Did MS Lobbying Stop NSA Work On SELinux?

inquisitive points to this CNET story on how George Wash Univ. may help Linux gain certification under the Common Criteria, certification required for software to be used in some sensitive government roles. In the same story, though, is an interesting quote from another effort at bringing GPL'd software to the public sector: "'We didn't fully understand the consequences of releasing software under the GPL (General Public License),' said Dick Schafer, deputy director of the NSA. 'We received a lot of loud complaints regarding our efforts with SE Linux.'" Sources familiar with events said that aggressive Microsoft lobbying efforts have contributed to a halt on any further work. 'Microsoft was worried that the NSA's releasing open-source software would compete with American proprietary software,' said a source familiar with the complaints against the NSA who asked not to be identified."

Comments

Re:Most Secure Shops...

[SilverThorn]

Or HP-UX 10.20 or 11i trusted version. In fact, there is an article in the Information Week magazine about HP now distributing a secure Linux dist that runs on their Itantium servers for some $600.

-- M

Re:lesser known AutoCAD

[Anonymous Coward]

AutoCAD used to be available for a number of the proprietary *nixes (Solaris, SGI IRIX, HP/UX, etc) back in the Release 10, 11, 12 (and early R13) days. People I used to know that worked at AutoDesk used to make sort of veiled hints that Microsoft put some kind of pressure on them to quit supporting alternative platforms. More or less what they were saying is that AutoDesk was told if didn't quit supporting non-Microsoft platforms that Microsoft would enter the CAD market (possibly by buying up one of AutoDesk's competitors), or at least announce that they were going to, and that would kill AutoDesk by "giving away" the product. But of course nobody in those days would dare come right out and say something like that.

US Gov simply cannot release stuff under GPL.

[phkamp]

It's really very simple:

To release source code under the GPL, you have to hold the copyright to the code.

The US Government (in this case represented by NSA) cannot hold a copyright, the law does not allow for it.

No copyright, no GPL, end of story.

But I have no doubt that M$ whined too.

Re:US Gov simply cannot release stuff under GPL.

[phkamp]

Here is the actual chapter and verse:

17USC 105. Subject matter of copyright: United States Government works

Copyright protection under this title is not available for any work of the United States Government, but the United States Government is not precluded from receiving and holding copyrights transferred to it by assignment, bequest, or otherwise.

Re:US Gov simply cannot release stuff under GPL.

[dwheeler]

No. It's true that government employees, if they write code, cannot acquire a copyright. But most code is written by contractors (this is true for SELinux), and they CAN have a copyright. And, they can assign their copyrights to the government (the government CAN own copyright).

Re:Question

[jpmorgan]

Does Torvalds own the copyright to the entire kernel? I wasn't aware that he had had all the contributers in the past send him copyright assignments (which is what the FSF does). I'm fairly sure different parts of the kernel are copyrighted by lots of different people.

And due to some of the wonderful properties of the GPL, you'd need to get every person who has contributed code into the kernel to agree to the exemption. Good luck.

USA export regulations

[yerricde]

Well, the U.S. government does place restrictions on one's right to give software away (in the case of strong cryptography). Hence OpenBSD is based in Canada.

But do these U.S. export restrictions apply to free software? The current crypto export regulations (section 740.13(e)) seem to grant an export License Exception for publicly available source code and object code compiled from publicly available source code provided that the original publisher of such code notifies crypt@bis.doc.gov (cc: enc@ncsc.mil) of the code's public availability. (Notification seems not to be required for mirrors.)

Hence Mozilla is based in the United States, where the only restriction on exporting OSI Certified(tm) open source encryption software is that it not implement a system primarily designed to restrict the fair use of a copyrighted work.

We the People

[drivers]

Funny, I thought that government (established by the people) was the means by which people promoted their welfare.

We the people of the United States, in order to form a more perfect union, establish justice, insure domestic tranquility, provide for the common defense, promote the general welfare, and secure the blessings of liberty to ourselves and our posterity, do ordain and establish this Constitution for the United States of America.

It's the applications, stupid

[Animats]

Most of you miss the point about SELinux. It's not an attempt to build something NSA would consider a secure system. It's a prototype on which apps can be written which might, someday, run on a system with mandatory security policies.

Writing server-type apps to live within the constraints of a mandatory access policy is tough. (Look at how much crap runs as root because people can't make it live within the UNIX permission structure, which is far less restrictive.) But it's the only approach that works, because the applications aren't trusted.

If you want to help, make some major application, like a mail program, work under SELinux, with as little trusted code as possible. Somebody was doing this for an FTP server, but those are of limited use. A mail server on SELinux would actually be useful.

Re:Government competition

[salimma]

Large companies like Microsoft do *not*
pay much in tax.

Government projects are paid for by taxpayers, mostly individuals and small-to-medium sized companies, and it would be in their interest to have an alternative to Microsoft.

Look at it this way, with their monopoly Microsoft is about the only entity that can reliably squeeze money out of large corporations.

My 2 cents,

Re:That's scary - NOT

[EQ]

because it's illegal for the NSA to spy on Americans doesn't mean they don't...

Having worked there, I can tell you this: intercepting a US person is a SERIOUS infraction. Its not something you can do without running afoul of a lot of laws. The abuse done by the NSA during the Nixon years caused a lot of severe curbs (both open and classified) to be placed on the NSA, and those laws have serious teeth that will bite anyone violating them. As with the armed forces, there are a lot of very liberty minded folks working there to preserve your freedoms at the cost of their own. One example is that free speech is very limited once you hold certain accesses and clearances.

IMHO, you're in more danger from those folks at the FBI.

You really ought to do a seach on "USSID 18". I cant say anything confirming or denying, but there are some very interesting things that have been declassified out of Big Daddy DIRNSA's pockets.

Secondarily, its NSA/CSS. Ever hear of the CSS side of the house? I suggest you look it up before posting obvious biased off-base stuff thats based on a hokey movie [sneakers].

Re:Why Linux sucks

[dclifton]

I've run Linux since 1993 when there were no distributions. I ran it on a 386 / 16 with 8Megs of memory. I've run almost every version since and I have yet to have any lockups / crashes. Either you have no idea how to install the OS or you are forcing the software to load into improper directories so that the system crashes when it is trying to run. Currently I'm running Mandrake 8.0 on a Pentium 100MHZ PC with 60 Megs memory and it hasn;t crashed in over six months. Personnaly, if I could run it at work, I'd delete every copy of windows I have and only run Linux.

Re:Why Linux sucks

[jesco]

First, the individuals:

> Linux is slower and less stable than windows
A far too generic comment.

> The few Apache/MySQL vs IIS/MS SQL tests I have
> seen have been won (sometimes dominated by)
> Windows

You can't really compare mySQL and MS-SQL. mySQL is a lightweight database, MS-SQL tries to play in the same league as Oracle, DB2.

And while I don't have any links at hand to prove you that you're wrong about the speed-comparison, I think that Apache is fast enough for most websites. Let alone the security issues IIS has ;)

> WinXP Pro comes with a 480 meg CD, Mandrake is 3
> CD's and SuSE is 7

This is because MS only gives you the basic OS with some goodies, whereas Mandrake/RedHat/SuSE t al. offer you an OS _and_ applications. In most cases you don't need to download/buy anything else than a Linux distro. It already has everything you need.

> Installing software on a Linux system is badly
> broken.

That'S what RPMs are for. Despite Win32 installation program, RPM keeps track of dependencies. Windows can't do that out of the box.

> The exists no development environment more
> compelling than gcc and emacs, for this reason
> Linux apps will always be behind

kDevelop, Kylix, only to name the two most professional ones. For Windows there MSVC++, which is actually a neat DevIDE, but it costs quite much and has issues of its own.

That said, a more general comment by me:

Linux can be a pain in the ass. Setting up a system is, for a (technical skilled) newbie much more difficult than setting up a Win32 box. Trying to make Linux do something can be quite some (research) work, and during that time you may say 'Oh what a crap system, nothing works.', but once you figured out how to do it right, Linux will rarely fail at its new job.

WinXP, on the other hand, is the best piece of code that left MS for a few years. It's stable, clearly multimedia-orientated, has a neat UI-design and runs everything you want. But it can be as much as pain in the butt as Linux, when your apps start crashing because you uninstalled a small shareware tool which removed a crucial DLL. Let a newbie figure that out... :o

But quite frankly, I wouldn't use Linux as my desktop OS if there wasn't this DRM/security stuff.

Summarized: Both OS'es aren't bad. Each has its use. I happen to favor Linux, you favor WinXP. But try to stay constructive :)

Re:To serve and protect whom?

[cduffy]

Mostly: GPLed software is often copyright by someone. Correct? If the govt makes patches, like SE Linux, they have contributed to someone else's copyright.

Not quite right.

Linux, for instance, is not all copyright Linus. In fact, most of Linux is not copyright Linus, because whenever someone else contributes a substantial portion, they own copyright on that portion (not Linus).

That's why folks writing GPLed software can't change the license (or offer an alternately-licensed version) if they accept other people's patches, unless they either rewrite all those patches themselves or require contributors to file a copyright assignment.

So the government can contribute to a GPLed project and still maintain their own, independant copyright. (That said, it makes more sense to release their patches into the public domain -- even if the derivative work, that being the patched product, must be GPLed).