts at some level, whether they be from microsoft/cisco or from the openssl core team. After all, if my doctor tells me I need to take some medicine to get better, I'll trust his opinion. If a builder tells me that my house is safe to live in, I'll trust his opinion. Otherwise I would probably just be sick and living in a hole somewhere!I think the argument for open source is as follows: if you want to use microsoft but don't trust the microsoft engineers, bad luck. If you don't trust the openssl engineers, that's ok because you are more than welcome to learn how to read the source code so that you need only trust yourself. However, if you don't trust experts and you don't trust your own opinion, I'm not sure you should be doing what you are doingI would guess that before this was found a week ago, the heartbleed bug was not exploited by any nefarious individuals. Why? Because lots of people run honeypots for this exact purpose, with IDS up the wazoo and nobody found or mentioned anything. Besides, it is much easier to steal a key bypretending to be the CEOthan to spend years looking through the openssl code.Bringing a large amount of attention to this bug is the best thing they could do, it makes everyone scrutinise the code. Look at the "ani bug" which allowed full privilege escalation on windows; the problem was found and reported by a researcher who was disassembling windows updates (yes, he was reading the source code, albeit in assembly!). Microsoft fixed it, and then the researcher found the exact same mistake that caused the bug a few instructions further along. So despite being notified of the problem, during the fix and corresponding audit (if they did one) did not find the same mistake in potentially the exact same function on adjacent lines. Clearly there was not enough scrutiny at that in the microsoft offices.Although as an engineer I abhor the argument and absolutely disagree, I have been told that "commercial software is better, because if they screw up I can recover the losses by suing the vendor"OT: linux-works, nice flickr!

author: hans
author_rank: Super Contributor
timestamp: April 09, 2014, 12:00:05 pm
content: QuoteDo you tear down a Chinese wall plug before using it? I guess you do. Because you can't trust cheap plugs for your life (see fake iPhone chargers). With hardware looking underneath will at most void your "warranty".Do you test a car airbags before driving(or crashing) it? No, not only are airbags expensive to replace, you trust in the manufacturers have put their best efforts into making it safe & reliable.Do you check your parachute the first time you go out diving? I guess not - chances are an apprentice parachutist doesn't know how, and moreover you put trust in your instructor that he/she knows what he/she is doing. Should that refrain you from parachuting? Only if you don't trust your instructor.Your statement only would make sense if you don't have any trust in the source.QuoteYep, (almost) everyone does the same for every other product they personally use. Unless you're really paranoid and don't trust any electrical device, but then I suggest living with the Amish may be a more peaceful thing to do.As for military applications and similar, I assume they will have got a few "engineers" (software dev, security analyst, etc) around that verify the integrity of (for example) the networking code/system. That's part of the high level security regime.QuoteNot only do you have got a lot of "there may be" or "there could be", I am pretty confident these "rats" exist for every platform out there. Be it Windows, OSX, Linux, Android, Windows Mobile, iOS, etc.Have you ever read help section of the "unsigned driver" dialogue? Then never install any untrusted drivers any more. Never install any software under administrator permissions.You're describing one possible issue of an open-source development. Tell me a better alternative. What power does the commercial parties have? Microsoft or Apple can create easy backdoors everywhere they need it, and only a few hackers can discover it by breaking their license & reverse engineering the crap out of it. Is that attractive? I find that more disgusting than the first issue, but that probably has something to do with "trust" (as described earlier) too.For example: the standard firmware of a D-link router was reverse engineered a little while ago, and they found a backdoor in the form of a master password. Similar things have happened to Cisco. Great feeling of safety. I still have yet to see proof for any backdoor in something like OpenWRT.Quote from: free_electron on April 08, 2014, 11:42:14 pmThis sounds more like lets cut a few corners and whoila we have a statement that fit my needs so I can bash linux.What powerhouse said was that because Linux is open source, telecommunications software engineers can customize, strip it, and run the way they want it. At the end of the day, it's their responsibility for making their systems run safe, not Linux.For personal use your statement may make sense, but read my post above about trust and you get what I mean. Ultimately vulnerabilities are everywhere, and it's the way they are treated (or treatable) that matters most.

author: AG6QR
author_rank: Frequent Contributor
timestamp: April 09, 2014, 07:39:51 pm
content: Quote from: hans on April 09, 2014, 12:00:05 pmExamining vulnerabilities in the source code to Linux may be a substantial task, but that's nothing compared to understanding the source code to a horse.

author: linux-works
author_rank: Super Contributor
timestamp: April 10, 2014, 01:47:43 am
content: "a horse with source?of course, of course!something, something, Mr. Ed"

author: free_electron
author_rank: Super Contributor
timestamp: April 10, 2014, 02:38:16 am
content: Just look at heartbleed now.... The entire source is available. And the problem was known for 2 years apparently... Pfff.Like i said. Having the source is uselessif it doesn't get read, analysed and understood.

author: Monkeh
author_rank: Super Contributor
timestamp: April 10, 2014, 02:50:17 am
content: Quote from: free_electron on April 10, 2014, 02:38:16 amYes, things still slip by. The fact that OpenSSL is open source is what got this bug caught and quickly fixedBut that runs against your deeply held belief that open source cannot work, so you'll ignore that.

author: free_electron
author_rank: Super Contributor
timestamp: April 10, 2014, 03:03:10 am
content: Quickly ? It took 2 bloody years !Software is insecure, whether open source or closed source. Having the source is useless if it doesn't get read and understood. The only safe pc is one without wifi or ethernet , without floppies or optical media, with all its usb , serial. Firewire, printer and other ports glued shut with hotmelt glue.Cut the keyboard and mouse cable. And whatever you do : don't power it up. That way it cant get infected.

author: linux-works
author_rank: Super Contributor
timestamp: April 10, 2014, 03:03:57 am
content: Quote from: free_electron on April 10, 2014, 02:38:16 amyou cherry pick the one example that proves your case.care to pick others that don't?for this one super-bug (and yes, its a doosey) there are 1000 more that ARE fixed and sometimes before they are even exploited.not sure what your grudge is against open-source but it has none of the drawbacks of closed-source. who knows, the closed source ssl libraries may not even BE patched in the next few weeks. you'll never even be able to verify it, you'll have to trust apple and MS and whoever else grabbed upstream copies of those libs. maybe Sun gear (solaris) also has this issue and it might take Sun a while to release their patches. nothing you can do to accelerate it, either, since you can't build solaris from source unless you are a fujitsu or equiv

author: linux-works
author_rank: Super Contributor
timestamp: April 10, 2014, 03:05:50 am
content: Quote from: free_electron on April 10, 2014, 03:03:10 amuhm, how does this relate, at all, to the topic on hand???

author: Monkeh
author_rank: Super Contributor
timestamp: April 10, 2014, 03:07:33 am
content: Quote from: free_electron on April 10, 2014, 03:03:10 amThey didn't know it was there for two years!

author: jeremy
author_rank: Super Contributor
timestamp: April 10, 2014, 04:00:33 am
content: Quote from: wilfred on April 10, 2014, 03:18:27 amI think the argument being made issecurity through obscurity. From the wikipedia page: Security through obscurity has never achieved engineering acceptance as an approach to securing a system, as it contradicts the principle of simplicity. The United States National Institute of Standards and Technology (NIST) specifically recommends against security through obscurity in more than one document. Quoting from one, "System security should not depend on the secrecy of the implementation or its components.".Or alternatively: "It is analogous to a homeowner leaving the rear door open, because it cannot be seen by a would-be burglar."

author: linux-works
author_rank: Super Contributor
timestamp: April 10, 2014, 04:46:47 am
content: I had a reply all typed up and ready - and then - BAM! - my enigma machine jammed.I hate when that happens.

author: linux-works
author_rank: Super Contributor
timestamp: April 10, 2014, 05:33:48 am
content: you're not kidding its busted.mine won't work at all, now!(where did I leave that wd40 can....)