Slashdot Mirror
Did MS Lobbying Stop NSA Work On SELinux?
inquisitive points to this CNET story on how George Wash Univ. may help Linux gain certification under the Common Criteria, certification required for software to be used in some sensitive government roles. In the same story, though, is an interesting quote from another effort at bringing GPL'd software to the public sector: "'We didn't fully understand the consequences of releasing software under the GPL (General Public License),' said Dick Schafer, deputy director of the NSA. 'We received a lot of loud complaints regarding our efforts with SE Linux.'" Sources familiar with events said that aggressive Microsoft lobbying efforts have contributed to a halt on any further work. 'Microsoft was worried that the NSA's releasing open-source software would compete with American proprietary software,' said a source familiar with the complaints against the NSA who asked not to be identified."
If the NSA software would compete with MS, then the government has no business releasing it. Government isn't there to compete with private industry. It's unfair, especially considering the fact that the government can subsidize any projects with tax money that comes from it's competitors.
Mmm, but it's ok to use a Government funded (BSD) TCP/IP stack in the MS Operating Systems right?
The point is that SE-Linux is free for Microsoft or anyone else to use. It did not compete with Windows, it's a Unix.
--fatboy
Have anyone noticed this buzzword used by every Microsoft lobbying effort after 9/11 just to trying to give the probably fake impression of Microsoft being "patriotic"?
Somebody has to wake up.
Shouldn't it be the other way around?
No.
Correct. The NSA shouldn't be telling anyone what to do. Their mandate is to collect information and provide security advice to other agencies and, where authorized, the private sector. They are not a governing body. Ditto on the last sentence for the FBI, the CIA, and various other black-op agencies running around grabbing people out of their homes in the middle of the night and confiscating their material wealth without due process in the name of the ongoing War on [insert your favorite cause here].
On who pays the fiddler orders the tune..
Only partially correct. If we truly believe in democracy and "one person, one vote", then the amount of influence we wield on our government should be proportional to the number of people we represent, not the amount of taxes we pay or, more commonly, the quantity of bribes, relabelled "campaign contributions" we stuff into the pockets of our so-called representatives.
But, even if it were 100% correct that the amount of taxes we pay should dictate the amoutn of influence we wield on our government, it should be pointed out that Microsoft almost never declares a profit on their tax returns (last year it was a 19 cent/share loss IIRC, as for tax purposes they do report those stock options which, conviniently, don't appear on the SEC filings), so Microsoft actually doesn't pay any taxes at all.
Given your reasoning, I should have much more influence on the NSA than Microsoft does. Unfortunately, that is not the case and one of the main reasons, perhaps the main reason, that democracy in the United States is falling to pieces.
The Future of Human Evolution: Autonomy
Many complaints criticized the agency for providing the fruits of research to everyone, not just U.S. companies, and thus hurting American business
Gee, imagine that -- the fruits of the research that the hard working taxpayers of America paid for is also provided to those very same citizens! Outrageous! It may be true that this research also benefits any other government or company in the world which may choose to use it; but more importantly, it can benefit any US citizen who chooses to implement it.
aggressive Microsoft lobbying efforts have contributed to a halt on any further work. "Microsoft was worried that the NSA's releasing open-source software would compete with American proprietary software," said a source familiar with the complaints against the NSA who asked not to be identified.
Gee, imagine that -- the taxpayers get can get free access to the fruits of the research which their tax dollars made possible. Lets not forget, MS can also get access to this research and implement it: either the exact implementation, which would need to be separated (at a hands length) from other components of MS' OS, or the idea and make their own implementation, which they could license under any scheme they wanted.
Microsoft would not comment directly on its lobbying efforts, but did stress that it wanted to ensure the government continued to fund commercial ventures. "The federal government plays an important ro7le in funding basic software research," said a Microsoft representative. "Our interest is in helping to ensure that the government licenses its research in ways that take into account a stated goal of the U.S. government: to promote commercialization of public research."
That's interesting. According to MS, the government has an obligation to make taxpayers pay twice for the what their tax-dollars funded. Come on. Research is publicly funded because it can help all of the US, not just corporations like MS. Gee, tough concept there -- everyone pays taxes to support research, thus everyone should benefit from it, not just MS. Again, MS can make use of this research internally, thus benefit, or even put it in their OS at a hands length, or develop their own implementation of it.
In addition, the Common Criteria process, run jointly by the NSA and the National Institute of Standards and Technology under the National Information Assurance Partnership (NIAP), is better suited to certify proprietary software coming from a single company. It's ill suited to deal with the myriad updates that the open-source community produces on a regular basis.
Then the solution is rather simple. We create a central organization of Linux volunteers to handle the mriad of updates, and they analyze and review those updates (quality-control), and submit them to the NSA and the NIAP.
Back to the government development of GPL'ed software. I think that whenever possible, the government should develop using the BSD-type license (actually, I think that the public domain should be redefined to be like the BSD-license, so that credit is always given and that the "source" of the originals are always distributed under that "license"). This is because the BSD-license allows all of the US taxpayers to implement the code in exactly the way they choose, even charge for it or make non-free modifications; but it also preserves the commons aspect of what was created by a public effort. In some cases, it may be necessary to develop under the GPL because that which your basing development off of is the GPL; such was the case in SE Linux.
social sciences can never use experience to verify their statemen
Wow, that's wildly inaccurate. I mean, you're astoundingly off-base.
You've got a point, there. I just meant that the U.S. gov't is partial to the needs of business, and doesn't really care about free software.
When you think about it, the government's only real job is to defend the rights and freedoms of its citizens.
So, you're saying that governments build roads to protect the mobility rights of citizens, for example? I think governments' jobs go much broader than that.
Among those freedoms, at least here in America, is the right to start a business and engage in free enterprise.
But rights must be balenced. If I may play the devil's advocate, one of the ideological underpinnings of the Free Software movement is that one's right to make money is less important than everyone's right to improve software, and your responsibility to help others.
The same laws that protect Microsoft's ability to sell software protect your right to give it away.
Well, the U.S. government does place restrictions on one's right to give software away (in the case of strong cryptography). Hence OpenBSD is based in Canada.
#define sig "Every social system runs on the people's belief in it."
Hold up. Forget competition for a second.
/.ers don't trust the govenment to keep our privacy intact, but you want to run a government built OS?
A large number of
Not to mention the govenment doesn't exactly have the best record with any type of security. Hell, they can't even keep track of the acutal computers that contain private information.
I can't tell you how disappointed I am that I don't get my govenment OS.
Microsoft is certainly worried about one thing: the increase in noise coming out of governments (Peru, China, the EU, etc) where they are either creating or promoting GPLed software across the board. RedFlagLinux is aptly named, as it throws up a red flag regarding the future of government IT.
Governments have the resources to push public IT anywhere they choose. And where public IT goes the private sector might follow. In the US, corporate giants are welded to the suger tit of Government contracts. What if they had to start developing financial and defense applications for a GPLed Federal infrastructure? They would, you know. The NSA could have handed out their inhouse Linux brew, even if there was no Peru-style legislation to require it. And given the hysterical terror-hacker meme making the media rounds many US agencies would have snapped up a free governement certified secure OS, if only to cover themselves. It would have been all done under the table, and nobody the wiser unless they noticed a downturn in governement IT RFPs for general purpose operating systems.
But given that this is the NSA, come on folks, what do you really think? They just shut down and went home? What do you think they do with all that "black budget" funding they get to fight terrorism? The next time you run into SELinux it might reading your email.
No, that's not at all what they were doing. If you extend the concept of "rights and freedoms" to things like having a more secure OS, you can extend to anything, like "enjoying a good movie".
Please, show me where in the Consitution or any amendments where we have the "right" you are talking about.
Ultimately, this comes down to unfair competition. People will say that it's good that Microsoft will have to compete with the NSA. How could that possibly be fair? How is a private corporation that has to make money to continue its existence going to compete with a government organization that has little to no accountability?
Forget the whales - save the babies.
Apparently, all of a sudden the NSA's partner, Secure Computing Corporation, came out and made a special exception from their Manditory Access Control Patents for SELinux. It may have been a desperate act to keep the NSA on board. It seems this company was deriving exclusive software patents from work partial completed/funded by the NSA. If I were a generally unaware politican told of this situation by a Microsoft birdie, I would see it a fraud/waste as well.
Although I cannot know for sure, from the basic facts availible to me, this seems to be a case of SCC's software patent greed biting them on their own ass. MSFT probably spun it as, "the govenment partially paid for labor leading to a patent for a competitor of ours, and it's not public domain.
Disclaimer: I hate software patents, as much as I would hate math patents if they existed. This may bias me against SCC.
Novel theory: Modern Man evolved from psychopath
Though I think that there's no basis for MS' complaints, all credability to them would be lost if MS released their additional improvements or modifications into the public domain or under the BSD license.
But the question is, can the government do that? According to the GPL, no. But, the owner of a copyright can grant exceptions to the license. Thus, Torvalds could grant an exception to the NSA regarding SE Linux, which would be as such: the original source code of the kernel/Linux upon which you based your modifications must still be released under the GPL; however, the modifications or additions you made may be released into the public domain or under the BSD license.
Furthermore, such would give the GPL license legal credability, as the government would be asking for an exception (though the NSA already gave the GPL license legal credability by releasing their modifications under the GPL).
That said, perhaps there should be some modifications of the GPL to allow people to release modifications under alternate licenses (which would include the public domain and OSI-certified or OSS licenses), if they can't possibly (due to legal restrictions) release it under the GPL. After all, its better that the modifications be released under a BSD-like license or the public domain (as opposed to the GPL), than not be released at all (which would ocur if the authors of the modifications were prevented from releasing modifications under the GPL).
social sciences can never use experience to verify their statemen
>Linux is slower and less stable than windows
...If you're running a 486.
./configure . It ckecks for everything you need on your system and errors if you dont have it.
Which versions? Are you using standard (good) hardware or POS rummage stuffs?
>My windows box uses about 40 megs of ram to boot, Linux uses about 175 (and
Linux is a monolithic kernel)
I'm using 172 MB of memory (with all the nicieties ON). And about that "Monolithic kernel crap"..
modprobe idiot_slashdot_poster IQ=1
>Linux crashes much more often than windows, way more
How so? Windows freezes much more on me. Even hangs during INSTALL. I've never seen Linux hang like that.
>The few Apache/MySQL vs IIS/MS SQL tests I have seen have been won (sometimes dominated by) Windows
I dont care about those tests... However, I do remember some test that had really crappy hardware for Linux and a quad proc with Win. Wonder what won that...
X is a one size fits all poor implementation at a responsive display server (both Apple and MS are moving to hardware accelerated GUI)
>KDE is maybe the only thing on earth more intigrated than windows explorer, everything under the sun imbeded into konqueror, it makes it clunky as hell, Nautalus is nearly as bad
Damn straight. It crashes a lot over stupid stuff, and it does hog memory. Still, after it crashes It works OK.
>Ease of use for the newbie is not as important as ergonomics for powerusers, but Linux has yet to bring an environment to the table that I can efficiently get work done it.
If you like Windows interface, go use FVWM95. I'll stick to using KDE and Wmaker.
>WinXP Pro comes with a 480 meg CD, Mandrake is 3 CD's and SuSE is 7
That's all apps you can use. Only thing I need to download is a DVD/AVI app. Windows comes with garbage (MSNMessenger vs. Gaim , IE vs. Moz, Paint vs. Gimp, nothing vs GCC suite).
>NTFS is much more stable than any Linux file system, hard shut down in Linux and watch it fsck your box
Permissions on WinNT are much nicer to deal with. Still, XFS and Reiser are really good for Linux. Only a second or 2 to "check disk".
>Installing software on a Linux system is badly broken, often you end up fixing make files, chasing dependencies, or in situations where you can't update a library with out breaking other apps, many libraries are not very backwards compatable and someone still has yet to write an installer for Linux. Nullsofts SperPiMP installer for windows is only 498K but such a simple installer has yet to exist for Linux because it's design is funamentally flawed.
Even windows 3.11 had an installer and you can install the 32 bit libraries for it and still run binaries that were compiled on XP, lets see Linux do that
Creators dont care to package a nice installer like the one Loki used in UT install. Still, if you compile static LIBS inside your binaries, thye'll run on nearly any Linux X86 platform (if that's the arch you compiled them for). RPM's are OK, but you have different companies repackaging them and breaking them. Still, the best is AUTOCONF
>Developers will often use GPL just so they can avoid having to create and test seperate packages for the last 3 versionsof every major distro, GPL lets someone else do it.
Yep. Essentially they are lazy in a certain regard. If you'd undertsand, they make the app for themselves alone. If somebody else wants it, try it out. If it doesnt work (and you want it), you fix it and submit patches. That's part of the cost of using Linux stuff. It doesnt cost money... Just time.
>The exists no development environment more compelling than gcc and emacs, for this reason Linux apps will always be behind
QTdesigner, INTEL's cc, KDevelop... I'd say they're "nice". Still, that's a simple bitch comment.
>Would like feedback on this
>Thanks
Agent: National Security Agency.
Martin: Oh, you're the guys I hear breathing on the other end of my phone.
Agent: No, that's the FBI. We're not chartered for domestic surveillance.
Martin: Oh, I see. You just overthrow governments; set up friendly dictators.
Agent: No, that's the CIA. We protect our government's communications. We try to break the other fella's codes. We're the good guys, Marty.
Martin: Gee, I can't tell you what a relief that is, Dick... You know, I could have joined the NSA, but they found out my parents were married.
Bear in mind that just because it's illegal for the NSA to spy on Americans doesn't mean they don't. Also, any technology released to commercial entities or the public in America is going to find its way to the rest of the world. Therefore, it is in the interest of the NSA to prevent Microsoft/Linux users/common people from securing their computers (the only computers the NSA is charged with protecting are the government's). However, it would be in the interest of the NSA to lead those groups to believe their computers are "so secure not even the NSA could get into them" when in fact they have easily-exploitable holes.
Ask yourself this question: why would the NSA release open source security software to the world?
I sort of work on SE Linux. Our group is unsponsored by the NSA (thus far). Since we are unofficially working on it, though, we hear birds chatter sometimes. The rumor mill around our office has been saying that it is not the case that Microsoft has done anything. What happened? A party, whose name shan't be mentioned, because we have not been told their name (we shall call them the Party), was given an SE Linux contract by the NSA. The NSA it seems didn't understand the GPL so well (or some lawyer of theirs who hammered out the contract didn't). The NSA contract said that the Party working on the contract could have propietary code, and could patent ideas used to achieve goals on the project. Much work was done on SE Linux in the mean time by the Party, but patents/etc are held on certain parts of the code by the Party, and therefore cannot be released under GPL. The quotes you see in this article heading make perfect sense to me in this context. The NSA didn't understand the GPL. And yeah, I would complain too if I couldn't have the complete source to my kernel...
Yes I hate Microsoft, but this article is kind of ridiculous...it uses some vague quote to make microsoft look bad. This is not the way to win the war.
The Right Reverend K. Reid Wightman,
The NSA goofed from the very beginning by trying to implement SELinux themselves.
Lets take a look at the main complaint about the NSA working on SE Linux.
"NSA's releasing open-source software would compete with American proprietary software"
So put the work in the hands of the American companies! A very simple solution would be to contract the work out to a private company like all other government work that needs to get done. The goverment doesn't design aircraft, they pay boeing and lockheed martin to do it. So why should they program a secure OS? They shouldn't! Pay someone else to. Define a set of requirements (If linux is one of them is irrelevant) and put the contract out for bid. This way, any company, including M$, has a chance to make money of the contract. So how government funds being put in private industry is hurting "American proprietary software" is beyond me.
I think the line about anyone having access is telling, but not in the way many people seem to be taking it. The NSA isn't concerned with US citizens having access to SELinux, although I'm sure that some people within the NSA are. They are concerned that security technology developed by the NSA will be made available to other countries. The NSA is fighting the tide of knowledge. The Soviet Union used to do this, to an even more dramatic extent than our government does. Anything mailed or published outside the USSR was subject to censorship. Soviet scientists used to get around this in interesting ways. For example, a physics paper was published that started "Imagine the interior of a star .... ". The censor immediately decided that there was nothing of interest militarily and passed the paper through for publishing in Western Europe. The star described could not possibly exist, it was actually describing a third stage thermo-nuclear explosion and gave Western physicists insight into the sophistication of Soviet nuclear weapons technology.
Information and knowledge cannot be prevented from spreading, as the Catholic Church in the middle ages learned, as the Soviet Union learned, and as the NSA keeps trying to forget.
In my universe I'm perfectly normal, it's not my fault you don't live in my universe.
So let me get this right: the National Security Agency develops a port of Linux to augment, unsurprisingly, national security. Microsoft bitches that national security runs counter to their profit interests and manages to get SE Linux terminated.
Fine.
But let's be sure to mention this next time Osama bin Ballmer starts foaming at the mouth about how Linux is un-American, and remind him that Linux developers have never undermined the safety of American citizens in order to line their pockets.
And while we're at it, let's consider what gigantic software monopoly distributes a flight simulator capable of accurately emulating passenger airliners, along with detailed scenery of American airports and major urban centers, complete with individual office towers.
Of course, having already crippled Naval warships, I shouldn't be surprised that Microsoft is now trying to cripple our chief intelligence agency.
Proud member of the Weirdo-American community.
Somebody should call the NSA's Public Affairs Office and ask for Dick Shafer, because I've never heard of the guy, and I wonder if he was made up. And if not, PAO should have cleared him to make that statement - which definitely doesn't sound like bureaucrat-ease.
I don't understand your question. It doesn't seem to relate to my post at all.
I like the "share and share alike" aspects of the GPL too, and I wish I could figure out a way to defend the govt producing GPL code.
But I can't. Just like I'd be pissed if (and I bet they do this anyway) the govt hacked proprietary software and allowed the proprietary vendor to sell the code.
The government should never produce intellectual property. Since the public owns the government, the public should own the government's source. This means Microsoft should own it and this means you should own it.
There are no trails. There are no trees out here.
I can't agree with your experiences on stability. In fact, I trust my Linux boxes more than anything with Winx on it. In my experience, the only reason our Winx boxes don't crash once or more per month is that we've adopted a strategy of rebooting them once per week so they don't "eat themselves". (A hard learned lesson. Maybe exagerated _a little_.)
That only addresses the server side of things though.
I agree on software installation - there are a lot of problems, mostly stemming from the lack of a strong, unified configuration. That is, everybody seems to have their own version of how a Linux (or unix in general) box should go together - and so the configuration options are too broad for a strong standard to emerge. MHO. Even Red Hat's RPM fails to solve the problem a lot of the time (my experience)...
I recently launched a RH7.3 server for MySQL & Resin (JSP Application Developmet). Everything from the CD went well - and then I needed to add Java. Got the RPM from Sun, and wouldn't you know it - the install went great.
(The other shoe drops here)
...but the program (java) wouldn't run - let alone the fact that I have to manually hack all of the environment varialbes. I thought that maybe this was ahead of the curve (using 1.4 instead of 1.3 on the CDs). I Turned back to the 1.3 version on the CD's - that failed too in precisely the same way.
As it turns out Java needed another package installed before it would work - a dependency - precisely what RPM is supposed to solve. After 3 days w/ tech support (sometimes it just doesn't go well) I got the answer on the package that needed to be there - I found it on the CD, installed it manually, and that problem was solved.
This is an example of something that should have been very simple, but became extraordinarly complex - from cryptic error messages and difficult technical support calls to locating installation packages to manual environment configuration etc... A less technical user would have been in real trouble.
An executive comparing that to the one-button install on a Winx machine doesn't take long to decide it's a better business decision to "stick with what works".
On the point of a user environment/desktop. There again, I have to agree. Every couple of months I pull out the latest RH version, wipe a machine, and try to build a user workstation that I could throw at my user base for business, software development, or even webware work... Every time so far it's a disaster - there are too many tools missing and the tools that do exist have steep learning curves.
On the point of learning curves, there's another core problem here I think - a cultural one. The *nix crowd in general seems to have a built in right of passage. You either know all of the right buzzwords, techniques, tools, and utilities, or it's your own fault that you haven't figured it out yet. (RTFM!)
It's difficult to describe - but I'll bet anyone who's tried to use *nix has had the experience:
You find yourself staring at a problem that should be simple to solve, but everything about it is inpenetrable - you don't even know what questions to ask... - or when abruptly reminded RTFM - which FM to F' READ...
...then, if you're lucky, you will stumble across some *nix guru who will press a few obscure keys and solve the problem instantly (thus is the power of *nix) - Even if they were nice about it and tried to teach you, and even if you took copious notes - this little tid-bit is probably not much more help than wrote instructions - and if you loose them, or forget them some day, you're just as lost as if you'd never had the help.
Even the simple things are maddening. Take the vi / emacs debate - then, prompty forget about it because it completely misses the point. For the typical computer user, in a world where every editor you can find works just about like Notepad (even edit on a DOS prompt works this way for the most part) - vi and emacs are useless and inaccessible.
The newbie can't begin to gain access to a *nix system. What we (people who want Linux to succeed) have to do is realize that in it's most profound terms.
In most of the companies in the world using computers, the guy that has to make it all work isn't a well trained technician or engineer, or even a hobbiest. He's the poor schmuck who figured out how to modify autoexec.bat with his trusty text editor - the token computer geek in the office - and through his continuing experiences he may eventually become a well trained technician... but today he can get by with a few simple tweaks and keep the wheels moving. This is just not so in the Linux world right now.
Show of hands: How many of you know why the following expression is a bad idea:
[ /] rm -rf *
The short of it is that I think *nix in general, and by extension Linux, is structured so that the learning curve is far too high for casual entry.
Once you get past the learning curve enough to be somewhat effective, you no longer have the time or energy it would take to bring the next fellow along - and so they will struggle as you have, or they won't "join the club".
I think it likley that until the Linux community solves this entry problem the barriers to solving usability, installation, and integration problems will remain unsolved.
What's needed is a workable environment that doesn't require a deep knowlegde, but does not preclude the benefits of that deep knowledge. A way for the novice to get their work done on their way to becoming a whiz...
Typically those in the open source development community that have the skills to solve these problems are busy with other things - and in any case there's little strong direction as to what the details of such an environment should be...
The challenge is going to be defining that goal and motivating the developer community to achieve it.
The first part is hard because the very people who can help to define that goal are kept out of the community by the entry barriers - and therefore don't get into the conversation.
The second part is hard because it is the nature of the development community (generally) to solve local problems and then share those solutions - rather than coming together to collectively solve a central problem they don't personally have. (Is that where RTFM comes from?!)
Think of it this way... If I have to make my mail server or database work properly, and I can fix the open source code to solve that problem - then I can do that and keep my job - it's all part of the work I've got to do. When I'm done, that work is now available for everyone. By extension, the most common problems will be solved and overall the open source software will be extremely reliable for the majority of people most of the time.
Try to apply that to this problem: Basic users need a unified desktop and operating system with integrated applciations and a shallow learning curve. Now tell your boss that you're working on a suite of productivity apps and a one CD linux distribution that will slickly install and interoperate with the majority of the business world running Windows. I'll bet he will ask: "How's that going to get our database up?"
The boss in this case might be the developer themselves. Best intentions, altruism, and grand visions not withstanding, it is not the open source developer's job to make everyone's desktop work and their installs go without a hitch - This is an advantage that the Microsoft developer has - it is their job and they get paid to do it. Similarly for the ISV/ISD - the potential for conflicts of interest are reduced significantly.
The short way of saying this might be that the open source community, left to it's own devices, probably can't solve this problem.
What's needed is an economically viable project that can focus the community on a unified vision, and specifically one that is strong enough, and compelling enough that the majority of the community will wish to participate.
To work, this project would have to encoumpass a wide range - not only the operating system and it's environment, but also the applications that make that environment powerful - IDEs for all programming languages, Word processing and document publishing, Spreadsheet, Database, Presentation, Mulitimedia, Web & Email access, all of those applications will have to work together in a seamless way - and had better coexist nicely with Microsoft's products which, like it or not, set the standard due to market share.
To date, I've seen some methodologies get close to supporting this kind of effort (a few good tries) - but nothing seems to have captured the critical mass necessary to generate this kind of focus.
It's a thorny problem.
I think we'ev seen some glimpses of what it _might_ be in the likes of MySQL, RedHat, Sun(java)... where there is a blend of open source and commercial licensing - sort of the best of both worlds. None of these seem to be perfected yet.
Anybody have a solution?
Did anyone bother to check the info? This quote may be old, misquoted (or misinterpreted), or dead wrong.
:-)
Dick Schafer is not the deputy director of the NSA. Per one of their press releases over two years ago, Bill Black is the Deputy Director:
http://www.nsa.gov/releases/newddir_071000.html
Also, SELinux was updated on July 3rd. Sounds like a bit of work for a dead project
http://www.nsa.gov/selinux/news.html
I am Me. No one else is Me, but Me. You are You. Get over it.
We've /.ed "www.nsa.gov".
At first I was surprised, but a Netcraft look-up explained it all.
"The site www.nsa.gov is running Microsoft-IIS/5.0 on Windows 2000."
That does NOT comfort me at all.
Having previously worked for the computer engineering folks in a branch of the armed forces, I can assure you that any computer on either the NIPRNET (unclass) or SIPRNET (classified) undergoes an NSA security lockdown. True, they are more protective of the class machines, but both still are locked down. Also, the NSA lockdown is a set of procedures involving a ton of reg changes and is quite thorough. In fact, when we were migrating to 2000, I worked with a Microsoft engineer walking through the NSA lockdown and documenting the install procedure for unclass machines.