MITRE Corp. Report On Open Source In Government

Jeremy Allison (of the Samba team) writes "Very interesting paper just published by MITRE corporation. (In PDF - they've learned not to use Microsoft Word. :-). Highlights: 'The main conclusion of the article was that FOSS software plays a more critical role in the DoD than has generally been recognised.'; 'Create a "Generally Recognised as Safe" FOSS list ... including Linux, OpenBSD, NetBSD, FreeBSD, Samba, Apache, Perl, GCC, GNAT, XFree86, OpenSSH, bind, and sendmail.' 'FOSS' stands for 'Free and Open-Source Software.' Looks like these people 'get it.'"

Comments

Generally Recognised as Safe.

[Sivar]

"Generally Recognised as Safe ... bind, and sendmail."

I'm all for Unix server software, but BIND and Sendmail? True, they haven't been bad lately, but both of these are former poster childs for the land of remote root exploits. Yet Qmail, djbdns, and Postfix--some of the most secure software ever made, is strangely absent.
Well, it is the government. They are making progress in their own little way. :)

Re:Generally Recognised as Safe.

[Sivar]

Correction: Upon further inspection, Qmail is graciously listed, though the others seem to still be absent (unless I can't search properly).

"Qmail is a FOSS replacement for Sendmail, the
program that transfers emails between computers
on the Internet. Qmail has improved security,
reliability, and performance features."

Yep, that pretty much sums it up. I'm impressed. :)

Re:Generally Recognised as Safe.

[GreatDave]

I'll wager that the feds' decision not to mark, say, other MTAs is safe may be due to lack of adoption in the public and age of the code. Let's face it, Sendmail touches just about every email sent, anytime and anywhere. It's old code that has its nuances known. Sure, it's not a daemon but a demon, but by the DoD's logic, it can be trusted while something like qmail cannot.

>They are making progress in their own little way. :)

Military intelligence... if we ever understood it, we'd be arrested and our brains classified. :P

Re:Generally Recognised as Safe.

[Richard Weber]

Only problem is, Qmail isn't "FOSS". It doesn't fit in with either of the Free Software or Open Source definitions. You're allowed to look at the source code of Qmail but not touch. Distributing modified versions isn't allowed. I'm going to contact them and point this out -- they're free to use Qmail, but they shouldn't use it thinking it's open source.

Re:Generally Recognised as Safe.

[Twirlip of the Mists]

I think you need to adjust your idea of "secure" a little bit. Sendmail is ancient-- in Internet terms-- and it is widely known. Everybody knows where Sendmail's bones are buried. Qmail, on the other hand, is newer and less widely used. The fact that Qmail has had fewer known security flaws can be interpreted as a sign that there are more left to be discovered.

Secure doesn't mean invulnerable. It means trusted. You can trust something with known flaws if you know where those flaws, how to avoid them when necessary, and how to fix them when possible.

Re:Generally Recognised as Safe.

[kpansky]

I think you may have jumped the gun here. Qmail is "free" as in beer. It does clearly meet the requirements as set out in the document to be Free and/or Open Source Software. They are not mutually exclusive, or inclusive.

Re:Generally Recognised as Safe.

[novakreo]

True, but then again Qmail has offered a USD $500 security guarantee since 1997, which so far remains unclaimed. Sendmail does not, and since then they've had a number of security issues to deal with.

As for its usage, Qmail at one stage included Hotmail among its users, so it has had a reasonable amount of testing and use.

Re:Generally Recognised as Safe.

[Twirlip of the Mists]

Your comment reminds me of the old joke about the optimist and the pessimist who visited California. They heard that there hadn't been a major earthquake in California in however-many years. The optimist thought to himself, "We're safe!" The pessimist though, "We're due!"

Security-minded folks are more likely to be pessimists than optimists.

Re:Generally Recognised as Safe.

[lewp]

Age of code doesn't always directly relate to security of code. Yes, Sendmail is older. While that means the code has been around to be looked at by more people, it also means it was written before security was even close to the priority it is today.

Qmail, on the other hand (and Postfix, and others. Sorry if I don't mention everyone's favorite :P), was created from the start to be as secure as possible. It has the advantage of being able to build on many years of advancement in secure coding practices. For example, the way as little of its code is executed as root as possible gives it a big advantage. Sendmail 8.12 is moving in the same direction, but it's much newer than Qmail and, while I haven't gazed at the Sendmail source recently I'd be willing to wager that getting it to play with privilege separation wasn't a trivial change.

I'm not knocking Sendmail. I use it on a whole bunch of production boxes. It's familiar, easy to use, and works out of the box with everything. It's also fast enough to make it suitable for most environments and I have a whole lot of time invested in learning the various ways to configure and tweak it and how to fix it when it's being moody.

That said, I also use Qmail on a regular basis. Of the two I keep a much closer eye on the Sendmail installations. Sendmail's current biggest known flaw is its history, and until a something approximating that shows up in Qmail I'm more inclined to trust djb's baby (even though I put it in /usr/local/qmail. nyeh!).

(Qmail also has the luxury of being the product of someone who comes off as a complete asshole. I can guarantee you that the fact that Qmail doesn't have any known security holes is not for a lack of trying. There are plenty of people who would *love* to find a hole in Qmail just to shut him up . I hope djb doesn't have mod points!)

Re:Generally Recognised as Safe.

[Elbereth]

No, it's "free" as in "free".

Re:Generally Recognised as Safe.

[geirt]

Sivar wrote:
"Generally Recognised as Safe ... bind, and sendmail."
I'm all for Unix server software, but BIND and Sendmail?

Don't mix old Bind and Bind 9, Bind 9 is an entirely new code base written from scratch with security as a basic premise. Version 9 is not susceptible to the same issues found in earlier versions of the Bind DNS server.

The track record for Bind 9 is *much* better than it used to be ....

Re:Generally Recognised as Safe.

[Black Copter Control]

Part of the reason why the $500 security guarantee hasn't been claimed is that -- as far as I can tell -- very few people use it unpatched. If someone were to find a bug, they would have to revert to an unpatched version and then recreate the error there. Not many people have the time and energy to do this -- and it doesn't do them much good if the problem is in the patch.

As far as I can tell, DJB refuses to incorporate any of the many patches into his software, so the security of his unpatched sources is of limited value. This also makes using qmail a royal pain in the ass. It can sometimes take hours to figure out which patches you want and then find and download them. As much as I like some of the ideas behind the design and implementation of the software, the license discourages me from using it (even though I generally get paid by the hour when I install it!)

Re:Generally Recognised as Safe.

[Tony-A]

Distributing modified versions isn't allowed.
I'm free to use qmail.
I'm free to modify qmail for whatever purposes for myself.
I'm not free to hold Dan Bernstein responsible for my butcheries, whether or not I (or anyone else) is aware of them.

If you want to distribute modified versions of qmail (including ports, no matter how minor the changes are) you'll have to get my approval. This does not mean approval of your distribution method, your intentions, your e-mail address, your haircut, or any other irrelevant information. It means a detailed review of the exact package that you want to distribute.

Close is not very good for security stuff. Can't say I blame him at all.

Re:Generally Recognised as Safe.

[Fweeky]

Yet Qmail, djbdns, and Postfix--some of the most secure software ever made, is strangely absent.

Did you ommit exim because you:

• Don't know it?
  
• Forgot about it?
  
• Don't like it?
  
• Think it's insecure?
  
• Think CoyboyNeal wouldn't approve?
  

Re:Generally Recognised as Safe.

[Glenn R-P]

Only problem is, Qmail isn't "FOSS". It doesn't fit in with either of the Free Software or Open Source definitions. You're allowed to look at the source code of Qmail but not touch. Distributing modified versions isn't allowed.

FOSS is Free (as in beer) and Open (you can look at it) but not necessarily Free (as in speech). You are thinking of FLOSS (Free Libre Open Source Software).

Glenn

Re:Generally Recognised as Safe.

[scrytch]

Bounties and cracking contests are complete snake oil, and have nothing to do with the security of software. That I may offer a $1000 bet on guesses on how much change is in my pocket says nothing about how much change is in my pocket (perhaps more than a thousand bucks though? yah right). It might motivate a few hackers to try for the prize. A bigger prize might motivate a lot more. But the prize itself is a handwave.

Dan writes secure code, and is a great fellow for giving it away, even if personality-wise he makes Theo look cuddly by comparison. It's also nice that he puts his money where his mouth is. But the prize is still meaningless. Hard facts like the demonstrable security of the libc replacement his stuff ships with are where I put my stock.

Re:Generally Recognised as Safe.

[Conare]

Bounties and cracking contests are complete snake oil

I thought that was called "putting your money where your mouth is". I am not denying that there is a strong publicity aspect to them, but contests do give a security company some credibility. Do you think that the type of folks who appear in Bruce Schneier's doghouse would run a contest? Of course not. Contest runners are saying, 'give us your best shot, so that we can all learn from it.' It doesn't hurt that they get publicity, but to me that simply makes it a win-win situation for all the participants.

Re:Generally Recognised as Safe.

[Sivar]

Don't forget to mention OpenSSH and OpenSSL!
Or doesn't that fit in your list-of-things-for-which-djb-has-made-a-replacemen t-so-you-can-piss-on-it-each-time-they-get-mention ed?

Perhaps if you'd look at the recent security record of these, you'd find that they weren't DoD-grade material quite yet.
And yes, Dan Bernstein probably could write a more secure implementation given is track record.

Rock on.

[LoudMusic]

Nice to see some of our tax dollars not going to waste on over-priced under-powered software.

I suppose this means there will be more job openings for geeks in government possisions. Get out your resumes guys and gals ...

Re:Rock on.

[Sivar]

You may not want to work for the government in anything technical. Sure, you may get to play with some neat toys, but after seeing so many Sun Enterprise systems used as office mail servers -- sitting alongside NT database servers equipped with 64MB RAM, one tends to go insane. :)

Re:Rock on.

[Anonymous Cowrad]

The US government provides thousands of IT jobs already. I wouldn't be surprised if they were the largest IT employer in the world. There's always been plenty of government work for an ambitious and well trained geek.

Re:Rock on.

[budalite]

Yeah, well, we can be either a part of the answer, part of the problem or work both sides of the fence, like I do. :) I have worked in both the fed. govt and private industry. There isn't really much difference in how things get done. The main difference is that where business people reward each other with fat contracts, in the fed. world, one must change the *policies* to reward your buddies. That is exactly what happens after every election. A new policy can reap billions in rewards. If you didn't know that, now you know why the position of president, though it "only" earns $200k/yr (+ room, board, and security detail), causes millions and millions to be spent to get someone the job.
Interestingly, I feel more like a "stakeholder" as a govt. employee than I did as an industry stock-holding employee. It's my tax money, too, I guess.

Re:Rock on.

[SN74S181]

There's always been plenty of government work for an ambitious and well trained geek.


I think you meant to type 'an ambitious and thoroughly wallpapered credential-whore.'

About time.

[carlmenezes]

About time somebody did something like this. I mean, to the average Joe, the advantages of FOSS are obvious. But the DoD need documents, papers...anything written. It's similar to businesses WANTING to pay for software and therefore keeping away from FOSS.

I guess everyone was waiting for somebody to basically do a "study" or write a paper that could be quoted or "fallen back upon" if you will.

Then again, this report is about the fact that FOSS already plays a more critical role. My point is, it's high time somebody came out and recognised the fact. Great job on the paper.

Re:About time.

[tunah]

to the average Joe, the advantages of FOSS are obvious.

No, maybe to the average slashdot.org/~joe the advantages are obvious, but the average Joe doesn't know FOSS exists. Heck, 5 minutes ago, I didn't know FOSS existed ;-)

Re:About time.

[Shalome]

quoth the poster:
I mean, to the average Joe, the advantages of FOSS are obvious.
Don't you mean "to the average Slashdot poster"? When I think of the average Joe, I think of my father, who believes that my computer must be turned on for him to send me e-mail from his computer. That, and that Prodigy is the greatest thing on the planet...

Yeah, I know, I'm nitpicking...

Re:About time.

[stefanlasiewski]

No, maybe to the average slashdot.org/~joe the advantages are obvious

Hmmm... if Joe knows that FOSS exists, he sure ain't admitting to it!

http://slashdot.org/~joe

joe has posted 0 comments. ... And userid 369. All that time and no comments... :)

Re:About time.

[Black Copter Control]

The DoD is interested in things working correctly all the time,

If that was the case, they wouldn't be using Microsoft products :-)

Re:About time.

[Daniel Dvorkin]

Exactly. The DoD is interested in sweetheart deals with major defense contractors (and yes, Microsoft now falls into that category) which are generally brokered by retired high-ranking officers who start taking gigantic salaries from said contractors the moment the ink is dry on their discharge papers. Since most of the contractors (Microsoft excluded) actually build pretty good products, "things working correctly all the time" is a happy side-effect, but there's no evidence that it's a primary goal.

As a vet, believe me, I'm not happy about this. I've seen the effects first-hand. I was a medic for eight years in the Air Force. About halfway through my second enlistment, we switched from company A's IV needles, which were very high-quality and never crimped up -- i.e., the plastic cannula over the needle, which is the part that actually stays in the patient when the needle is pulled out, always went in smoothly with the needle instead of crimping up around the needle and not going in -- to company B's IV needles, which crimped up about a third of the time -- which of course meant that the patient had an extra hole in his skin and the needle was now useless. We did this, as it turned out, because the recently retired General X, who had been quite high up in the AF medical bureaucracy, was now a member of Company B's board of directors. When I got out of the service a couple of years later, we were told that the AF was "studying the problem." Meanwhile our supply guys were cutting "gray" deals with local medical supply companies to get us needles that worked.

This may seem like a minor problem, but consider that a) the switch caused a lot of pain and suffering (even good IV sticks are painful; bad ones are worse) and wasted a lot of money, and b) this sort of thing happens all the time, all over the place, in places ranging from the base personnel office to the ER to the flightline where people are loading nuclear weapons onto bombers. And not just in the AF; there are similar stories from almost every job in every branch of the service. Your tax dollars at work, folks.

PDF format freer than Word?

[coupland]

A very minor and unimportant comment:

Most companies when publishing in PDF format do so, not for openness but to preotect against copying or modification.

For example, my company works extensively with the FDA and we publish all our standard operating procedures (SOPs) in PDF format since it's so difficult to copy. We rely not on the openess of the format but on its limitations. Not earth-shattering but I wanted to mention that PDF is not a particularly open format, despite its structures being well known.

Re:PDF format freer than Word?

[pauldy]

That is kind of funny because the line feeds are ^M just like what the acrobat distiller does. I would say PDF is freer than word however, because you don't have to pay money to view the document and since the purpose of this document is to be read then this particular format is best suited to enable that viewing across platforms without additional costs for the reader while maintaining the original format of the document.

I would also say anyone using PDF's for the security of them not being easily modifiable is running on assumptions that the people they are sending the files to are to stupid to figure out how to modify them to their hearts content.

Re:PDF format freer than Word?

[JordoCrouse]

Most companies when publishing in PDF format do so, not for openness but to preotect against copying or modification.

Ironically, you think that PDF protects against copying, because it is difficult to modify them in Windows. By the same token, you may think that .DOC files are less secure, due to the fact that they are easy to read and modify in Windows.

Which of course, is the opposite for any *NIX system running Ghostscript (where a PDF -> ASCII conversion is trival, but .DOCs require much more work).

I guess you do have to play to your users strengths and weaknesses, it just seems funny to me, somehow.

Re:PDF format freer than Word?

[tunah]

I would say PDF is freer than word however, because you don't have to pay money to view the document

Only half true. Microsoft offers a little known Word 2000 viewer (and similar viewers for Excel etc) that is available gratis.

Re:PDF format freer than Word?

[captaineo]

If you are worried about tampering, just use a secure hash. e.g. create a web site or phone number people can call to verify md5sums of important documents.

If you really want to prevent copying (as in copyright infringement), then you'll have to wait for Palladium. ("Ctrl-C" - "I'm sorry Dave, I can't let you do that...")

Re:PDF format freer than Word?

[Ami Ganguli]

It's only available for Windows (although it might work in Wine I suppose), so you still have to pay Microsoft for the operating system.

Re:PDF format freer than Word?

[Shelled]

Open the pdf in XPDF, left click to highlite text, centre click to drop into text editor. It's that easy on my system. Ironically, the MITRE report is a pdf of a Word doc.

Re:PDF format freer than Word?

[u19925]

There are three main advantages of PDF over Word:

1) The format is compressed, so it is smaller in size.

2) The PDF viewer is available on more platforms than Word viewer

3) The PDF is already formatted for printing.

Re:PDF format freer than Word?

[booms]

Most companies when publishing in PDF format do so, not for openness but to preotect against copying or modification.

Or it could simply be because its much easier to predict how the document will print / read on various platforms. At this point, PDF files are pretty much a web standard for white papers, reports, etc. I guess if it were me I would skip the paranoia factor and the black helicopter sightings and take the report at face value. :)

- Brandon

Re:PDF format freer than Word?

[lemkebeth]

PDF isn't open?

Thats news to me.

PDF is an open specification, anyone can write their own PDF creation tool as well as reader.

The security thing is a bad idea though, as is the attachments in PDF files that Adobe just added support for in their apps. Ah, the coming the the PDF virus era....

Re:PDF format freer than Word?

[zenyu]

Only half true. Microsoft offers [microsoft.com] a little known Word 2000 viewer (and similar viewers for Excel etc) that is available gratis [microsoft.com]. It's only free as in beer. I can use xpdf and the like to view pdf's... Also I've had the experience of the Word Viewer crashing on complex word documents. Only ones from Microsofties so far, but even so it's sad when I have to turn to openoffice to view a word file (even if it takes minutes to render a page), and then convert it to postscript to be able to view it in something solid like ghostview.

Re:PDF format freer than Word?

[kir]

Actually, all the M$ viewers work in CrossOver, but you have to pay for that too... BUT IT'S CHEAP!

Re:PDF format freer than Word?

[henben]

we publish all our standard operating procedures (SOPs) in PDF format since it's so difficult to copy.

I just found a way to penetrate your security! The exploit is:

1. Ctrl-C
2. Ctrl-V

Do you think I should post this to SecurityFocus or something?

Honestly, I know what you're trying to say, but I don't understand why companies do this. Anyone who was motivated to fake a report from your company could still do so. All publishing in PDF format does is annoy people and waste bandwidth. Actually, you'd be better off publishing documents as HTML on a webserver you control, because people can see the address it's at and be (reasonably) sure that it's official. If you release them as PDF files, surely people will be more likely to save them, print them out and forward them around, creating a situation where a fake is less likely to be spotted straight away?

If you're worried about employees tampering with internal documents - that's what file permissions are for.

I once worked for a shit company who generated a lot of their transaction reports as PDFs for "security" so they couldn't be modified. It also made it impossible to do diffs, search groups of reports, etc. I was ordered to compare files by flicking between them and looking for differences. Tards.

Re:PDF format freer than Word?

[kir]

True... But, it does work surprisingly well.

Re:PDF format freer than Word?

[Xtifr]

Microsoft offers a little known Word 2000 viewer [...] gratis

But that supposedly gratis viewer requires a non-gratis OS to run, so many of us would still have to pay money to view the document.

(But then you did say, "half true", and anyway, my objection is only half true because it probably runs under Wine. Though I'm not sure that helps people running Solaris/AIX/LinuxPPC/LinuxARM/LinuxPS2/etc.)

Anyway, the bottom line is that PDF is freer than Word because PDF is an open standard, and multiple implementations exist (some gratis, some FOSS) while Word is a closed, proprietary format subject to change without notice.

Re:PDF format freer than Word?

[runderwo]

PDF is an image description format, nothing more.

Um, wrong. PDF is a subset of Postscript, and it can contain text (rendered in the native system's fonts) as well as image data. It can also contain "marked-up" portions of the image, that are rendered as images, but have text associated with them (so you can copy and paste outside the PDF by selecting a part of the image as you would a block of text).

Re:PDF format freer than Word?

[DickBreath]

Microsoft offers [microsoft.com] a little known Word 2000 viewer...

Funny they don't offer it for either of the platforms I run.

Re:PDF format freer than Word?

[spitzak]

Actually the results of PDF->ASCII are about as accurate as the results of the many .DOC->ASCII converters available. Both lose much of the formatting information and can scramble the order of the text.

It is probably possible to "edit" the PDF so it actually looks the same but has some of the words changed, but if the new wording is a different length it is going to require some work and probably hand-editing. I would think that a Linux user would have better luck modifying a .DOC in OpenOffice or something. Of course any real evil document-modifier is going to have access to a Windows machine with Word, and if Linux was useful for some documents they would have a Linux machine too.

Re:PDF format freer than Word?

[babbage]

You really think that being able to cleanly translate from PDF to ASCII is going to be a step towards being able to modify a document? Surely I must be misunderstanding you, because obviously that isn't going to help at all after it throws away all the formatting, layout, images, etc.

This really isn't a platform issue -- download a copy of Cygwin & it can easily be used to install Ghostscript, rendering the two platforms isomorphic for these purposes. (And playing more into that point, Antiword makes it easy to convert DOCs to ASCII on *nix, so the conversion you want can go either way on either OS.) It's not that the tools aren't commonly used on the dominant platform, it's that the tools you're suggesting won't allow invisible tampering on *any* platform.

The point the original poster was getting at is that the PDF format is difficult to modify; it's much more tamper-proof than Word, and this implicit copy protection makes it a more desirable distribution format. The fact that this doesn't require people to shell out money for a copy of Word probably doesn't enter in the equation in the first place -- DOC can be modified, so DOC isn't suitable for distributing documents that aren't meant to be modified.

You can use Ghostscript to go from PDF to ASCII, or you can use Antiword to go from DOC to ASCII, but how are you going to get that ASCII document back into a form that is nearly identical to the original? I'd argue that you can't, because both conversations throw too much information away, and so both are going about the problem the wrong way.

Re:PDF format freer than Word?

[HiThere]

Both libre (i.e., free as in degrees of freedom) and gratis are legitimate interpretations of free. Unfortunately, neither of those terms are exactly english words. But freedom is not usually thought of as being without a price, to liberty is probably the more basic meaning of free in english, and if one wished to designate one of the meanings as secondary, then it would have to be "gratis", as that is less tied into the body of the rest of the language. (Well, perhaps in "free-for-all"... but even there...).

Re:PDF format freer than Word?

[rjkimble]

Well, CrossOver doesn't run on all Linux boxes -- my Alphas, for example. However, it does work well, and so do the viewers, on my Intel machines.

Re:PDF format freer than Word?

[pauldy]

I would say it is widely known that the wordviewer exists. You may be unaware that many people are using alternate operating systems who have no access to the Word Viewer I.E. Macintosh, Linux, Solaris, HPUX, SGI, OS/2, and Digital Unix not to mention have you ever tried to read documents in pocket word for the pocket pc or palm, not pretty.

And before you tell me that wv is there for Linux or you can convert on the Macintosh. Isn't the point of the document to be portable across these systems without hassle of figuring out how to translate it so it can be viewed on your device? Thus acrobat is born and is it freer for the end user you betcha because one can ensure that the reading experience across platforms is as close to the original as possible without having to publish a different document for every platform that they would like to deliver their content to.

So while you are correct the word viewer is available to those who have already paid their Microsoft Tax the argument that it's half true that you don't have to pay money to view a Microsoft Word document is not. The exception might be using wine to launch the word viewer which only solves the problem on one platform and I won't even go into the problems with getting it setup so it actually works right without installing MS windows so the appropriate DLLs could be loaded so the word viewer will even work.

"Generally Recognised as Safe" Reference

[gmanske]

If like me, you were wondering what the "Generally Recognised as Safe" reference was referring to, here's an excerpt of the executive summary of the report.

This list would provide quick official recognition of FOSS (Free and Open-Source Software) applications that are:

(a) commercially supported
(b) widely used and
(c) have proven track records of security and reliability (eg. as measured by speed of closures of CERT reports in comparision to closed-source alternatives)

Gmanske.

This is a pleasant surprise...

[GreatDave]

While the Navy has its much-farted-upon attempt to build Win2k-powered "Smart Ships", the NSA has been developing SELinux (Security Enhanced Linux), their homebrew kernel.

It seems that the right hand doesn't see what the left hand is doing. That's the USA federal government for you. However, based on the existance of the "safe" FOSS list, perhaps the DoD is rethinking their investments in eN Tee. I sure hope so, for the sake of national security. Meh.

Re:This is a pleasant surprise...

[mcubed]

It seems that the right hand doesn't see what the left hand is doing. That's the USA federal government for you.

With all due respect to your example, I would rather each department of the government be allowed to implement its own solutions, at least based on my experiences working for large corporations (where the right hand often doesn't know what the right middle finger is doing). The most productive situations arise when divisions and departments are allowed to solve their own problems, rather than having some senior-level executive decided, "okay, this worked for marketing, so now everyone has to do it this way." Information sharing is important, of course, but forcing one-size-fits-all "solutions" can be counter-productive.

Michael

Re:This is a pleasant surprise...

[scrytch]

The Navy's "smart ship" was running NT4, and it was their application that crashed when it threw an unhandled exception, while the rest of the system hummed along merrily.

The NSA is no longer developing SELinux. MS made 'em stop.

You seem to have your evils switched.

Re:This is a pleasant surprise...

[jafac]

Or as we saw at Enron, Congress, the White House, and the CEO didn't know what the "invisible hand" was doing. (giving investors the finger)

Infers that GPL means better security

[AIXadmin]

In this paragraph MITRE seems to infer that GPL'ed software is some how more secure, or better able to be secured then other software.

"For Security, use of GPL within
groups with well-defined security boundaries should be encouraged to promote faster,
more locally autonomous responses to cyber threats. "
Page 3, Example 2.

This really makes no sense to me. Especially when the majority of the software they list as "heavily used infrastrucuture tools such as "Linux, OpenBSD, NetBSD, FreeBSD, Samba, Apache, Perl, GCC, GNAT, XFree86, OpenSSH, bind, and sendmail," are a good portion of NOT licensed under the GPL. (Yes I realize some, are but the majority of that list are not.)

Doesn't make a lot of sense. Considering most people would agree the most secure OS out there is OpenBSD.

Re:Infers that GPL means better security

[FreeUser]

"For Security, use of GPL within groups with well-defined security boundaries should be encouraged to promote faster, more locally autonomous responses to cyber threats."

Perhaps one aspect of the security to which they refer is the secure knowledge that inhouse software developed under the GPL will remain free, i.e. they will in turn receive any and all improvements made by others. ;-) Somehow I doubt that is what they meant, though.

While the GPL is arguably more appropriate for public funded software development than licenses that lend themselves to proprietarization, I must agree wholeheartedly with you that it is clear that the advantage in security goes to free software over proprietary software, and not GPLed software over other free software to any degree. Indeed, as you point out, OpenBSD is the most secure operating system around, and it is certainly not GPLed.

What they clearly meant to say was the free software should be encouraged to promote faster, more locally autonomous responses to cyber threats ... they are mistakenly equating GPLed software with free software (when in fact it is only a subset).

Re:Infers that GPL means better security

[leviramsey]

While the GPL is arguably more appropriate for public funded software development than licenses that lend themselves to proprietarization

I would say that the license that gives the most freedom is the license that publically funded development should have. Guess what: that license is not the GPL (though you could easily create your own GPL'd fork of a BSDL'd project... it's identical as far as the BSD license is concerned to proprietary licensing)

Re:Infers that GPL means better security

[Ektanoor]

They refer to an ideal situation. The use of GPL soft would free completely their hands on changing every piece of soft that might be compromised. And they would not have to deal with licensing hurdles. But there are two caveats here.

First, a GPL-exclusivety would be appropriate only in top-security situations that demand a fast and very flexible response. Not having barriers on how to deal with the soft, be it binary or sourcecode is extremely important here. However, I would not be so fanatical on saying that only GPL soft is appropriate. Frankly, I think it would be better to say: licenses to do not impose barriers of any kind to software changes and distribution.

Second, to do such thing, people should be uberprofessional. Having GPL code is not enough to provide security. There should be someone who's able to manage the guns. However, if a certain department or site is considered to be top-security, then one should have someone of that weight out there... Isn't it? But... well... we know that even security guards love to sleep when they shouldn't. And that engineers are underpaid and don't have enough qualification. And that the managers will still buy some piece of crap instead of listening the experts... So this caveat is utterly pointless...

OpenBSD is one of the most secure. Because it is made for security. Most Linux machines are not because it would be a problem trying to adapt users to the level of security in OpenBSD. I made a few installs of OpenBSD and I may tell you that it is not easy to install something on it. Besides it is much harder to use. And, sometimes it is quite slower than other BSD and Linux conceptions. But it is very good on kicking every kiddie out.However, its administration demands every kind of tasks as nay other system. A badly administered OpenBSD is also breakable.

On what concerns Linux itself, unfortunately there are very few secure distros. But it is possible to reach a level of security near to OpenBSD or even better. By hand and making the system from scratch. Once we had such a machine. We named it "The Castle", out of the name of a distro that gave us the idea to make it. It was a damn well secured system. But using it... Better walking through the Labyrinth...

Re:Infers that GPL means better security

[theLOUDroom]

So how exactly do your statements show that OpenBSD wouldn't be more secure if it was GPL'ed?
The point is: "what license promotes security the best" What OS is currently most secure, may or may not be under that license.
BTW, I would probably agree with you about OpenBSD's security.

Re:Infers that GPL means better security

[lewp]

Meh? A Linux system you create yourself isn't going to be any more secure than a properly-configured RedHat box in the hands of someone who knows what they're doing. It's not like you're not going to be running the same software for the most part.

I, like most people, wish that the more mainstream distros didn't ship with everything but the kitchen sink on by default, but come on. If you've got the know-how to put together a Linux box from scratch there's no reason you can't properly lock down one you get from a mainstream distributor in much less time.

I realize it's good security practice to start from zero and enable only what you need rather than have everything on and disable what you don't, but UNIX isn't Windows. Unless a distro is shipped with a rootkit in it already it's quite easy to turn everything off. Once you've done that you can pretend you started from scratch if that makes you feel better.

Building "Linux From Scratch" is fun (for some people, myself included) and a great way to learn about how your system works. But if you do it on a regular basis for systems you deploy you're just wasting a lot of time and being masochistic.

On another note, I've never found it that much harder to admin or use an OpenBSD box than I have say, FreeBSD or even your average Linux box. I find that the difference in philosophy is the biggest hurdle (vi this file vs. use our badly-designed ncurses/GTK+ config tool). Once you get over that any of the above can be quite usable.

Re:Infers that GPL means better security

[The Fun Guy]

Actually, I think they are *implying* that, not *inferring* that.

Regards,

The Grammar Police

p.s. Please don't mod me down for this... someone has to take a stand for approriate usage of language. Besides, I have a wife and kids at home who rely on my maintaining a good Karma.

Exerpt

[willpost]

Banning Free and Open Source Software would remove certain types of infrastructure components (e.g., OpenBSD) that currently help support network security. It would also limit DoD access to -- and overall expertise in -- the use of powerful FOSS analysis and detection applications that hostile groups could use to help stage cyberattacks. Finally, it would remove the demonstrated ability of FOSS applications to be updated rapidly in response to new types of cyberattack. Taken together, these factors imply that banning FOSS would have immediate, broad, and strongly negative impacts on the ability of many sensitive and security focused DoD groups to defend against cyberattacks.

Starting on page 32, theres a very nice glossary of common Free and Open Source Acronyms.

Wait...another term?

[Rhinobird]

Isn't anybody gonna mention that RMS is going to say that FOSS should really be reffered to as Dental/FOSS?

PDF?

[intermodal]

whatever happened to good old ASCII or ISO text files? nothing says cross-platform than an ISO format

I work for the DoD.. open source rules!

[Shalome]

I work for the DoD (and am lucky enough to work with MITRE folk as well), and we go for the open source solution whenever we can. Why? We're in security. We absolutely NEED to be able to hack our own code whenever necessary. We can't afford to be taken down by any sort of attack, whether it be a worm, virus, or directed attack -- and I'm not talking "afford" in the sense of a dollar amount. We also like to be able to do things like add signatures to our IDSs whenever we feel like it. We often notice and track new virus and worm activity before it "breaks." We can't wait for vendor updates.

I've sat through meetings with vendor reps where certain office members tore the reps some new orifices. I've heard from a *major AV/Firewall company name deleted* rep "Oh, you use open source FREEWARE! Well, if you want to go with something totally insecure that has absolutely no support and you don't know exactly what the code actually does..." The rep then sat there in stunned silence as the department head launched into a detailed tirade about how every member of the office not only knew what the open source we used did, most of us could re-write it if we needed to. The rep actually blushed and admitted that if we could do that, we didn't need their product.

Most of our offices do use Microsoft on most of the standard user desktops... but it's open source hacked-to-hell code that runs everything else around here! Well, aside from the gallons and gallons of coffee and Mountain Dew that runs the people..

Re:I work for the DoD.. open source rules!

[sheriff_p]

You need to remember that reps aren't *real* people in most cases, and especially in a field like anti-virus, reps are often keen to over-sell products.

Of course, it's worth remembering (going a little off-thread here), that unpatched open-source software isn't any more secure than unpatched Windows software - IIS can be patched and secured too. A good tutorial on hardening IIS can be found here:
http://www.virusbtn.com/magazine/archives/200208/i mpossible.xml

Re:I work for the DoD.. open source rules!

[Sivar]

A DoD guy talking about his knowledgeable co-workers advocating OSS, being powered by coffee and Dew, and whose signature links to a web page whose largest graphic is a Southpark character...

Is this some other Department of Defense that I was not previously aware of?

Re:I work for the DoD.. open source rules!

[kir]

I'm a DoD contractor too and it's not like that where I work. Here it's windoze, windoze, windoze... except for my BSD FW, Linux/BSD web servers, and a few misc workstations. All of these are kept pretty hush-hush (except the FW), otherwise they'd probably make me reinstall them with win2k... yuck!

Can I please come work with you? PLEASE!!!!! I'll send you my resume... a couple hundred dollars? Just put in a good word for me ;-) !

Re:I work for the DoD.. open source rules!

[DickBreath]

I'm confused. If open source is so good, then why does it have to be "hacked-to-hell" ?

It's not the only quality, but one of the fine qualities that makes open source so good is that it can be hacked to hell. The original statement should not be read to mean that it is necessary to hack it for proper operation. Many open source users never touch their source code.

Of course, I'm sure the DoD uses a mixture. For some of their needs I'm sure that they pay inflated prices for inflexible closed source as well.

Re:I work for the DoD.. open source rules!

[Fjord]

It is true that unpatch OSS isn't any more secure than unpatched Windows software, but I don't think you can say the same for the opposite end. Fully patched OSS software has the potential to be more secure than fully patched closed source software as
a) patches tend to be released faster and backported farther for OSS than for closed source software.
b) you can patch the software or backport a patch yourself if you need it closed immediately. For those that say this cannot be done, I will say that the grandparent posters stated that they could rewrite the systems they have if necessary, and I personally have gone through two open source application upon finding a bug (not a security issue, however), although I found writing a patch wasn't necessary in either case (I just needed to change some configuration).

Re:I work for the DoD.. open source rules!

[Sivar]

I work for the DoD, too, so I think I have a fairly reliable perspective.

Re:I work for the DoD.. open source rules!

[jafac]

I have to agree - I have worked with some Mitre people in a capacity I won't go into here, and out of all my past customers, they're the most clueful bunch I've ever worked with.

Re:I work for the DoD.. open source rules!

[HiThere]

Re:
- IIS can be patched and secured too. A good tutorial on hardening IIS can be found here:

How do you know it does what it says it does? Sorry. It can't be patched to be any more secure than MS is willing for it to be. And you always need to guess on what that means. Even were you to sign up for one of their "You can look at the source" licenses, since you can't really compile and link it, you can't know that what they gave you is the real code.

Now it's true, I don't make a practice of looking through the code that a distribution distributes. But there are those who do! Any Linux distribution that puts out code with trapdoors is taking an unreasonable risk. They're making a bet the company bet that nobody's going to notice. MS could do it all the time, and nobody could tell, except via inadvertence (like that strange NSA-KEY entry point that someone found awhile back).

So I don't think that you can reasonably claim that it's equivalently secure. Not unless you don't count MS and those who make deals with it and those who crack into it as potential threats.

No surprise

[e5z8652]

I've always wondered about the supposed lack of "FOSS" at DoD. Aside from SE Linux, there are other quite public acknowledgements of support for open source software. From the back of the OpenBSD 3.1 CD case:

"This effort sponsored in part by the Defense Advanced Research Projects Agency (DARPA) and Air Force Research Laboratory, Air Force Material Command, USAF, under agreement number F30602-01-2-0537"

Kind of a big hint that someone somewhere in DoD thinks highly of OpenBSD.

Of course, this support may have since been reduced or eliminated due to the same pressure that the NSA faced with SE Linux.

How much respect does MITRE command?

[burgburgburg]

How well is the MITRE Corporation regarded in general? How well are the thought of by the government in particular? How influential will their word on things be?

By the way, the document summary shows that it was originally a Microsoft Word Doc titled "Microsoft Word - 3DBD823B-1ABD-0AA6.doc" with the author being www.

Interesting that the DOD uses GnuPG, Linux, Linux (Red Hat), FreeBSD, NetBSD, OpenBSD, OpenOffice, Perl, Perl CGI Scripts, PerLDAP, PHP, Tcl/Tk and TCP Wrappers, amongst others.

Re:How much respect does MITRE command?

[Shalome]

quoth the poster: How well is the MITRE Corporation regarded in general? How well are the thought of by the government in particular? How influential will their word on things be? You're kidding, right?

On the front page of MITRE's website: MITRE is a not-for-profit national resource that provides systems engineering, research and development, and information technology support to the government. It operates federally funded research and development centers for the DOD, the FAA, and the IRS, with principal locations in Bedford, Massachusetts, and Northern Virginia.

Trust me, they're extremely highly regarded and their analysis carries quite a bit of weight.

Re:How much respect does MITRE command?

[Jeremiah Cornelius]

Not only this, Mitre are the origin of the Capabilities Maturity Model - in conjunction with CMU.

Process and methodology kings, par excellence.

Do you want to know how to do something right? Do you want to know how to repeat the performance? Mitre are your experts in the field.

If your organization has a job-title of "Program Manager", there is at least a passing nod to the CMM processes outlined by Mitre, which breaks down all process and initiative into functional program areas.

Re:How much respect does MITRE command?

[Ektanoor]

MITRE is a DoD child, created in the heat of the Cold War. It was and probably still is one of the best brainstorm centers in the world. And DoD loves it a lot. Besides, MITRE is one of the historic hallmarks on computer development. It was one of the organisations that tightly worked with ARPA in the 60's. So, in some way they can be the aunties of Internet. Many other things we use today were also developed by MITRE. So DoD will probably listen to its giant child.

Re:How much respect does MITRE command?

[grendelkhan]

You've never dealt with MITRE have you? MITRE, in my experience, are delay and overbilling kings, par excellence. They charge for this solutions library that you can never access and create some of the most god awful solutions mankind has ever witness, and then bury the evidence. Do a search on "Intelligence Training System" or "Sentinal II" on their website and see if you can find the US$50Million of taxpayer money,

Re:How much respect does MITRE command?

[dwheeler]

MITRE is well-respected. Technically, it is a Federally Funded Research and Development Center (FFRDC). FFRDCs are non-profit organizations chartered to give unbiased technical advice to the U.S. government.

Re:PDF?

[Arandir]

Please don't make me laugh! I just got my stitches out and it hurts!

What the DoD is and isn't

[kryonD]

Just to add some info here. Just because an article talks about usage and approval of FOSS in the "DoD" (Department of Defense), it doesn't mean that there is signifigant usage. Remember that the DoD is comprised of some management overhead and three sub departments: Army, Navy, Air Force. While Linux may be used and even endorsed by the "DoD", it's usage is not permitted without one hell of a waiver process in the Department of the Navy. Especially under NMCI(Navy Marine Corps Intranet), Linux is not even listed as an approved legacy system, much less something EDS will agree to support.

Additonally, each branch of the service is autonomous in IT management, which means there are FOUR DIFFERENT ways of running a network with the associated FOUR sets of management overhead and of course, they aren't interoperable. This is a fairly generalized statement, but most of the systems I deal with daily in the Marine Corps are specific to us and don't work with the other services systems despite the fact that they all do the EXACT SAME THING.

So kids, the moral of the story is: Write you congressman and complain about the misuse of your tax dollars. And don't forget to tell them that free software == excuse for lower taxes == more votes for them.

Re:What the DoD is and isn't

[Anonymous Coward]

Linux is in widespread use in the Navy research lab that I work for. And our NMCI installation apparently does include Linux in some way as I have seen reports of "compatibility testing" that mentioned NT/2k/XP/Linux/Solaris and a couple others.

Not to imply that NMCI isn't ridiculous and a huge waste of money. We're trying to fight it...

And don't forget that most computers aren't desktops. We certainly don't have any MS OS on our many embedded computers.

Re:What the DoD is and isn't

[Black Copter Control]

Especially under NMCI(Navy Marine Corps Intranet), Linux is not even listed as an approved legacy system, much less something EDS will agree to support.

I guess this means that if I want to mount a pirate attack on the DOD, I should make the Marines my beachhead?

Sir! The enemy is sighted, and they are using ISS!
Arrgh! Prepare to board them, and take no prisoners!

Re:What the DoD is and isn't

[rogueroo]

What you say is true, but this report was sponsored and generated by DISA, the joint-services IT provider to DoD. So while what you say has merit, it has little to do with this particular report. I am a DISA contractor, and we provide services to _all_ branches of the military. DISA is kinda like an outsourcer for the branches. Stuff that does not _need_ to be done "in-house" gets farmed out to DISA. DISA also manages all of the consolidated datacenters.

Report is written in Word

[ronys]

Open with Acrobat Reader, File->Document Properties->Summary... reveals:

Title: Microsoft Word - 3DB823B-1ABD-0AA6.doc

Furthermore, the PDF file was created by http://createpdf.adobe.com - which allows one to upload files and have the processed into PDF - 15 for free, more for $$$.

Seems like they didn't find out that ghostview allows you to generate pdf files as well as view them...

Report says GPL was the original

[AIXadmin]

Last I checked the BSD's were first:
"The General Public License (GPL)4 is the original FOSS license, and GPL software is simply FOSS software that is covered by the GPL."
Page 12

This report is really full of holes. In the chart it says that BSD and Artistic licensed software cannot be combined with closed source software.

A funny bit

[Vireo]

In page 22:

[i]Ironically, a thoroughly rigorous and systematic ban on DoD use of FOSS could also affect a number of proprietary product that rely on FOSS products that permit incorporation of FOSS into their closed-source products. For example, Microsoft Office uses the FOSS zlib collection of data compression software, and thus could technically be banned as a product that incorporates FOSS software.[/i]

MITRE...sounds familiar

[0x0d0a]

Weren't they the defense contractor with the absolutely awful security in Cliff Stoll's _The Cuckoo's Egg_?

Report makes no difference between OS and FS

[AIXadmin]

The report also no makes no differentation between Open Source Software like FreeBSD, OpenBSD, and Apache; and Free Software which generally always refers to software under the GPL or LGPL. Like Linux, gcc, or GNATS.

"The word free in FOSS refers not to fiscal cost, but to the autonomy rights that FOSS grants its users. (A better word for zero-cost software, which lacks such rights, is freeware.) The phrase open source1 emphasizes the right of users to study, change, and improve the source codethat is, the detailed designof FOSS applications. Software that qualifies as free almost always also qualifies as open source, and vice versa, since both phrases derive from the same set of software user rights2 formulated in the late 1980s by Richard Stallman of the Free Software Foundation."

The writer of this report does not make differentation between Open Source and Free Software. He call's things under a BSD license with no cost, and no restriction on rights, freeware. (Freeware does not mean OSS. Freeware is closed source software, that is given away at no cost.) While in the next setence pushing the view that all OSS is GPL'ed.

This report is a grave disapointment.

Re:Report makes no difference between OS and FS

[Ektanoor]

You didn't get the point. The problem this report tries to cover is not about costs but about the ability to control the software you use. And that's the what DoD is concerned about. And the report notes that DoD is damn dependent on FOSS:

The main conclusion of the analysis was that FOSS software plays a more critical role in the DoD than has generally been recognized. FOSS applications are most important in four broad areas: Infrastructure Support, Software Development, Security, and Research. One unexpected result was the degree to which Security depends on FOSS. Banning FOSS would remove certain types of infrastructure components (e.g., OpenBSD) that currently help support network security. It would also limit DoD access to and overall expertise in the use of powerful FOSS analysis and detection applications that hostile groups could use to help stage cyberattacks. Finally, it would remove the demonstrated ability of FOSS applications to be updated rapidly in response to new types of cyberattack. Taken together, these factors imply that banning FOSS would have immediate, broad, and strongly negative impacts on the ability of many sensitive and security- focused DoD groups to defend against cyberattacks.

I don't see where your disappointment comes up. The report shows that both OSS and FreeSoftware are the major players in DoD sectors (well I would be very admired if they wouldn't). Besides, it shows that all this FUD from M$ is a national danger to the US (and I would be HIGHLY admired if it wouldn't). Apart of some gaffes the report is superb.

Time to put Redmond on the rough nations list...

Re:Report makes no difference between OS and FS

[Anonymous Coward]

you are -1 silly, not +1 insightful....

The report also no makes no differentation between Open Source Software like FreeBSD, OpenBSD, and Apache; and Free Software which generally always refers to software under the GPL or LGPL. Like Linux, gcc, or GNATS.

you're repeating a distinction which is usually made only for the purposes of criticizing the GPL. All the software you mentioned is Free Software. It all grants you the certain vital rights, such as the right to copy and the right to inspect and change. to repeat.. there is no distinction to be made. some of them are GPL-incompatible, and many are not copyleft ("viral") but this is not important for this paper.

also, from a user's point of view, this is mostly irrelevant. the "license wars" are between developers. to users, they grant the same freedoms.

finally, from the distant and unpleasant vantage point of most proprietary software, the gpl/non-gpl are pretty much identical. really, for most people, being able to copy the software at will is mind-boggling. "how do they make money", etc.

He call's things under a BSD license with no cost, and no restriction on rights, freeware.

No, he points out the distinction that "zero-cost software" which DOESN'T grant you the FOSS rights is NOT FOSS! This is an important and subtle distinction, because it's not just about price, but freedom to do certain things. I'm impressed by their understanding. I think you misread it.

While in the next setence pushing the view that all OSS is GPL'ed.

no, it just says that they are very similar, and they both came from Stallman's ideas. which is still correct. open source is weaker form of free software, but usually they grant you the same basic rights.

For the purposes of this document, it is completely correct and appropriate to mix OSS and FS together, and to concentrate on freedom rather than price.

i think the document is peachy keen, and it gives me a fat chubby.

Re:Report makes no difference between OS and FS

[T.E.D.]

The report also no makes no differentation between Open Source Software like FreeBSD, OpenBSD, and Apache; and Free Software which generally always refers to software under the GPL or LGPL. Like Linux, gcc, or GNATS.

A minor point here. When they mentioned "GNAT", they did not mean "GNATS". They were referring to the Gnu Ada compiler (Gnat), not to the unfortunately named Gnu bug tracking system (GNATS).

Gnat is one of many commonly used Ada compilers. It is unique in that it, along with its entire supporting tool suite, is Free Software.

Re:PDF?

[Sivar]

If you actually tried to open up any but the most basic Word document in Wordpad, it butchers the document. Try it.
However, that's beside the point. You see, not everyone runs Windows, and not everyone wants to open a document that can come with little extras like macro virii.

Further, .PDF documents are extremely common. Get used to it. If you really can't stand to have to download extra software to view such a common format, you'll be happy to know that most Linux distributions come with at least one .PDF viewer.

Not that the parent wasn't a troll or anything...

Re:PDF?

[Darth_Burrito]

I hate it when I have to buy a $400 program to view .doc file..:-)

Don't then. Download Open Office, buy Sun's Version, or use something like wordpad.

Re:PDF?

[Darth_Burrito]

Don't then. Just use Open Office.

Re:PDF?

[Sivar]

whatever happened to good old ASCII or ISO text files?
The PDF document contains images, tables, colors, and underlined/italicized/bold text. Those are rather difficult to express in plain ASCII text.
Doing so is not unlike trying to write a voxel-based graphics engine in HTML.

Right tool for the job...

Re:PDF?

[King of the World]

PDF tends to be smaller unless you have bitmap graphics. That's the rule I've always had. Anyone want to improve on that?

COE (now NCES) will support Linux

[Anonymous Coward]

I work in the trenches so-to-speak.

The good news is that the DoD is paying attention to Linux in a big way. Undoubtedly, Solaris, HP, and SGI were among a few of the favorite big ticket items that the DoD likes to purchase. However, there is a small number of people who are using linux. We're expecting that number to grow.

Mitre gets it -- they're pretty smart folks. But does the rank-and-file military? By and large -- no -- although there's more currently than say 18 months ago. Some are still caught of in the security problems linux has. Others are just ignorant by calling it "freeware" -- when linux really rises to a level above the typical "freeware" moniker.

The military is really a bargain buyer -- yes they don't want those M16's to explode -- but they don't want to be bled dry for a shoddy system, either. Especially when they have to report to a congressional subcomittee explaining why they blew billions of taxpayer dollars on incompatible systems.

Re:PDF?

[zulux]

whatever happened to good old ASCII or ISO text files? nothing says cross-platform than an ISO format

Oh sure, leave out us EBCDIC users, you young whipper-snappers with your fanch-schmancy ISO standards. HA! ...I'll just go back to my Forth system and cry.

price for this report...

[u19925]

The BSA has asked MITRE to conduct internal software audit or pay 10 Million dollars.

The DoD has been asked to conduct internal software audit or trash MITRE report on FOSS.

Re:Open source, eh?

[wcbarksdale]

1. Somehow I doubt that the DoD -- or anywhere that security is really important -- throws together code and puts it into production right away. (Who hasn't heard the stories about the draconian code review policies?)
2. Why would the DoD distribute their modified code? Perhaps they would send a patch to Apache or whatever if it was sufficiently general interest, but I suspect most of the modifications have to do with security policies particular to them.
3. Do you really believe that "Al-Qaeda hackers" [sic] spend more person-hours looking at the code than non-malicious users?
4. Neglecting the silliness about Al-Qaeda, why should I trust you that "some computer science programs and IRC channels" are training highly dangerous black hats? Last I checked, IRC was the land of windows-running script kiddies, and typical computer science programs include perhaps one optional course on security.

They are not required to distribute it

[XNormal]

Even the GPL does not require anyone to distribute their customized in-house modifications.

I do hope that some employees who are exposed to open source, its benefits and the values of the community behind it contribute to open source projects in some way.

What if ...

[SgtChaireBourne]

It's interesting that the report starts out with a what-if scenario. "What if FOSS were banned in the DoD?" Answer - things would pretty much stop. FOSS has played and continues to play a critical role in the DOD.

A lot of people will begin to think about the converse, "What if Closed Source were banned from the DoD?" or even more specifically, "What if Closed Source from companies found guilty of breaking federal law were banned from the DoD?". I wouldn't be surprised if the answers were "not much change" and "things improve", respectively.

Re:PDF?

[Twirlip of the Mists]

Ever tried to read a "good old ASCII" text file? If you try to read it on screen, you'll suffer annoyance and fatigue after mere minutes. If you try to print it out, you'll end up with page after page after page of unformatted text, probably wrapped to 80 characters.

ASCII is a fine format for email and config files. It's not an acceptable document format. PDF is, despite what some people seem to think, the best digital document format available today.

GNAT is part of GCC

[norwoodites]

yes that is right even though the paper makes it sound like GNAT is a separate project from GCC, they are now one, GCC (GNU Compiler Collection). Their description says they are one now but I think this description was copied from each of their web sites.

Also is not RTLinux longer consider free software, because it restricts more than the GPL due to patents?

Also looks like they do not use csh at all which is under the BSD license. or pdksh which is in public domain, they are the default shells on OpenBSD.

They are also missed Binutils from the GNU which is the assembler and linker for most open/free operating systems.

Also is there not versions of sed and make and m4 and top that are under the BSD license?

Is perl not dual licensed, GPL and artistic?

Re:GNAT is part of GCC

[himi]

GNAT has only been included in the core GCC distribution since 3.0, and it's still not amazingly well incorporated (you need extra tools to build it, rather than being able to build it straight out of the base tree as you can with the other supported languages). But yeah, talking about them seperately is at least a little out of date . . .

himi

djbdns & qmail

[dasunt]

I'm not trying to torch anybody's favorite software here, but both djbdns and qmail have drawbacks.

The biggest issue is the license. Qmail is limited to source-code only distribution, with an exception being made for precompiled binaries if they behave exactly the same as qmail normally behaves. Information here. This means that if you want qmail not to throw all of its binaries under /var and ignore most of /etc for configuration files (which it normally does), you have to compile and patch it by yourself. Also, there is no distributing patched versions, so if D. J. Bernstein dies tomorrow, qmail development is effectively frozen until qmail passes into the public domain decades later. That includes any security/performance patches, as well as ports to other architectures. Djbdns has a similiar license.

There is also compatability. Djbdns does not support certain zone transfer mechanisms. It ignores some IETF standards entirely and impliments its own version instead. I get upset when Microsoft twists and corrupts public standards for its own ends, and I get upset when Bernstien does it as well. I'm lazy, I don't want to have to doublecheck if my DNS servers supports a certain standard if my cofiguration changes. Qmail is more of a quibble, I don't like how it throws everything in /var. (And I'm not sure why the world needs qmtp)

I'm not saying that a lot of people and smaller sites won't find qmail/djbdns (and the rest of Bernstein's software) useful. They seem to be secure, and they do their job as long as everything is compatible.

However, one of the reasons why I avoid proprietary software for many tasks is that I don't want to hitch my wagon to somebody else's horse. If I go with a MTA that is wildly used and is GPL or BSDl, I am assured that development does not rest solely on one person. And if I go with standards-compliant software, it ends up being less of a hassle in the long run.

Djbdns and Qmail aren't bad. But they have licenses that limit distribution and development, and they break interoperability.

Brilliant example of Microsoft

[magi]

The document is an enjoyment to read. It has a few pearls which are especially enlightening. One of these is a table illustrating the actual freedoms and restrictions placed by various licences, for example GPL and a Microsoft's MIT EULA:

Properties (a) through (e) in the table examine the ability of a license to co-exist with other types of software, e.g., the ability of FOSS licenses to co-exist with proprietary software. In this
category, the most exclusive license is easily the Microsoft MIT EULA license 1 , which prohibits a number of FLOSS licenses from co-existing on the same platform as the EULA software. No other FLOSS or proprietary license encountered during the survey came close to this level of exclusivity. The GPL takes a very distant second place for exclusivity, since it forbids design- time incorporation of GPL source code into non-GPL source code. However, unlike the Microsoft MIT EULA, the GPL places no constraints on software simply running on the same system, and actually goes out of its way not to intrude on other licenses outside of that context."

I didn't even know Microsoft has that restrictive license. It says here that it "Specifically bans use of: GPL, LGPL, Artistic, Perl, Mozilla, Netscape, Sun Community, and Sun Industry Standards."

Microsoft's site shows the license. It's really true. This particular EULA seems to be for a "Microsoft Mobile Internet Toolkit Beta 2". They actually call OSS as "Potentially Viral Software" in the license.

Re:Brilliant example of Microsoft

[Ektanoor]

OSS licenses are Potential Viral Software. Anyway a virus can potentially strike most software stuff. Besides, we have Linux virus don't we? So I think M$ does make a serious point here. As they software has nothing "potential" in virus terms. It had viruses, it has viruses and it will have a lot more for generations coming. So that's a point dividing "Potential Viral Software" from "Effective Viral Software". So let's thank M$ for its care of trying to avoid us of catching this eternal endemic plague out from its soft...

Re:Open source, eh?

[thelen]

Even on Slashdot the GPL is largely misunderstood. It principally dictates that if you redistribute the software you must also redistribute the source; it does not require that you redistribute the source in order to use the code yourself in whatever fashion you require. Your error is exactly the misunderstanding that MS capitalizes upon in describing the GPL as 'viral'.

Generally Recognised as Safe == Debian/stable?

[SgtChaireBourne]

One of the reports' three recommendations is to create a "Generally Recognized As Safe" list of Free or Open Source Software. The stable distribution of Debian has already done this. If the DoD is looking for a base set of packages, then Debian looks to be the set to work with.

Re:PDF?

[Simon Brooke]

whatever happened to good old ASCII or ISO text files? nothing says cross-platform than an ISO format

I'm currently trying to write a parser for ISO8211. Currently it makes me very cross and won't run on any platform. Just because a format has been endorsed by ISO doesn't mean it's either any good or easy to use.

[Yes, I know there already are two open source ISO8211 parsers out there. Unfortunately they're in C++ and Python respectively and I need one in Java].

About #2

[Kjella]

2. Why would the DoD distribute their modified code? Perhaps they would send a patch to Apache or whatever if it was sufficiently general interest, but I suspect most of the modifications have to do with security policies particular to them.

Same as everybody else I'd guess, not having to keep their own branch and re-implement any fixes in the public branch, keeping track what they have fixed and public branch haven't when the interface changes. Of course, the NSA could probably afford that, but the benefits are few...

Kjella

Re:About #2

[himi]

At which point they get the benefit of all the white-hat review that the project gets, so it's kind of a moot point.

Really, arguing that letting the black-hats see your code automatically leads to terrible insecurities is just plain stupid - if the code is that bad, you shouldn't be using it, regardless. If you're confident enough to use it in production, then revealing the code shouldn't be a serious issue.

himi

Qmail: secure, but not responsible

[Black Copter Control]

Qmail's security is more theoretical than actual. From what I can tell, Bernstein wrote Qmail more to prove that he can design and write secure software than to provide a service to the public. He disclaims responsibility for problems that come from outside his source code.

If somebody finds a bug in, say Linux, that can be exploited against both Sendmail and Qmail, the Sendmail folk will fall all over themselves to find and distribute a workaround. Bernstein, on the other hand, will likely just smile and say "not qmail's fault". This doesn't do much good for people who are actually using qmail in the field and will need to create and distribute their own patches on the back-channels -- and then integrate them with the myriad of patches out there.

I really believe that Qmail's license was and is the biggest barrier to it's more widespread adoption.

Debian may not agree...

[Xtifr]

As a Debian Developer, allow me to strongly disagree. There is a lot of software in Debian! It's as reliable and trustworthy as we can make it, but a lot of stuff doesn't get banged on very heavily (some of it is downright obscure), and the best we can really say is, "we haven't found any obvious problems". Which is a whole world apart from "Generally Recognized As Safe."

Now, anything that's FOSS and GRAS is probably in Debian, but being in Debian stable is only evidence of being FOSS and NPU (Not Proven Unsafe).

I think that the idea of having an external list of FOSS/GRAS software is an excellent one. Moreover, I doubt if Debian wants to accept responsibility for maintaining such a list.

Re:Debian may not agree...

[Xtifr]

Rather it would be more like the Dept. of Defense selecting a subset from among Debian's not proven-as-unsafe packages, pounding on them till they're proven safe and recontributing the safe packages.

Sort of like the NSA did with the Linux kernel to give us SELinux? That would be nice, but I think it goes far beyond the bounds of what's being discussed here. (Although I can't tell for sure, since the site is slashdotted.) They seem to want a list of what they should be willing to use now. And Debian is not the right place for them to start on compiling such a list.

I think you're missing the Generally part of "Generally Recognized As Safe". Most of the stuff that's GRAS is going to be included in most distributions, simply because it is generally recognized as safe. So, again, they don't have much to win by going with Debian. (Aside from Debian's usual advantages of maintainability and reliability.)

In other news...

[karlm]

For simplicity, KFC set up the world's largest builboard in its empoyees-onlyparking lot, facing company headquarts. The billboard contained the Colonel's secret recipie. A local photographer is being sued for taking an oblique picture of the sign from a nearby freeway.

Seriuously. There are established procedures for keeping people out. If you're not at a very minimum using HTTP Basic authentication, it's the equivalent of setting up a billboard, or leaving a stack of papers face down on a public sidewalk in hopes nobody flips the stack over. Reasonable and innocent curiousity is not a crime, nor is reasonable reporting of the reslults of such.

A friend once got sued for using a "guest" dialup account with a null password from a local telco back in the early 1990s, when net access was damn expensive and for the most part not available to kids. He didn't set up a BBS or crack any passwrd files. He just used the guest account to telnet into some MUDs and read some newsgroups. Luckily, the jury decided it was reasonable for him to assume that as a customer, the "guest" account with no attepts made to restrict acess applied to him.

If you put a table in your front yard with a "free" banner hanging over it, it's kinda hard to charge someone for trespassing if they walk up and eat a few brownies off the table when you weren't arround. Maybe it is your yard and maybe they were your brownies, but you implied consent in a major way by putting them out there in that context. If you really only meant for the paper cups next to the brownies to be free, it's your problem. In fact, it's false advertising if you try and collect damages.

Re:In other news...

[kindbud]

That's fascinating. But you posted it to the wrong thread. :)

csh considered harmful

[Xtifr]

I'm actually quite relieved to see that they don't include csh. I think that's just good sense. As for pdksh, I doubt if even BSDers use it very often, so it probably fails the widely-used test. I actually know of more people that use ash (recently renamed dash), which is originally from NetBSD, but is now found on many other systems (Linux, FreeBSD, etc.)

reps

[Shalome]

I was recently at a conference where several vendors promised that their anti-virus product "stopped attacks 100% of the time." I didn't bother pointing out that that wasn't exactly likely or sustainable in an operational environment.

Someone else at the conference mentioned a foreign vendor whose firewall was supposed to stop 100% of traffic -- well, it did. However, it blocked ALL network traffic to the machine it was installed on and was not reconfigurable. Hey, it did what it was advertised to do, right?

Pity about the invective . . .

[himi]

Because what you had to say is about right.

Don't use qmail, use postfix. It's more secure, faster, simpler to use, and it has a much better license. Also, Weiste Venema is a much nicer person ;-)

himi

Linux IS used in the Marine Corps

[LittleLebowskiUrbanA]

I took a class recently conducted by a Major ( in the Corps) who informed me that Linux is used for firewalling at the higher echelons of IT in the Corps. As for other services, I can point you to quite a few Navy guys running Linux mailservers. The Navy is much less regimented than the Corps and their IT think nothing of going Fry's, building a nice Athlon system, and throwing Linux on it. That would never happen here in the Corps unfortunately. I'm sure if I'm in Kuwait in six months setting up a network and the only way to get said network running was through the LEAF project, I'd get the go-ahead until we could get some expensive, proprietary firewall sent to us. The poster above is pretty much dead on. Each service does have its own way of going things. Just head on over to Netcraft.com and see what the Army's running for a webserver.

License should protect the payer, not payee

[FreeUser]

I would say that the license that gives the most freedom is the license that publically funded development should have. Guess what: that license is not the GPL

This is a tired argument, but to recap:

Long story short, GPL is analogous to a constitution protecting the freedoms of its citizens (users) by constraining in a few minor ways what freedoms the developers can deny their users.

The BSD license is more akin to a democracy with no constitution, or no strong constitution, which constrains the developers little or not at all, at the expense of leaving the users with no protection of their freedoms.

Both licenses are appropriate in some circumstances. BSDL is good for getting protocols, algorithms, and other standards widely accepted by allowing proprietary as well as free products to use the code (good example: ogg vorbis), while the GPL is excellent at insuring that a project remains free in perpetuity.

Software funded by tax dollars is funded by the users. It is therefor more appropriate to have a license which protects the rights and freedoms of the users who are paying for the developmnt over those of the developers who are being paid (though of course developers benefit immensly, in having their freedoms protected with respect to contributions by other developers. Not every user is a developer, but every developer is a user somewhere along the line).

Re:Did you not catch the title?

[jandrese]

Microsoft software has to be trashed too, fortunatly the registry makes this easy to do. It's not hard to horribly break a Windows machine with a few strategic registry tweaks, all in the name of security.

This is probably the reason for the MITRE report

[Mr. No Skills]

The DoD is under tremendous pressure to have Microsoft blessed as the only products they use, as Microsoft has learned how to lobby and started throwing lots of money at this. The government is a huge purchaser of systems, and there are many legacy things out there. Since the past 10 years or so have brought many fresh college grads into the workforce, many of whom only know Microsoft products, there is pressure on the technical selection folks to replace with Microsoft since those precious MCSE's only know these platforms.

This report is probably an effort to build some evidence and support on why wholesale replacement of everything with off the shelf would add costs and hurt national security. Probably also explains IBM's (and others) shift to support Linux and variants over the past few years as they saw Microsoft tactics refined.

And, Microsoft's more recent license agreement language seems pointed at providing a legal reason why they need to be the only platform, since there are no technical reasons.

They SHOULD Get It

[Compulawyer]

After all, they're MIT. MITRE stands for MIT Research. For the uninitiated, MIT is Massachusetts Institute of Technology.

Qmail not really open source software.

[dwheeler]

Qmail is not really an open source software/ free software program. See my paper at http://www.dwheeler.com/oss_fs_why.html for an explanation.

Re:Qmail not really open source software.

[dwheeler]

There are no font specifications other than a few tables, and the legal mumbo-jumbo at the bottom. If the fonts aren't readable, that's a problem with your browser settings. In Mozilla, select Edit/ Preferences/ Appearances/ Fonts to modify them.

Re:Misleading...

[adb]

Nobody has ever assumed that GPL software cannot be used on the same system as proprietary software.

You are quite mistaken. People who are clueless about the GPL (and there are a lot of them) assume this all the time. And others make other incorrect assumptions: for example, that code that is compiled or written with a GPL'ed tool becomes GPL'ed. Few people who have been involved in the debate for a while suffer gross misunderstandings like this, but the general public (and clueless managers) certainly do.

This ignores the fact that you cannot link a GPL library into your proprietary code. For a company that writes top secret material, this is somewhat concerning that they would ignore this.

It's not true that you can't link a GPL library into your proprietary code. You can. You just can't distribute it to others in that state. (You can still use it internally.) If you need to distribute proprietary code but want to use GPL code, you just have to keep them at a safe distance from each other: for example, running in separate processes and communicating through IPC or standard I/O is fine. And, of course, this sort of issue is totally irrelevant to the question of whether or not to use Linux; it's about integrating GPL code into your code, not merely using them side by side.

Bio of the author

[benploni]

It was written by:

Terry Bollinger

The MITRE Corporation
1820 Dolley Madison Blvd.,
W534 McLean, VA, 22102, USA
terry@mitre.org

Terry Bollinger currently works at The MITRE Corporation, where he focuses on distributed software and hardware architectures issues for U.S. Department of Defense information infrastructures. He is an editor for IEEE Software, and was one of two Special Editors for the Jan/Feb 1999 issue of IEEE Software on Linux and open source software methods.

Terry has had extensive experience at all levels of software development in the telecommunications industry, at NASA, and for the U.S. Department of Defense. Especially while working in the telecommunications industry, he has had extensive hands-on experience with both a wide range of software construction methods and approaches, and with the consequenses of trying to apply some of these methods in "realistic" environments in which there is a typical spectrum of developer experience (e.g., what happens when C++ is applied in and environment consisting almost entirely of long-term funcional C programmers). Terry also has a strong background in software reusability and software process, including an IEEE Software Best Paper on why software process improvement doesn't always give the kinds of results advertised, and is intrigued by the issue of why some programmers seem to be so much better at producing high-quality, stable code that endures over time. In terms of software construction issues, he is both highly familiar with the overall set of techniques involved (including newer methods such a graphical component based programming), and is strongly supportive of the need for good methods while also being heathily skeptical about a lot of the claims made for various software construction methods and tools.

Terry has M.S. and B.S. degrees in Computer Science from the University of Missouri at Rolla, and has been a member of IEEE for 23 years.

Not Worth Switch to Open Office...yet

[reallocate]

As of yet, there's not enough incentive for the non-ideologically driven to drop Word and switch to an open source product. Large organizations, and MITRE is large, already have Word sitting on thousands of desktops, they've paid for it, and they've sent employees off to "How To Use Word" training. Bringing in a Word replacement means additonal time and cost (installations, tweaking, employee training, help desk training, etc.) without a compelling payoff --you pay for the transition and your capabilities remain essentially the same.

Open source office suites will need to do a lot more than be "free" and successfully mimic MS Office before they're become worth the price of switching.

Re:Not Worth Switch to Open Office...yet

[reallocate]

>> ...the risk that development of the open source office suite you chose could be dropped at any time if the contributors get bored with it

That's a key and often overlooked point. Before an organization sinks 6- or 7-figure sums into an deployment, they want to be sure that the software isn't going to go "poof" the following year. In addition to soft pedaling the expense of rolling out new software, even if that software is free, many open source advocates ignore the general impression of lack of commitment and "college kids passing code on the Internet" that their chosen development model radiates in some circles.

That's unfortunate, and in the case of heavyweight effort like Apache, not justified. In other instances, though, it is justified.

especially slimey

[sacrilicious]

the Microsoft MIT EULA

What I find really distasteful is the above phrase's incorporation of "MIT". Microsoft tries to pass it off as standing for "Mobile Internet Toolkit", but personally I believe it was intended to sound like (and evoke the favorable sentiments associated with) the Massachusetts Institute of Technology AND the associated, like-named OSS license.

.

I like the acronym

[spitzak]

Somebody there was aware that there was a bunch of people who argue about the differences between "Free" and "Open" and which one is better, while for all practical purposes they are exactly the same. Combining the acronym was a good way to not take sides in the argument (I suspect the authors had no opinion either). I also think a word starting with a consonant is easier to pronounce and put into sentences.

Re:Misleading...

[spitzak]

This ignores the fact that you cannot link a GPL library into your proprietary code. For a company that writes top secret material, this is somewhat concerning that they would ignore this.

Yes you can use GPL in your proprietary code. You just are not allowed to distribute it to outside parties. If you are writing something top-secret where the secret would be revealed by examination of the source code, you would be pretty foolish to distribute the binary, too!

Re:I work for the DoD.. - OFF TOPIC -

[ivan256]

No offence to you, Sivar, since you're an innocent victim of this offtopic rant, but it's unfortunate that you can click a box to disable peoples .sigs, but there's no box to disable comments about people's sigs. If only...

Re:PDF?

[Jason Earl]

Will the Python one run under Jython? Just a thought.

Re:Misleading...

[spitzak]

Companies can write Top Secret code that is distributed to other companies and even sold.

You are correct that such a program could not include any GPL code.

If you link it in to your code, you are required to release the source code. Just because people may not know it exists does not mean you can hold the source proprietary.

As has been pointed out about a million times here, the GPL only requires you to release the source code to the people you distribute to. If somebody does not know a program exists then they obviously have not been distributed to, so they have no rights to the source code.

Re:Qmail: secure, but not responsible

[Black Copter Control]

Yes the patch should (also) be done in Linux.. In the meantime, however, a workaround in userspace can be valuable from a security point of view.

For some reason people are often wary about the idea of loading new versions of the kernel into running servers. and new kernel releases can take longer to test and propogate than (relatively) simple userspace programs.

How long do you want to wait for a patch to a security problem?

(Perhaps I should have used a proprietary Kernel as an example --- they're likely to take much longer to come out with a patch).

Re:Misleading...

[spitzak]

If it is a government secret you can then arrest that requestor (and whoever gave them the program) for violating whatever security arrangement they were made to sign.

Re:Misleading...

[kevlar]

Nonsense. The mere notion that the software exists and that it links with GPL libraries is enough for someone to request the code. Legally (assuming the GPL can stand the test) they'd be required to provide it. For reasons of national security they may decide to ignore the GPL, but thats only because its a catch-22. I highly suggest that all government contractors who develop sensative software not link any libraries that are released under the GPL. In this case, its a sleazy trap to force developers to release their source code.

Re:Misleading...

[spitzak]

No, only people who have the program are allowed to request the source code. If somebody has a top-secret government program then they have probably broken the law somehow.

Re:Misleading...

[kevlar]

Read the license, then make your point.

Re:Misleading...

[spitzak]

I know exactly what you are talking about:

"b) Accompany it with a written offer, valid for at least three years, to
give any third party, for a charge no more than your cost of physically
performing source distribution, a complete machine-readable copy of the
corresponding source code, to be distributed under the terms of
Sections 1 and 2 above on a medium customarily used for software
interchange; or,"

Please explain how somebody gets ahold of this written offer without violating security regulations of the DOD or whoever wrote the "secret" program.

It is well established that GPL code can be used inside an organization for whatever purpose that organization wants, and there is absolutely no requirement that anybody inside or outside the organization get access to the source code.

The purpose of the GPL is so that anybody who owns a program can modify it for their own uses or interoperate with it (they can of course "modify" it to free copies thus allowing others to "own" it). It is not in any way intentded to grant anything to people who don't have the program. The "third party" thing has been explained a million times over that the "third party" is supposed to have a copy of the program.

Glyphs vs. characters

[Apotsy]

Nope.

PDF is a subset of Postscript all right, but while Postscript contains the actual character values, PDFs only store glyphIDs.

Glyphs, not characters.

There is a difference. A big difference. Trying to turn glyphIDs back into characters may work sometimes, but it's certainly not guaranteed to work. Any glyphs that do not have cmap entries in the font will come out as garbage.

Adobe should certainly never have put the text selection tool into Acrobat Reader. It does not work half the time, and it has fooled people into thinking that PDFs contain text. They don't. They only contain the vector image data necessary to render the text.