MITRE Corp. Report On Open Source In Government

Jeremy Allison (of the Samba team) writes "Very interesting paper just published by MITRE corporation. (In PDF - they've learned not to use Microsoft Word. :-). Highlights: 'The main conclusion of the article was that FOSS software plays a more critical role in the DoD than has generally been recognised.'; 'Create a "Generally Recognised as Safe" FOSS list ... including Linux, OpenBSD, NetBSD, FreeBSD, Samba, Apache, Perl, GCC, GNAT, XFree86, OpenSSH, bind, and sendmail.' 'FOSS' stands for 'Free and Open-Source Software.' Looks like these people 'get it.'"

Comments

Generally Recognised as Safe.

[Sivar]

"Generally Recognised as Safe ... bind, and sendmail."

I'm all for Unix server software, but BIND and Sendmail? True, they haven't been bad lately, but both of these are former poster childs for the land of remote root exploits. Yet Qmail, djbdns, and Postfix--some of the most secure software ever made, is strangely absent.
Well, it is the government. They are making progress in their own little way. :)

Re:Generally Recognised as Safe.

[Sivar]

Correction: Upon further inspection, Qmail is graciously listed, though the others seem to still be absent (unless I can't search properly).

"Qmail is a FOSS replacement for Sendmail, the
program that transfers emails between computers
on the Internet. Qmail has improved security,
reliability, and performance features."

Yep, that pretty much sums it up. I'm impressed. :)

Re:Generally Recognised as Safe.

[GreatDave]

I'll wager that the feds' decision not to mark, say, other MTAs is safe may be due to lack of adoption in the public and age of the code. Let's face it, Sendmail touches just about every email sent, anytime and anywhere. It's old code that has its nuances known. Sure, it's not a daemon but a demon, but by the DoD's logic, it can be trusted while something like qmail cannot.

>They are making progress in their own little way. :)

Military intelligence... if we ever understood it, we'd be arrested and our brains classified. :P

Re:Generally Recognised as Safe.

[Twirlip of the Mists]

I think you need to adjust your idea of "secure" a little bit. Sendmail is ancient-- in Internet terms-- and it is widely known. Everybody knows where Sendmail's bones are buried. Qmail, on the other hand, is newer and less widely used. The fact that Qmail has had fewer known security flaws can be interpreted as a sign that there are more left to be discovered.

Secure doesn't mean invulnerable. It means trusted. You can trust something with known flaws if you know where those flaws, how to avoid them when necessary, and how to fix them when possible.

Re:Generally Recognised as Safe.

[novakreo]

True, but then again Qmail has offered a USD $500 security guarantee since 1997, which so far remains unclaimed. Sendmail does not, and since then they've had a number of security issues to deal with.

As for its usage, Qmail at one stage included Hotmail among its users, so it has had a reasonable amount of testing and use.

Re:Generally Recognised as Safe.

[Twirlip of the Mists]

Your comment reminds me of the old joke about the optimist and the pessimist who visited California. They heard that there hadn't been a major earthquake in California in however-many years. The optimist thought to himself, "We're safe!" The pessimist though, "We're due!"

Security-minded folks are more likely to be pessimists than optimists.

Re:Generally Recognised as Safe.

[lewp]

Age of code doesn't always directly relate to security of code. Yes, Sendmail is older. While that means the code has been around to be looked at by more people, it also means it was written before security was even close to the priority it is today.

Qmail, on the other hand (and Postfix, and others. Sorry if I don't mention everyone's favorite :P), was created from the start to be as secure as possible. It has the advantage of being able to build on many years of advancement in secure coding practices. For example, the way as little of its code is executed as root as possible gives it a big advantage. Sendmail 8.12 is moving in the same direction, but it's much newer than Qmail and, while I haven't gazed at the Sendmail source recently I'd be willing to wager that getting it to play with privilege separation wasn't a trivial change.

I'm not knocking Sendmail. I use it on a whole bunch of production boxes. It's familiar, easy to use, and works out of the box with everything. It's also fast enough to make it suitable for most environments and I have a whole lot of time invested in learning the various ways to configure and tweak it and how to fix it when it's being moody.

That said, I also use Qmail on a regular basis. Of the two I keep a much closer eye on the Sendmail installations. Sendmail's current biggest known flaw is its history, and until a something approximating that shows up in Qmail I'm more inclined to trust djb's baby (even though I put it in /usr/local/qmail. nyeh!).

(Qmail also has the luxury of being the product of someone who comes off as a complete asshole. I can guarantee you that the fact that Qmail doesn't have any known security holes is not for a lack of trying. There are plenty of people who would *love* to find a hole in Qmail just to shut him up . I hope djb doesn't have mod points!)

Re:Generally Recognised as Safe.

[Elbereth]

No, it's "free" as in "free".

Re:Generally Recognised as Safe.

[geirt]

Sivar wrote:
"Generally Recognised as Safe ... bind, and sendmail."
I'm all for Unix server software, but BIND and Sendmail?

Don't mix old Bind and Bind 9, Bind 9 is an entirely new code base written from scratch with security as a basic premise. Version 9 is not susceptible to the same issues found in earlier versions of the Bind DNS server.

The track record for Bind 9 is *much* better than it used to be ....

Re:Generally Recognised as Safe.

[Fweeky]

Yet Qmail, djbdns, and Postfix--some of the most secure software ever made, is strangely absent.

Did you ommit exim because you:

• Don't know it?
  
• Forgot about it?
  
• Don't like it?
  
• Think it's insecure?
  
• Think CoyboyNeal wouldn't approve?
  

Rock on.

[LoudMusic]

Nice to see some of our tax dollars not going to waste on over-priced under-powered software.

I suppose this means there will be more job openings for geeks in government possisions. Get out your resumes guys and gals ...

Re:Rock on.

[Sivar]

You may not want to work for the government in anything technical. Sure, you may get to play with some neat toys, but after seeing so many Sun Enterprise systems used as office mail servers -- sitting alongside NT database servers equipped with 64MB RAM, one tends to go insane. :)

Re:Rock on.

[budalite]

Yeah, well, we can be either a part of the answer, part of the problem or work both sides of the fence, like I do. :) I have worked in both the fed. govt and private industry. There isn't really much difference in how things get done. The main difference is that where business people reward each other with fat contracts, in the fed. world, one must change the *policies* to reward your buddies. That is exactly what happens after every election. A new policy can reap billions in rewards. If you didn't know that, now you know why the position of president, though it "only" earns $200k/yr (+ room, board, and security detail), causes millions and millions to be spent to get someone the job.
Interestingly, I feel more like a "stakeholder" as a govt. employee than I did as an industry stock-holding employee. It's my tax money, too, I guess.

About time.

[carlmenezes]

About time somebody did something like this. I mean, to the average Joe, the advantages of FOSS are obvious. But the DoD need documents, papers...anything written. It's similar to businesses WANTING to pay for software and therefore keeping away from FOSS.

I guess everyone was waiting for somebody to basically do a "study" or write a paper that could be quoted or "fallen back upon" if you will.

Then again, this report is about the fact that FOSS already plays a more critical role. My point is, it's high time somebody came out and recognised the fact. Great job on the paper.

Re:About time.

[Shalome]

quoth the poster:
I mean, to the average Joe, the advantages of FOSS are obvious.
Don't you mean "to the average Slashdot poster"? When I think of the average Joe, I think of my father, who believes that my computer must be turned on for him to send me e-mail from his computer. That, and that Prodigy is the greatest thing on the planet...

Yeah, I know, I'm nitpicking...

Re:About time.

[stefanlasiewski]

No, maybe to the average slashdot.org/~joe the advantages are obvious

Hmmm... if Joe knows that FOSS exists, he sure ain't admitting to it!

http://slashdot.org/~joe

joe has posted 0 comments. ... And userid 369. All that time and no comments... :)

Re:About time.

[Daniel Dvorkin]

Exactly. The DoD is interested in sweetheart deals with major defense contractors (and yes, Microsoft now falls into that category) which are generally brokered by retired high-ranking officers who start taking gigantic salaries from said contractors the moment the ink is dry on their discharge papers. Since most of the contractors (Microsoft excluded) actually build pretty good products, "things working correctly all the time" is a happy side-effect, but there's no evidence that it's a primary goal.

As a vet, believe me, I'm not happy about this. I've seen the effects first-hand. I was a medic for eight years in the Air Force. About halfway through my second enlistment, we switched from company A's IV needles, which were very high-quality and never crimped up -- i.e., the plastic cannula over the needle, which is the part that actually stays in the patient when the needle is pulled out, always went in smoothly with the needle instead of crimping up around the needle and not going in -- to company B's IV needles, which crimped up about a third of the time -- which of course meant that the patient had an extra hole in his skin and the needle was now useless. We did this, as it turned out, because the recently retired General X, who had been quite high up in the AF medical bureaucracy, was now a member of Company B's board of directors. When I got out of the service a couple of years later, we were told that the AF was "studying the problem." Meanwhile our supply guys were cutting "gray" deals with local medical supply companies to get us needles that worked.

This may seem like a minor problem, but consider that a) the switch caused a lot of pain and suffering (even good IV sticks are painful; bad ones are worse) and wasted a lot of money, and b) this sort of thing happens all the time, all over the place, in places ranging from the base personnel office to the ER to the flightline where people are loading nuclear weapons onto bombers. And not just in the AF; there are similar stories from almost every job in every branch of the service. Your tax dollars at work, folks.

PDF format freer than Word?

[coupland]

A very minor and unimportant comment:

Most companies when publishing in PDF format do so, not for openness but to preotect against copying or modification.

For example, my company works extensively with the FDA and we publish all our standard operating procedures (SOPs) in PDF format since it's so difficult to copy. We rely not on the openess of the format but on its limitations. Not earth-shattering but I wanted to mention that PDF is not a particularly open format, despite its structures being well known.

Re:PDF format freer than Word?

[pauldy]

That is kind of funny because the line feeds are ^M just like what the acrobat distiller does. I would say PDF is freer than word however, because you don't have to pay money to view the document and since the purpose of this document is to be read then this particular format is best suited to enable that viewing across platforms without additional costs for the reader while maintaining the original format of the document.

I would also say anyone using PDF's for the security of them not being easily modifiable is running on assumptions that the people they are sending the files to are to stupid to figure out how to modify them to their hearts content.

Re:PDF format freer than Word?

[JordoCrouse]

Most companies when publishing in PDF format do so, not for openness but to preotect against copying or modification.

Ironically, you think that PDF protects against copying, because it is difficult to modify them in Windows. By the same token, you may think that .DOC files are less secure, due to the fact that they are easy to read and modify in Windows.

Which of course, is the opposite for any *NIX system running Ghostscript (where a PDF -> ASCII conversion is trival, but .DOCs require much more work).

I guess you do have to play to your users strengths and weaknesses, it just seems funny to me, somehow.

Re:PDF format freer than Word?

[tunah]

I would say PDF is freer than word however, because you don't have to pay money to view the document

Only half true. Microsoft offers a little known Word 2000 viewer (and similar viewers for Excel etc) that is available gratis.

Re:PDF format freer than Word?

[u19925]

There are three main advantages of PDF over Word:

1) The format is compressed, so it is smaller in size.

2) The PDF viewer is available on more platforms than Word viewer

3) The PDF is already formatted for printing.

Re:PDF format freer than Word?

[zenyu]

Only half true. Microsoft offers [microsoft.com] a little known Word 2000 viewer (and similar viewers for Excel etc) that is available gratis [microsoft.com]. It's only free as in beer. I can use xpdf and the like to view pdf's... Also I've had the experience of the Word Viewer crashing on complex word documents. Only ones from Microsofties so far, but even so it's sad when I have to turn to openoffice to view a word file (even if it takes minutes to render a page), and then convert it to postscript to be able to view it in something solid like ghostview.

Re:PDF format freer than Word?

[Xtifr]

Microsoft offers a little known Word 2000 viewer [...] gratis

But that supposedly gratis viewer requires a non-gratis OS to run, so many of us would still have to pay money to view the document.

(But then you did say, "half true", and anyway, my objection is only half true because it probably runs under Wine. Though I'm not sure that helps people running Solaris/AIX/LinuxPPC/LinuxARM/LinuxPS2/etc.)

Anyway, the bottom line is that PDF is freer than Word because PDF is an open standard, and multiple implementations exist (some gratis, some FOSS) while Word is a closed, proprietary format subject to change without notice.

"Generally Recognised as Safe" Reference

[gmanske]

If like me, you were wondering what the "Generally Recognised as Safe" reference was referring to, here's an excerpt of the executive summary of the report.

This list would provide quick official recognition of FOSS (Free and Open-Source Software) applications that are:

(a) commercially supported
(b) widely used and
(c) have proven track records of security and reliability (eg. as measured by speed of closures of CERT reports in comparision to closed-source alternatives)

Gmanske.

This is a pleasant surprise...

[GreatDave]

While the Navy has its much-farted-upon attempt to build Win2k-powered "Smart Ships", the NSA has been developing SELinux (Security Enhanced Linux), their homebrew kernel.

It seems that the right hand doesn't see what the left hand is doing. That's the USA federal government for you. However, based on the existance of the "safe" FOSS list, perhaps the DoD is rethinking their investments in eN Tee. I sure hope so, for the sake of national security. Meh.

Re:This is a pleasant surprise...

[mcubed]

It seems that the right hand doesn't see what the left hand is doing. That's the USA federal government for you.

With all due respect to your example, I would rather each department of the government be allowed to implement its own solutions, at least based on my experiences working for large corporations (where the right hand often doesn't know what the right middle finger is doing). The most productive situations arise when divisions and departments are allowed to solve their own problems, rather than having some senior-level executive decided, "okay, this worked for marketing, so now everyone has to do it this way." Information sharing is important, of course, but forcing one-size-fits-all "solutions" can be counter-productive.

Michael

Infers that GPL means better security

[AIXadmin]

In this paragraph MITRE seems to infer that GPL'ed software is some how more secure, or better able to be secured then other software.

"For Security, use of GPL within
groups with well-defined security boundaries should be encouraged to promote faster,
more locally autonomous responses to cyber threats. "
Page 3, Example 2.

This really makes no sense to me. Especially when the majority of the software they list as "heavily used infrastrucuture tools such as "Linux, OpenBSD, NetBSD, FreeBSD, Samba, Apache, Perl, GCC, GNAT, XFree86, OpenSSH, bind, and sendmail," are a good portion of NOT licensed under the GPL. (Yes I realize some, are but the majority of that list are not.)

Doesn't make a lot of sense. Considering most people would agree the most secure OS out there is OpenBSD.

Re:Infers that GPL means better security

[FreeUser]

"For Security, use of GPL within groups with well-defined security boundaries should be encouraged to promote faster, more locally autonomous responses to cyber threats."

Perhaps one aspect of the security to which they refer is the secure knowledge that inhouse software developed under the GPL will remain free, i.e. they will in turn receive any and all improvements made by others. ;-) Somehow I doubt that is what they meant, though.

While the GPL is arguably more appropriate for public funded software development than licenses that lend themselves to proprietarization, I must agree wholeheartedly with you that it is clear that the advantage in security goes to free software over proprietary software, and not GPLed software over other free software to any degree. Indeed, as you point out, OpenBSD is the most secure operating system around, and it is certainly not GPLed.

What they clearly meant to say was the free software should be encouraged to promote faster, more locally autonomous responses to cyber threats ... they are mistakenly equating GPLed software with free software (when in fact it is only a subset).

Re:Infers that GPL means better security

[Ektanoor]

They refer to an ideal situation. The use of GPL soft would free completely their hands on changing every piece of soft that might be compromised. And they would not have to deal with licensing hurdles. But there are two caveats here.

First, a GPL-exclusivety would be appropriate only in top-security situations that demand a fast and very flexible response. Not having barriers on how to deal with the soft, be it binary or sourcecode is extremely important here. However, I would not be so fanatical on saying that only GPL soft is appropriate. Frankly, I think it would be better to say: licenses to do not impose barriers of any kind to software changes and distribution.

Second, to do such thing, people should be uberprofessional. Having GPL code is not enough to provide security. There should be someone who's able to manage the guns. However, if a certain department or site is considered to be top-security, then one should have someone of that weight out there... Isn't it? But... well... we know that even security guards love to sleep when they shouldn't. And that engineers are underpaid and don't have enough qualification. And that the managers will still buy some piece of crap instead of listening the experts... So this caveat is utterly pointless...

OpenBSD is one of the most secure. Because it is made for security. Most Linux machines are not because it would be a problem trying to adapt users to the level of security in OpenBSD. I made a few installs of OpenBSD and I may tell you that it is not easy to install something on it. Besides it is much harder to use. And, sometimes it is quite slower than other BSD and Linux conceptions. But it is very good on kicking every kiddie out.However, its administration demands every kind of tasks as nay other system. A badly administered OpenBSD is also breakable.

On what concerns Linux itself, unfortunately there are very few secure distros. But it is possible to reach a level of security near to OpenBSD or even better. By hand and making the system from scratch. Once we had such a machine. We named it "The Castle", out of the name of a distro that gave us the idea to make it. It was a damn well secured system. But using it... Better walking through the Labyrinth...

Exerpt

[willpost]

Banning Free and Open Source Software would remove certain types of infrastructure components (e.g., OpenBSD) that currently help support network security. It would also limit DoD access to -- and overall expertise in -- the use of powerful FOSS analysis and detection applications that hostile groups could use to help stage cyberattacks. Finally, it would remove the demonstrated ability of FOSS applications to be updated rapidly in response to new types of cyberattack. Taken together, these factors imply that banning FOSS would have immediate, broad, and strongly negative impacts on the ability of many sensitive and security focused DoD groups to defend against cyberattacks.

Starting on page 32, theres a very nice glossary of common Free and Open Source Acronyms.

Wait...another term?

[Rhinobird]

Isn't anybody gonna mention that RMS is going to say that FOSS should really be reffered to as Dental/FOSS?

PDF?

[intermodal]

whatever happened to good old ASCII or ISO text files? nothing says cross-platform than an ISO format

I work for the DoD.. open source rules!

[Shalome]

I work for the DoD (and am lucky enough to work with MITRE folk as well), and we go for the open source solution whenever we can. Why? We're in security. We absolutely NEED to be able to hack our own code whenever necessary. We can't afford to be taken down by any sort of attack, whether it be a worm, virus, or directed attack -- and I'm not talking "afford" in the sense of a dollar amount. We also like to be able to do things like add signatures to our IDSs whenever we feel like it. We often notice and track new virus and worm activity before it "breaks." We can't wait for vendor updates.

I've sat through meetings with vendor reps where certain office members tore the reps some new orifices. I've heard from a *major AV/Firewall company name deleted* rep "Oh, you use open source FREEWARE! Well, if you want to go with something totally insecure that has absolutely no support and you don't know exactly what the code actually does..." The rep then sat there in stunned silence as the department head launched into a detailed tirade about how every member of the office not only knew what the open source we used did, most of us could re-write it if we needed to. The rep actually blushed and admitted that if we could do that, we didn't need their product.

Most of our offices do use Microsoft on most of the standard user desktops... but it's open source hacked-to-hell code that runs everything else around here! Well, aside from the gallons and gallons of coffee and Mountain Dew that runs the people..

Re:I work for the DoD.. open source rules!

[sheriff_p]

You need to remember that reps aren't *real* people in most cases, and especially in a field like anti-virus, reps are often keen to over-sell products.

Of course, it's worth remembering (going a little off-thread here), that unpatched open-source software isn't any more secure than unpatched Windows software - IIS can be patched and secured too. A good tutorial on hardening IIS can be found here:
http://www.virusbtn.com/magazine/archives/200208/i mpossible.xml

Re:I work for the DoD.. open source rules!

[Sivar]

A DoD guy talking about his knowledgeable co-workers advocating OSS, being powered by coffee and Dew, and whose signature links to a web page whose largest graphic is a Southpark character...

Is this some other Department of Defense that I was not previously aware of?

No surprise

[e5z8652]

I've always wondered about the supposed lack of "FOSS" at DoD. Aside from SE Linux, there are other quite public acknowledgements of support for open source software. From the back of the OpenBSD 3.1 CD case:

"This effort sponsored in part by the Defense Advanced Research Projects Agency (DARPA) and Air Force Research Laboratory, Air Force Material Command, USAF, under agreement number F30602-01-2-0537"

Kind of a big hint that someone somewhere in DoD thinks highly of OpenBSD.

Of course, this support may have since been reduced or eliminated due to the same pressure that the NSA faced with SE Linux.

How much respect does MITRE command?

[burgburgburg]

How well is the MITRE Corporation regarded in general? How well are the thought of by the government in particular? How influential will their word on things be?

By the way, the document summary shows that it was originally a Microsoft Word Doc titled "Microsoft Word - 3DBD823B-1ABD-0AA6.doc" with the author being www.

Interesting that the DOD uses GnuPG, Linux, Linux (Red Hat), FreeBSD, NetBSD, OpenBSD, OpenOffice, Perl, Perl CGI Scripts, PerLDAP, PHP, Tcl/Tk and TCP Wrappers, amongst others.

Re:How much respect does MITRE command?

[Shalome]

quoth the poster: How well is the MITRE Corporation regarded in general? How well are the thought of by the government in particular? How influential will their word on things be? You're kidding, right?

On the front page of MITRE's website: MITRE is a not-for-profit national resource that provides systems engineering, research and development, and information technology support to the government. It operates federally funded research and development centers for the DOD, the FAA, and the IRS, with principal locations in Bedford, Massachusetts, and Northern Virginia.

Trust me, they're extremely highly regarded and their analysis carries quite a bit of weight.

Re:How much respect does MITRE command?

[Jeremiah Cornelius]

Not only this, Mitre are the origin of the Capabilities Maturity Model - in conjunction with CMU.

Process and methodology kings, par excellence.

Do you want to know how to do something right? Do you want to know how to repeat the performance? Mitre are your experts in the field.

If your organization has a job-title of "Program Manager", there is at least a passing nod to the CMM processes outlined by Mitre, which breaks down all process and initiative into functional program areas.

Re:How much respect does MITRE command?

[Ektanoor]

MITRE is a DoD child, created in the heat of the Cold War. It was and probably still is one of the best brainstorm centers in the world. And DoD loves it a lot. Besides, MITRE is one of the historic hallmarks on computer development. It was one of the organisations that tightly worked with ARPA in the 60's. So, in some way they can be the aunties of Internet. Many other things we use today were also developed by MITRE. So DoD will probably listen to its giant child.

What the DoD is and isn't

[kryonD]

Just to add some info here. Just because an article talks about usage and approval of FOSS in the "DoD" (Department of Defense), it doesn't mean that there is signifigant usage. Remember that the DoD is comprised of some management overhead and three sub departments: Army, Navy, Air Force. While Linux may be used and even endorsed by the "DoD", it's usage is not permitted without one hell of a waiver process in the Department of the Navy. Especially under NMCI(Navy Marine Corps Intranet), Linux is not even listed as an approved legacy system, much less something EDS will agree to support.

Additonally, each branch of the service is autonomous in IT management, which means there are FOUR DIFFERENT ways of running a network with the associated FOUR sets of management overhead and of course, they aren't interoperable. This is a fairly generalized statement, but most of the systems I deal with daily in the Marine Corps are specific to us and don't work with the other services systems despite the fact that they all do the EXACT SAME THING.

So kids, the moral of the story is: Write you congressman and complain about the misuse of your tax dollars. And don't forget to tell them that free software == excuse for lower taxes == more votes for them.

Re:What the DoD is and isn't

[Anonymous Coward]

Linux is in widespread use in the Navy research lab that I work for. And our NMCI installation apparently does include Linux in some way as I have seen reports of "compatibility testing" that mentioned NT/2k/XP/Linux/Solaris and a couple others.

Not to imply that NMCI isn't ridiculous and a huge waste of money. We're trying to fight it...

And don't forget that most computers aren't desktops. We certainly don't have any MS OS on our many embedded computers.

Re:What the DoD is and isn't

[Black Copter Control]

Especially under NMCI(Navy Marine Corps Intranet), Linux is not even listed as an approved legacy system, much less something EDS will agree to support.

I guess this means that if I want to mount a pirate attack on the DOD, I should make the Marines my beachhead?

Sir! The enemy is sighted, and they are using ISS!
Arrgh! Prepare to board them, and take no prisoners!

Report is written in Word

[ronys]

Open with Acrobat Reader, File->Document Properties->Summary... reveals:

Title: Microsoft Word - 3DB823B-1ABD-0AA6.doc

Furthermore, the PDF file was created by http://createpdf.adobe.com - which allows one to upload files and have the processed into PDF - 15 for free, more for $$$.

Seems like they didn't find out that ghostview allows you to generate pdf files as well as view them...

Report says GPL was the original

[AIXadmin]

Last I checked the BSD's were first:
"The General Public License (GPL)4 is the original FOSS license, and GPL software is simply FOSS software that is covered by the GPL."
Page 12

This report is really full of holes. In the chart it says that BSD and Artistic licensed software cannot be combined with closed source software.

A funny bit

[Vireo]

In page 22:

[i]Ironically, a thoroughly rigorous and systematic ban on DoD use of FOSS could also affect a number of proprietary product that rely on FOSS products that permit incorporation of FOSS into their closed-source products. For example, Microsoft Office uses the FOSS zlib collection of data compression software, and thus could technically be banned as a product that incorporates FOSS software.[/i]

Report makes no difference between OS and FS

[AIXadmin]

The report also no makes no differentation between Open Source Software like FreeBSD, OpenBSD, and Apache; and Free Software which generally always refers to software under the GPL or LGPL. Like Linux, gcc, or GNATS.

"The word free in FOSS refers not to fiscal cost, but to the autonomy rights that FOSS grants its users. (A better word for zero-cost software, which lacks such rights, is freeware.) The phrase open source1 emphasizes the right of users to study, change, and improve the source codethat is, the detailed designof FOSS applications. Software that qualifies as free almost always also qualifies as open source, and vice versa, since both phrases derive from the same set of software user rights2 formulated in the late 1980s by Richard Stallman of the Free Software Foundation."

The writer of this report does not make differentation between Open Source and Free Software. He call's things under a BSD license with no cost, and no restriction on rights, freeware. (Freeware does not mean OSS. Freeware is closed source software, that is given away at no cost.) While in the next setence pushing the view that all OSS is GPL'ed.

This report is a grave disapointment.

Re:Report makes no difference between OS and FS

[Ektanoor]

You didn't get the point. The problem this report tries to cover is not about costs but about the ability to control the software you use. And that's the what DoD is concerned about. And the report notes that DoD is damn dependent on FOSS:

The main conclusion of the analysis was that FOSS software plays a more critical role in the DoD than has generally been recognized. FOSS applications are most important in four broad areas: Infrastructure Support, Software Development, Security, and Research. One unexpected result was the degree to which Security depends on FOSS. Banning FOSS would remove certain types of infrastructure components (e.g., OpenBSD) that currently help support network security. It would also limit DoD access to and overall expertise in the use of powerful FOSS analysis and detection applications that hostile groups could use to help stage cyberattacks. Finally, it would remove the demonstrated ability of FOSS applications to be updated rapidly in response to new types of cyberattack. Taken together, these factors imply that banning FOSS would have immediate, broad, and strongly negative impacts on the ability of many sensitive and security- focused DoD groups to defend against cyberattacks.

I don't see where your disappointment comes up. The report shows that both OSS and FreeSoftware are the major players in DoD sectors (well I would be very admired if they wouldn't). Besides, it shows that all this FUD from M$ is a national danger to the US (and I would be HIGHLY admired if it wouldn't). Apart of some gaffes the report is superb.

Time to put Redmond on the rough nations list...

Re:Report makes no difference between OS and FS

[Anonymous Coward]

you are -1 silly, not +1 insightful....

The report also no makes no differentation between Open Source Software like FreeBSD, OpenBSD, and Apache; and Free Software which generally always refers to software under the GPL or LGPL. Like Linux, gcc, or GNATS.

you're repeating a distinction which is usually made only for the purposes of criticizing the GPL. All the software you mentioned is Free Software. It all grants you the certain vital rights, such as the right to copy and the right to inspect and change. to repeat.. there is no distinction to be made. some of them are GPL-incompatible, and many are not copyleft ("viral") but this is not important for this paper.

also, from a user's point of view, this is mostly irrelevant. the "license wars" are between developers. to users, they grant the same freedoms.

finally, from the distant and unpleasant vantage point of most proprietary software, the gpl/non-gpl are pretty much identical. really, for most people, being able to copy the software at will is mind-boggling. "how do they make money", etc.

He call's things under a BSD license with no cost, and no restriction on rights, freeware.

No, he points out the distinction that "zero-cost software" which DOESN'T grant you the FOSS rights is NOT FOSS! This is an important and subtle distinction, because it's not just about price, but freedom to do certain things. I'm impressed by their understanding. I think you misread it.

While in the next setence pushing the view that all OSS is GPL'ed.

no, it just says that they are very similar, and they both came from Stallman's ideas. which is still correct. open source is weaker form of free software, but usually they grant you the same basic rights.

For the purposes of this document, it is completely correct and appropriate to mix OSS and FS together, and to concentrate on freedom rather than price.

i think the document is peachy keen, and it gives me a fat chubby.

Re:PDF?

[Sivar]

If you actually tried to open up any but the most basic Word document in Wordpad, it butchers the document. Try it.
However, that's beside the point. You see, not everyone runs Windows, and not everyone wants to open a document that can come with little extras like macro virii.

Further, .PDF documents are extremely common. Get used to it. If you really can't stand to have to download extra software to view such a common format, you'll be happy to know that most Linux distributions come with at least one .PDF viewer.

Not that the parent wasn't a troll or anything...

Re:PDF?

[Sivar]

whatever happened to good old ASCII or ISO text files?
The PDF document contains images, tables, colors, and underlined/italicized/bold text. Those are rather difficult to express in plain ASCII text.
Doing so is not unlike trying to write a voxel-based graphics engine in HTML.

Right tool for the job...

COE (now NCES) will support Linux

[Anonymous Coward]

I work in the trenches so-to-speak.

The good news is that the DoD is paying attention to Linux in a big way. Undoubtedly, Solaris, HP, and SGI were among a few of the favorite big ticket items that the DoD likes to purchase. However, there is a small number of people who are using linux. We're expecting that number to grow.

Mitre gets it -- they're pretty smart folks. But does the rank-and-file military? By and large -- no -- although there's more currently than say 18 months ago. Some are still caught of in the security problems linux has. Others are just ignorant by calling it "freeware" -- when linux really rises to a level above the typical "freeware" moniker.

The military is really a bargain buyer -- yes they don't want those M16's to explode -- but they don't want to be bled dry for a shoddy system, either. Especially when they have to report to a congressional subcomittee explaining why they blew billions of taxpayer dollars on incompatible systems.

Re:PDF?

[zulux]

whatever happened to good old ASCII or ISO text files? nothing says cross-platform than an ISO format

Oh sure, leave out us EBCDIC users, you young whipper-snappers with your fanch-schmancy ISO standards. HA! ...I'll just go back to my Forth system and cry.

price for this report...

[u19925]

The BSA has asked MITRE to conduct internal software audit or pay 10 Million dollars.

The DoD has been asked to conduct internal software audit or trash MITRE report on FOSS.

Re:Open source, eh?

[wcbarksdale]

1. Somehow I doubt that the DoD -- or anywhere that security is really important -- throws together code and puts it into production right away. (Who hasn't heard the stories about the draconian code review policies?)
2. Why would the DoD distribute their modified code? Perhaps they would send a patch to Apache or whatever if it was sufficiently general interest, but I suspect most of the modifications have to do with security policies particular to them.
3. Do you really believe that "Al-Qaeda hackers" [sic] spend more person-hours looking at the code than non-malicious users?
4. Neglecting the silliness about Al-Qaeda, why should I trust you that "some computer science programs and IRC channels" are training highly dangerous black hats? Last I checked, IRC was the land of windows-running script kiddies, and typical computer science programs include perhaps one optional course on security.

They are not required to distribute it

[XNormal]

Even the GPL does not require anyone to distribute their customized in-house modifications.

I do hope that some employees who are exposed to open source, its benefits and the values of the community behind it contribute to open source projects in some way.

What if ...

[SgtChaireBourne]

It's interesting that the report starts out with a what-if scenario. "What if FOSS were banned in the DoD?" Answer - things would pretty much stop. FOSS has played and continues to play a critical role in the DOD.

A lot of people will begin to think about the converse, "What if Closed Source were banned from the DoD?" or even more specifically, "What if Closed Source from companies found guilty of breaking federal law were banned from the DoD?". I wouldn't be surprised if the answers were "not much change" and "things improve", respectively.

GNAT is part of GCC

[norwoodites]

yes that is right even though the paper makes it sound like GNAT is a separate project from GCC, they are now one, GCC (GNU Compiler Collection). Their description says they are one now but I think this description was copied from each of their web sites.

Also is not RTLinux longer consider free software, because it restricts more than the GPL due to patents?

Also looks like they do not use csh at all which is under the BSD license. or pdksh which is in public domain, they are the default shells on OpenBSD.

They are also missed Binutils from the GNU which is the assembler and linker for most open/free operating systems.

Also is there not versions of sed and make and m4 and top that are under the BSD license?

Is perl not dual licensed, GPL and artistic?

djbdns & qmail

[dasunt]

I'm not trying to torch anybody's favorite software here, but both djbdns and qmail have drawbacks.

The biggest issue is the license. Qmail is limited to source-code only distribution, with an exception being made for precompiled binaries if they behave exactly the same as qmail normally behaves. Information here. This means that if you want qmail not to throw all of its binaries under /var and ignore most of /etc for configuration files (which it normally does), you have to compile and patch it by yourself. Also, there is no distributing patched versions, so if D. J. Bernstein dies tomorrow, qmail development is effectively frozen until qmail passes into the public domain decades later. That includes any security/performance patches, as well as ports to other architectures. Djbdns has a similiar license.

There is also compatability. Djbdns does not support certain zone transfer mechanisms. It ignores some IETF standards entirely and impliments its own version instead. I get upset when Microsoft twists and corrupts public standards for its own ends, and I get upset when Bernstien does it as well. I'm lazy, I don't want to have to doublecheck if my DNS servers supports a certain standard if my cofiguration changes. Qmail is more of a quibble, I don't like how it throws everything in /var. (And I'm not sure why the world needs qmtp)

I'm not saying that a lot of people and smaller sites won't find qmail/djbdns (and the rest of Bernstein's software) useful. They seem to be secure, and they do their job as long as everything is compatible.

However, one of the reasons why I avoid proprietary software for many tasks is that I don't want to hitch my wagon to somebody else's horse. If I go with a MTA that is wildly used and is GPL or BSDl, I am assured that development does not rest solely on one person. And if I go with standards-compliant software, it ends up being less of a hassle in the long run.

Djbdns and Qmail aren't bad. But they have licenses that limit distribution and development, and they break interoperability.

Brilliant example of Microsoft

[magi]

The document is an enjoyment to read. It has a few pearls which are especially enlightening. One of these is a table illustrating the actual freedoms and restrictions placed by various licences, for example GPL and a Microsoft's MIT EULA:

Properties (a) through (e) in the table examine the ability of a license to co-exist with other types of software, e.g., the ability of FOSS licenses to co-exist with proprietary software. In this
category, the most exclusive license is easily the Microsoft MIT EULA license 1 , which prohibits a number of FLOSS licenses from co-existing on the same platform as the EULA software. No other FLOSS or proprietary license encountered during the survey came close to this level of exclusivity. The GPL takes a very distant second place for exclusivity, since it forbids design- time incorporation of GPL source code into non-GPL source code. However, unlike the Microsoft MIT EULA, the GPL places no constraints on software simply running on the same system, and actually goes out of its way not to intrude on other licenses outside of that context."

I didn't even know Microsoft has that restrictive license. It says here that it "Specifically bans use of: GPL, LGPL, Artistic, Perl, Mozilla, Netscape, Sun Community, and Sun Industry Standards."

Microsoft's site shows the license. It's really true. This particular EULA seems to be for a "Microsoft Mobile Internet Toolkit Beta 2". They actually call OSS as "Potentially Viral Software" in the license.

Re:Open source, eh?

[thelen]

Even on Slashdot the GPL is largely misunderstood. It principally dictates that if you redistribute the software you must also redistribute the source; it does not require that you redistribute the source in order to use the code yourself in whatever fashion you require. Your error is exactly the misunderstanding that MS capitalizes upon in describing the GPL as 'viral'.

Qmail: secure, but not responsible

[Black Copter Control]

Qmail's security is more theoretical than actual. From what I can tell, Bernstein wrote Qmail more to prove that he can design and write secure software than to provide a service to the public. He disclaims responsibility for problems that come from outside his source code.

If somebody finds a bug in, say Linux, that can be exploited against both Sendmail and Qmail, the Sendmail folk will fall all over themselves to find and distribute a workaround. Bernstein, on the other hand, will likely just smile and say "not qmail's fault". This doesn't do much good for people who are actually using qmail in the field and will need to create and distribute their own patches on the back-channels -- and then integrate them with the myriad of patches out there.

I really believe that Qmail's license was and is the biggest barrier to it's more widespread adoption.

Debian may not agree...

[Xtifr]

As a Debian Developer, allow me to strongly disagree. There is a lot of software in Debian! It's as reliable and trustworthy as we can make it, but a lot of stuff doesn't get banged on very heavily (some of it is downright obscure), and the best we can really say is, "we haven't found any obvious problems". Which is a whole world apart from "Generally Recognized As Safe."

Now, anything that's FOSS and GRAS is probably in Debian, but being in Debian stable is only evidence of being FOSS and NPU (Not Proven Unsafe).

I think that the idea of having an external list of FOSS/GRAS software is an excellent one. Moreover, I doubt if Debian wants to accept responsibility for maintaining such a list.

This is probably the reason for the MITRE report

[Mr. No Skills]

The DoD is under tremendous pressure to have Microsoft blessed as the only products they use, as Microsoft has learned how to lobby and started throwing lots of money at this. The government is a huge purchaser of systems, and there are many legacy things out there. Since the past 10 years or so have brought many fresh college grads into the workforce, many of whom only know Microsoft products, there is pressure on the technical selection folks to replace with Microsoft since those precious MCSE's only know these platforms.

This report is probably an effort to build some evidence and support on why wholesale replacement of everything with off the shelf would add costs and hurt national security. Probably also explains IBM's (and others) shift to support Linux and variants over the past few years as they saw Microsoft tactics refined.

And, Microsoft's more recent license agreement language seems pointed at providing a legal reason why they need to be the only platform, since there are no technical reasons.

Bio of the author

[benploni]

It was written by:

Terry Bollinger

The MITRE Corporation
1820 Dolley Madison Blvd.,
W534 McLean, VA, 22102, USA
terry@mitre.org

Terry Bollinger currently works at The MITRE Corporation, where he focuses on distributed software and hardware architectures issues for U.S. Department of Defense information infrastructures. He is an editor for IEEE Software, and was one of two Special Editors for the Jan/Feb 1999 issue of IEEE Software on Linux and open source software methods.

Terry has had extensive experience at all levels of software development in the telecommunications industry, at NASA, and for the U.S. Department of Defense. Especially while working in the telecommunications industry, he has had extensive hands-on experience with both a wide range of software construction methods and approaches, and with the consequenses of trying to apply some of these methods in "realistic" environments in which there is a typical spectrum of developer experience (e.g., what happens when C++ is applied in and environment consisting almost entirely of long-term funcional C programmers). Terry also has a strong background in software reusability and software process, including an IEEE Software Best Paper on why software process improvement doesn't always give the kinds of results advertised, and is intrigued by the issue of why some programmers seem to be so much better at producing high-quality, stable code that endures over time. In terms of software construction issues, he is both highly familiar with the overall set of techniques involved (including newer methods such a graphical component based programming), and is strongly supportive of the need for good methods while also being heathily skeptical about a lot of the claims made for various software construction methods and tools.

Terry has M.S. and B.S. degrees in Computer Science from the University of Missouri at Rolla, and has been a member of IEEE for 23 years.

especially slimey

[sacrilicious]

the Microsoft MIT EULA

What I find really distasteful is the above phrase's incorporation of "MIT". Microsoft tries to pass it off as standing for "Mobile Internet Toolkit", but personally I believe it was intended to sound like (and evoke the favorable sentiments associated with) the Massachusetts Institute of Technology AND the associated, like-named OSS license.

.