Slashdot Mirror


Defense Dept. Memo Explains Open Source Policy

TonyStanco writes "Big news. DoD issued a policy statement leveling the playing field for Open Source. We have the memo on the Center of Open Source & Government site." The requirements listed in this memo make me think of a company policy along the lines of "You can bring your baby or toddler to work, so long as it can talk, feed itself and stick effortlessly to the ceiling like a spider." See this PDF for more information about National Security Telecommunications and Information Systems Security Policy (NSTISSP) number 11.

97 of 387 comments (clear)

  1. OSSis not a toddler. by sould · · Score: 3, Insightful

    ....make me think of a company policy along the lines of "You can bring your baby or toddler to work, so long as it can talk, feed itself and stick effortlessly to the ceiling like a spider."

    Except it's not really like that is it?

    OSS is not a toddler - it's tends to be just as mature as proprietry equivilants.

    So it should be covered by similar guidlines.

    Which is all memo says really.

    1. Re:OSSis not a toddler. by iopha · · Score: 2, Funny

      Also known as the 'trainspotting' child policy.

      iopha

    2. Re:OSSis not a toddler. by zurab · · Score: 3, Insightful

      OSS is not a toddler - it's tends to be just as mature as proprietry equivilants.
      So it should be covered by similar guidlines.
      Which is all memo says really.


      Mostly. But I found couple of things that bothered me a little:

      "OSS refers to software that is copyrighted and distributed under a license that provides everyone the right to use, modify and redistribute the source code of software. Open source licenses impose certain obligations on users who exercise these rights." [Emphasis mine]

      This is not entirely true. Most open source licenses that I know of do not impose any obligations on *use* of the software (unless you consider warranty disclaimer as an obligation). These types of obligations usually come with proprietary software and licenses.

      "Certain restrictive open source licenses allow users to copy, modify and distribute software..." [Emphasis mine]

      "Restrictive" is a relative term. That's why I say, make all Open Source apps double-license - one Open Source license of choice, the other - binary only regular EULA with all its conditions. Let users choose which one they want. They will not call this software "restrictive", "cancerous" or any other names anymore.

    3. Re:OSSis not a toddler. by Anonymous Coward · · Score: 5, Insightful

      Yes and no... Yes, OSS should be just as mature and reliable as accepted propreitary equivalents, and that is partially what the guidelines are saying. No, OSS doesn't get to be used just because it is widely considered to be mature and reliable, and here's where the difficulty comes in.

      The referenced guidelines require that all Information Assurance applications MUST have gone through the NIAP certification process. This includes security scanners like nmap or nessus, lockdown tools like bastille, intrusion detection systems like Snort, and also (I think) any security-enabled applications like OpenSSH, or really anything OpenSSL-enabled like Apache, and even the operating systems that run them. With the current certification requirements, it is incumbent upon the vendor to pay to have a certified 3rd party testing group send the product through the testing. It is a lengthy, expensive, beauracracy-driven process. It is highly unlikely that any opensource project will have the time, money, or patience for dealing with it. Someone like RedHat or IBM would have to feel that it is in their best interests to throw away millions of dollars to prove that a given installation of a particular opensource application is acceptably, provably secure. Given the intense lobbying by Microsoft that happened when the NSA undertook the SE Linux project, and more importantly given that most managers have serious missions to accomplish that have nothing to do with software evaluations, it is highly unlikely that any government manager is going to put their budgets and careers on the line by having an opensource product put through evaluation.

      This situation does not just affect opensource projects, but also small businesses and vendors. It's unlikely that such organizations would have the resources to get this certification process completed. This game is clearly closed to only big and/or well-heeled vendors.

      For this reason, it is highly unlikely that officially blessed opensource products will ever enter an environment with even marginal security requirements. Until the beaucractic process for evaluation changes significantly, the current situation is decidedly biased against opensource, as well as small businesses and vendors.

      All this being said, while DoD has fairness as a goal in its procurement processes, safeguarding the lives of its servicemen and servicewomen is the top priority, even if that means a bias for or against certain classes of organizations. Whether there is an effective way of making this process more fair while keeping things secure, whether the benefits of the system outweigh the detriments, or whether the process as it exists now is doing an effective job in passing products that are secure in the real world and not just on paper, is a question that I cannot answer.
      --

    4. Re:OSSis not a toddler. by TFloore · · Score: 5, Insightful

      I'll reply on some general topics here, because it's useful to understand what the regulations say and mean, as well as how they are interpretted.

      The regulations always say words to the effect of "a specific installation of a specific version of a specific software product (on a specific hardware configuration)". The parenthetical there is for some other security ratings.

      A good example of this is the C2 security rating. Microsoft spent some money getting Windows NT C2 rated. Specifically, they got a specific patch level of a specific service pack of Windows NT v3.51 approved as C2 certified, on a specific set of hardware (with no floppy, I think) in a non-networked configuration.

      No one paid any attention to those little details. They just saw "Windows NT is C2 rated" and used that for purchase decision approval for every Windows NT/2000 system the DoD has bought since then. Because the "bureaucratic process" doesn't know enough about computers to know what the ratings mean, or what they apply to, or where they don't apply.

      The same will be done with this. "The NSA certified Linux for secure operation" will be enough, with supporting documentation to state that. Doesn't matter that it is for a different version of linux than your current procurement, it will still get it through the acceptance process.

      Government regulations are only meant to be an overwhelming burden for those people silly enough to think you are actually supposed to comply with them fully. No one that has worked with government procurements for more than 3 months still believes that.

      --
      This is my sig. There are many like it but this one is... Oops. Frank, I've got your sig again! Where's mine?
  2. Justification.... by mao+che+minh · · Score: 5, Informative
    Well, the possible use of any commodity that may be used by the government (especially by the military) is always pitched in a structured and lengthy write-up that examines all aspects of the commodity and it's probable uses.

    Oh wait, everything but the use of Microsoft products that is. It seems like that gets instant approval without the need for any justification. "Microsoft released Windows XP? OK, upgrade, forget about the costs and everything else that such an upgrade demands - just do it - across the board. Office XP you say? OK, allocate $10,000,000 for the software, we'll worry about paying for the licenses later."

    Everyone knows that the benefits of using open source products far exceeds any benefits that can be reaped by paying a whole bunch of money for closed source products and their associated licenses (which are arguably always more extensive and restrictive then open source license schemes). Sure, paying $50,000,000 to upgrade your old NT servers to 2000 and your 98 desktops to either Windows 2000 or XP has it's benefits over spending $30,000,000 on Redhat and Star Office and the training. A bunch of sales people always say that such a move (upgrading Windows servers and clients and Office) has it's benefits. I just don't seem to see them. Maybe I'm too progressive, I don't know.

    PS: didn't get it...this time

    1. Re:Justification.... by Anonymous Coward · · Score: 5, Insightful

      Oh wait, everything but the use of Microsoft products that is. It seems like that gets instant approval without the need for any justification.

      Whatever ... 9 times out of 10, the least upgraded systems you will find will be in the government or DOD. There are thousands of little fiefdoms, all run by different little chiefs, and their IT structure is a mess.

      Sure, the nice high tech stuff is out in the field, but Joe Government is working off a 95 box hooked up to an NT network most likely, with 3270's into some ancient mainframe or some Sun system.

      This is where OSS can make a big impact. Shit, half the IT guys in the government are UNIX guys, where do you think they've been hiding? Right next to the Novell Guys. All of a sudden, thousands of "out of date" UNIX guys are competitive with linux, and they're bringing in new blood to supplement them, because many are close to retirement. All the while their outdated Win and proprietary UNIX systems are nearing EOL, with nary a vendor in sight.

      You couldn't get a better situation for FOSS in the government right now. Someone's gotta replace those big nasty mainframe's and NT 3.51 boxen. Some of us make a decent living doing it. :)

  3. It's a start by BWJones · · Score: 4, Interesting

    "You can bring your baby or toddler to work, so long as it can talk, feed itself and stick effortlessly to the ceiling like a spider.

    Well, hey. At least its a start. Previously, many DOD organizations and departments had an absolute policy on software/platform. In many places, especially sensitive installations, the policy was Solaris. In the last few years there has been an inexorable move toward Windows, despite the obvious problems. Other defense contractors have been moving in the same direction presumably to control costs by moving everything to one platform. However, most people are finding that this is not the best solution and they are allowing the installation/use/purchase of other systems including open source, Linux and OS X.

    --
    Visit Jonesblog and say hello.
  4. Eeep. Spider-babies by KU_Fletch · · Score: 5, Funny

    You can bring your baby or toddler to work, so long as it can talk, feed itself and stick effortlessly to the ceiling like a spider." Thanks for that, now everytime the AC comes out at work I'm going to expect an army of spider-babies to pop out and steal my printer.

    --
    It's not stupid. It's advanced.
    1. Re:Eeep. Spider-babies by Strike · · Score: 2, Informative

      Shouldn't that be "like a gecko " anyway?

  5. Explains Open Source Policy -- Excuse Me by Nom+du+Keyboard · · Score: 4, Funny
    Explains Open Source Policy

    Isn't that putting it a bit strongly?

    --
    "It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
  6. True Story... by craenor · · Score: 5, Funny

    What is bureaucracy?

    This guy wants to clean out a room in the Pentagon, stacked to the ceiling with boxes labeled, "non-essential documents". So he starts a study showing how much space they can save by ridding themselves of all of these useless documents.

    A few months later they complete this study, and send it up for a review. A board determines that this is a great idea and they can in fact save tons of space by ridding themselves of all of these documents, with one stipulation. They must make copies of all the documents for their records...

    Craenor

    1. Re:True Story... by mao+che+minh · · Score: 5, Funny
      I live in a military town, and hence know a lot of folks that work in the local military bases (from actual military personel to contractors to just plain non-affiliated civilians). I have heard many such stories.

      My favorate involves moving a set of offices (used by Naval training personel, my friend is an officer and IT worker in said office) from Windows 98 and 2000 to Redhat. Yes, it is happening in a few places withing the military. Anyways, the IT staff there has been utilizing Linux and BSD for years, and decided to write up a report to outline it's effectiveness and security so that they could obtain approval to use it for all of the desktops under their control. Needless to say, they got approval with the usual stipulations (such as: some workstations demand Windows for certain software that only runs on Win32, and emulation is not an option). But, the military wanted them to also keep on hand a collection of spare Windows 2000 workstations "just in case", because "Linux is not yet proven" - that was their honest answer (why they needed entire workstations and not just a collection of "ready to go" Ghost images was a point of laughter in itself). The total: 50 workstations for a network of 200 systems. The cost of paying for those workstations and then keeping them on hand, and then paying for the Win2k clients and licenses for the next year was nearly triple the cost of moving the existing workstations over to Redhat 7.x (which was the newest RH release at the time) and hiring outside training for whatever training they might need (which didn't involve a move to Open or Star Office, because they were planning on running Microsoft Office anyways).

      One of the people that "approved" the move was father-in-law for a local Microsoft sales person. Sure the plan got "approval" due to it's merits, but the contigency plan effectively killed the move.

  7. Not the same memo by sould · · Score: 4, Informative

    Sorry.

    That document you linked to is dated Janurary, 2000, not may 2003.

    It also does not mention the GPL.

    1. Re:Not the same memo by Repton · · Score: 4, Funny

      The PDF linked from the article is also dated Jan 2000, and also doesn't mention the GPL ...

      <shrug>

      --
      Repton.
      They say that only an experienced wizard can do the tengu shuffle.
    2. Re:Not the same memo by fanatic · · Score: 5, Informative

      The dipshit that posted the article linked the wrong doc. Here is the right one: http://www.egovos.org/pdf/OSSinDoD.pdf

      --
      "that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
  8. Hum.. by JFMulder · · Score: 4, Funny

    and stick effortlessly to the ceiling like a spider
    Better start here then.

  9. I don't see the problem... by bethanie · · Score: 5, Funny

    My toddler can do all that. Can't yours?

    ....Bethanie....

  10. It's not that bad by Mahrin+Skel · · Score: 4, Interesting
    The regulations cited are basically a bunch of qualification hoops that have to be jumped through before software is considered "Mil-Spec". The first outfit inside DoD to qualify a OSS package is going to have to *really* want it to fill out all that paperwork, but once it is done it should get a lot easier. Keep in mind, that doesn't mean it will get used for Top Secret or above work right away, some of those hoops are *not* pro forma. But once DoD starts using it, even for trivial things, there will be outfits that just need to satisfy *one* more requirement than has already been filled, and will find it worthwhile to take it the next step.

    Best first bet would be it will slip in from DARPA. They've probably *already* been using it in places they're technically supposed to be using a commercial UNIX.

    --Dave

  11. Maybe time to change attitude a bit by bstadil · · Score: 5, Insightful
    Perfectly legitimate memo as far as I can see. I fact it makes a very good point that FOOS is a previledge not a right. Priviledges comes with attachments and can be revoked. This memo only states that DoD will play by the rules.

    I think the FOOS community notably the ones (like me) that do not write code but tries to get FOOS into the corporations, increasingly need to stress the fact that it comes with strings attached and that the corporations need to make sure that those strings is being honored.

    --
    Help fight continental drift.
    1. Re:Maybe time to change attitude a bit by Anonymous Coward · · Score: 2, Interesting
      increasingly need to stress the fact that it comes with strings attached and that the corporations need to make sure that those strings is being honored.

      I'd say that's so important as to be essential. That can lessen the "buyer's remorse" if a company discovers it can't do something it wants to down the road and, more importantly, focuses the consumers' minds on the idea that there are different kinds of licenses. That seemingly simple concept can be a huge revelation to someone who has only dealt with proprietary software or has only a vague idea like "Linux is free and hard to use."

      It also perhaps gives developers pause to consider different types of licenses. Perhaps the GPL is not a good "default" license (I personally think the BSD and LGPL are better for commercial entities -- I realize I can be debated on that subject). Perhaps it is. Still, even developers should think about what license is best for their software. And it'd be nice if the software didn't dictate that to them...

  12. Re:Gawd. If code were written that way . . . by sould · · Score: 5, Informative

    Gawd!

    It aint that hard.

    Basically:

    1) It defines OSS & GPL

    2) Says they're OK to use provided:
    a) They comply with the same Dod policies for equivilant Off the Shelf software
    b) They're comply with the requirements defined by the National Security Telecommunications and Information Systems Secuirty policy.
    c) They're configured as per DoD approved security configurations from http://iase.disa.mil and http://www.nsa.gov.
    d) You dont break any licenses.

    Thats all!

  13. So Basically... by snipingkills · · Score: 2, Interesting

    So basically this policy says that if you use OSS then you have to follow the licensing that went with it. What happens if it was sensitive code and it could be detrimental(sp?) if you released the source? Do you still have to do it or is that an exception in the GPL?

    1. Re:So Basically... by cyt0plas · · Score: 2, Informative

      The GPL basically says (oversimplicification, oh well) that if you distribute a binary copy to someone, you have to include the source. First off, if it's so "top secret" that it cannot have the source given out, they probably won't give the binary out either. Secondly, if they keep it internally, it's not "dissemminated", and as such, they are not bound by it either.

      The GPL is a copyright license, and as such covers only _distribution_ and posession, not use or output. They don't distribute it - they don't have to give out the source.

      --
      Contact Me (got tired of viruses emailing me).
    2. Re:So Basically... by diakka · · Score: 2, Insightful
      The GPL contains no "internal use" exception.
      There is no 'exception' needed since internal copying by a single entity is not considered to be distribution.

      Now if an employee takes the modified software home and installs it on his personal machine, he has violated his company's copyright. If his company allows him to install it on his personal machine, then they must license the modifications to him under the GPL.

      Simply using propriotary software installed on your company's computer doesn't mean you own a license. The same is true with GPL'd software. However in most cases, that same GPL'd software is available from multiple sources, so it's a non-issue.
      --
      -- Knowledge shared is power lost. -- Aleister Crowley
  14. Which in fact, means jack... by Ayanami+Rei · · Score: 4, Informative

    especially since OSS is often (and arguably most useful) used to augment existing systems, with no expectation of redistribution. It is up to the project managers to make a product that delivers; forget about NSTISS or the GPL.

    And most COTS systems in use don't have the certs anyway, and no one gets in a tizzy. It's only if you wanted to hook it up to SIPRNET or something (and then it gets reviewed independantly anyway).

    This is just some stuff to make the guys funding the projects (Congress) feel better.

    --
    THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
    1. Re:Which in fact, means jack... by pe1rxq · · Score: 2

      As long as they don't distribute the bombs there is nothing to wory about... You only have to offer the source to the people you sell bombs to...

      Jeroen

      --
      Secure messaging: http://quickmsg.vreeken.net/
    2. Re:Which in fact, means jack... by Anonymous Coward · · Score: 4, Informative

      For the (34^e)*78368.22432 + Pi time, please get this through your thick skull: The GPL only applies IF YOU DISTRIBUTE THE SOFTWARE The DoD, NASA, NSA, your granny etc. can use GPL software until they have it comming out of their ears, but you have no right to see, smell, touch or taste even the tiniest scrap of it unless the person using that code legally distributes a binary to you. They do not have to make the source code publicly available so that anyone can download it, although anyone who has recieved a copy of the code can redistribute it as they wish.

      So unless the fucking missle flies through your window, the code has not been distributed to you. If that happens, you have bigger things to worry about than the god damn source.

      Now for fucks sake, go read the GPL and the FSF FAQ's about it, or shut the hell up.

    3. Re:Which in fact, means jack... by dbrutus · · Score: 2, Interesting

      no, no, that means that when we sell guidance systems to Israel with requirements that they get our approval before selling them on, the Israelis are bound to give the source code to the PRC when they next do an illegal technology transfer otherwise next time they're not only going to have to face congressional scrutiny but the wrath of Richard Stallman.

      God, I'm looking forward to a ME where Israel isn't the most open and democratic society so they'll get off their US subsidized, pampered butts and fix what ails them.

    4. Re:Which in fact, means jack... by dbrutus · · Score: 2, Interesting

      By this argument does Ford Motor company have to give you source code for their embedded computers running Linux? If so, that's really going to kick embedded Linux in the teeth if your appliance and motor vehicle vendors also have to become software distributors.

    5. Re:Which in fact, means jack... by ichimunki · · Score: 2, Insightful

      Let's see. First, if Ford is selling computers in cars, they are still selling computers. And if those computers contain software, then Ford is a software distributor. Second, you're telling me that in all the legal mess it takes to build cars, that it's too much of a hassle for Ford to post the source code to their embedded processors' software? They could conceivably put that code on a CD-ROM and put that in a pocket of your car's owners manual. This is not rocket science-- but it is a simple thing to do as part of the automotive engineering process.

      They could also easily post said source code to their web servers. Have you ever seen their web site? They are insanely well-done. They're a combination of your wildest tech fantasies about online shopping and the most over-produced TV commercials known to man.

      But hey, I'm sure Ford can't handle it. Never mind safety testing, emissions regulations, and all that hard stuff! Have you rebooted a Ford lately?

      --
      I do not have a signature
    6. Re:Which in fact, means jack... by mrmeval · · Score: 2, Insightful

      Their classifications override your copyright, besides as long as they don't sell or provide the binary to any other entity they don't have to provide the code and if they do provide the binary (if classified), the recipient has to have that particular classification rating.

      This can be of benefit if the code is GPL'd and a contractor or other business that can accept (is allowed) the binary+clearance, they (hopefully) get the code. Which can be a real life saver especially if getting an antique (much of military stuff is just that) working again.

      Probably though they'd just override the GPL and ship the binary only.

      --
      I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
  15. No problem by unsinged+int · · Score: 2, Insightful

    Provided they're electronic copies.

  16. Waivers by MonkeyBoyo · · Score: 3, Interesting
    How much do you want to bet that most acceptible software in the DoD is there because of waivers? In the NSTISSP link it says:
    (14) Waivers to this policy may be granted by the NSTISSC on a case-by-case basis. Requests for waivers, including a justification and explanatory details, shall be forwarded through the Director, National Security Agency (DIRNSA), ATTN: V1, who shall provide appropriate recommendations for NSTISSC consideration. Where time and circumstances may not allow for the full review and approval of the NSTISSC membership, the Chairman of the NSTISSC is authorized to approve waivers to this policy which may be necessary to support U.S. Government operations which are time-sensitive, or where U.S. lives may be at risk.
    1. Re:Waivers by Daniel+Dvorkin · · Score: 4, Funny
      or where U.S. lives may be at risk
      Which pretty much rules out the use of any Microsoft software for any US military application, anytime, anywhere ...
      --
      The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
  17. Navy/Marine Corp and the desktop by Camel+Pilot · · Score: 4, Interesting

    The Navy/Marine corp are launching a large scale contract (NMCI) that restricts all Navy IT to MS and MS solutions.

    This contract locks down the network to only NMCI managed systems (MS only). If there are existing systems that cannot run under windows than you have to apply for a "legacy system" exception and pay extra for no service.

    This one size fits all approach is short sighted and foolish. The upper echelon has yet to catch on that the network is the backbone or the infrastructure that enables an ever increasing plethora of monitoring systems, data acquisition and control systems, collabration and communication mechanisms, etc.

    As more and more devices become Web enabled the Navy has effectively locked itself out in the cold and crawled in bed with built in obsolesce - not to mentioned left itself vulnerable to an attack or virus that would spead like wild fire in a homogeneous network.

    1. Re:Navy/Marine Corp and the desktop by instantkarma1 · · Score: 5, Interesting

      Oh, how I love NMCI. We (a couple of consultants) won a gig with the Navy, developing a web application on Linux, MySQL & Apache. Got the go-ahead and started developing...Then, the big bad NMCI came along. In order to be NMCI compliant, we were forced to switch from MySQL to Oracle (to be fair, we were given the choice to use SQL Server....bah!). Ok, I can deal with that. I now get paid to learn Oracle. Cool. Then, after three months of development..."uh...we need you to switch to Windows. It's a NMCI thingy". Not a happy day. Anyway...to make a long story short, in order to be NMCI compliant (and not having the requirements up front), we have this monstrosity of a web application running on Win2000 with Perl, PHP, Oracle and Apache. Needless to say, there aren't too many people in that boat (whoa...a funny...navy..boat...oh nevermind).

      There really is no point to this posting, so mod me down. I'm just ranting and wanted to share an example of your tax dollars at work.

    2. Re:Navy/Marine Corp and the desktop by Camel+Pilot · · Score: 4, Informative

      Official NCMI information site

      The and another

      Bitching from a deckhand

      .. UNIX/Linux machines would connect as
      legacy servers...

    3. Re:Navy/Marine Corp and the desktop by Minna+Kirai · · Score: 2, Informative

      Try google.com someday. But here's a story on C-Net. Notice that the central contractor for this project is Ross Perot's company. (Here's another article which mentions different defense contractors doing the work, plus other big IT jobs)

    4. Re:Navy/Marine Corp and the desktop by Camel+Pilot · · Score: 4, Insightful

      No no Mod parent up

      I deal with this monster everyday and there is very little publicity about this contract. There needs to be more horror stories out in the press. NMCI forces MS on everything that touches that friggen network and all other Operating Systems are considered "legacy".

    5. Re:Navy/Marine Corp and the desktop by cvas · · Score: 2, Informative

      Welcome to this decade, EDS has not been associated with Ross Perot since 1986.

  18. another interesting link... by pb · · Score: 4, Interesting

    Use of Free and Open-Source Software (FOSS) in the U.S. Department of Defense -- This report documents the results of a short email-mediated study by The MITRE Corporation on the use of free and open-source software (FOSS) in the U.S. Department of Defense (DoD).

    --
    pb Reply or e-mail; don't vaguely moderate.
  19. What I'd like to know... by wfrp01 · · Score: 2, Insightful

    What I'd like to know is why does an organization that sets United States federal technology policy guidelines post their policies on the web by scanning a paper document into PDF format! So we can all see a facsimile of John P. Stenbit's signature?!

    --

    --Lawrence Lessig for Congress!
  20. Baby... Spider... What? by ryanvm · · Score: 5, Funny

    "You can bring your baby or toddler to work, so long as it can talk, feed itself and stick effortlessly to the ceiling like a spider."

    Hi Timothy, we'd like to make you an honorary member of our organization - PIFCA (People Incapable of Forming Cogent Analogies).

    You belong with us like a marmot is comfortable with peanut butter.

    1. Re:Baby... Spider... What? by stefanlasiewski · · Score: 2

      I bet Timothy was responsible for the "Barrel of Attack Elephants" code at the top of the homepage.

      I mean "Team of Stealth Rabbits".

      Er, I mean "Barrel of Orange Midgets"

      Or wait, maybe I mean "Group of Albino Chickens"... ...

      Shit, I'm lost.

      --
      "Can of worms? The can is open... the worms are everywhere."
  21. hmmm... by brkello · · Score: 5, Insightful

    "You can bring your baby or toddler to work, so long as it can talk, feed itself and stick effortlessly to the ceiling like a spider."

    I work for the government, so maybe I am more used to seeing security requirements for everything, but I didn't get that impression at all. We expect everything to talk, feed itself, and stick effortlessly to the ceiling all the while being secure. The government (DoD, DoE, etc) is probably one of the biggest users and innovaters of open source so I wouldn't get too feisty. The only reason people (managers) get a little hesitant about Open Source is blame. When something drops on the floor, they want someone to point the finger at, someone we have a contract with so that they can fix it reducing personal liability. Enter Microsoft with contracts in hand.

    --
    Support a great indie game: http://www.abaddon360.com
    1. Re:hmmm... by Malcontent · · Score: 4, Insightful

      "Enter Microsoft with contracts in hand."

      I am very serious in asking this.

      1) Does microsoft offer guarantees to the military. for example do they guarantee uptimes or security. Do their contracts stipulate that Microsoft is liable for defects in their software.

      2) Do the contracts that MS sign specify that MS will always fix the problem if things go wrong. Do they guarantee it?

      It would be interesting if MS offered such contracts to the military because in the commercial world their contracts disavow any kind of liability.

      --

      War is necrophilia.

    2. Re:hmmm... by Alsee · · Score: 2, Insightful

      When something drops on the floor, they want someone to point the finger at, someone we have a contract with so that they can fix it reducing personal liability. Enter Microsoft with contracts in hand.

      Yep. And that contract says when something drops on the floor don't try pointing that finger at us or we'll bite it off.

      -

      --
      - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
    3. Re:hmmm... by gbjbaanb · · Score: 4, Informative

      I don't know about 1) but my last company, we had a bug, and a nice support contract with MS, this bug turned into something pretty major for us, and MS stepped in and had developers working 9-5 to find and fix it.

      Apparently if the bug hadn't been fixed in a week, it'd have been escalted into a 'class A' bug and Ballmer or Gates would have been informed, and the developers would have started working round the clock.

      (it turns out our CTOs code was at fault, the duffer).

      I was surprised at the response from MS though. I think we had paid a fair bit to MS for the support, though knowing the guys in charge they persuaded MS that it was a strategic relationship and subject to a special discount.

      Oh, we also had a MS employee assigned to us as a support contact - not just a secretary-type either, someone who knew his stuff and could actually do things for us, including helping us with the MS performance lab we got to use.

    4. Re:hmmm... by Quila · · Score: 2, Informative

      I've never been in on any extremely large-scale MS buys but:

      1) I've never seen any guarantees of uptime.
      2) I've never seen anything other than standard corporate-style support, but I've never even seen that being used. All problems are handled by the in-house help desk people (who may be non-Microsoft contractors), who may go to TechNet for answers.

    5. Re:hmmm... by PhxBlue · · Score: 2, Interesting

      To the best of my knowledge as a US Military employee: No, and no. If Microsoft software breaks, it's up to the people in our Network Operations Centers to fix it. I'd imagine the government gets a good discount in support costs, though. . . and probably has more than a couple Microsoft employees on contract to boot.

      --
      !#@%*)anks for hanging up the phone, dear.
    6. Re:hmmm... by Eminence · · Score: 2, Interesting

      Do you seriously think they do provide any guarantees?

      In the corporate mentality (and government is the worst case of it) it is not important what is in the contract. What counts is the simple fact that there is an external entity (i.e. Microsoft) you can point finger on should something go wrong. As opposed to the situation, when there is no external entity, no contract and someone has to admit that it was they (or their subordinate) who screwed up something. Corporate mentality is about keeping safe within the structure with minimum effort - not about doing something.

      I think that is one of the driving forces of outsourcing (apart from the issue of cost savings).

    7. Re:hmmm... by gbjbaanb · · Score: 2, Interesting

      we were a middling sized company - about 400 people. The CTO was supposed to do CTO type stuff, but he preferred to tinker with the code - we had to make the new product perform better, and for him, that meant the opportunity to fiddle with very low level OS features.

      The company is called AIT - listed on LSE, it all collapsed when the directors were caught effectively fiddling the accounts.

  22. Re:Contracs by mao+che+minh · · Score: 5, Insightful
    A service contract with Microsoft doesn't usually include accountability. That is a stance that Microsft usually takes very strongly: "we are not accountable" - it's "as is". "Prove that it is our fault". Besides, major Linux vendors offer the same exact type of contract that you are talking about, because that is one of their core areas of specialization: support and services, not licenses and upgrades. It's a moot point for a number of reasons, really, but a good one to bring up in this topic nonetheless.

    True, the core Linux maintainers could die or quit at any time. So could a software company drop a given application or operating system. For example, my company used a CRM called Vantive that was vastly superior in terms of ease of use and custimozation compared to PeopleSoft 8. We have in-house programmers that are very adept at coding for it. But PeopleSoft bought Vantive and dis-continued it. A few bugs sprang up that required access to certain source code that we didn't have. The answer? Pay 2 million (absolutely no exagueration) for People Soft 8 and go through the process of buying better servers and changing the structure of your Oracle databases "if you need future support for a PeopleSoft CRM". And yes, we had a service contract.

    But the beauty of open source insures that others will pick up where they left off. It happens with alomst every popular and useful open source project whose lead developers quit. In the case of Linux, you would have people from companies like Redhat, Suse, and IBM ready to take the lead. The costs of such a change of "power" is rarely passed on to the consumer. Also, the really good analysts do,/i> factor in the cost of hiring contractors to specialize your code.

  23. Re:Contracs by E_elven · · Score: 5, Insightful
    OSS? Linus and software maintainers could stop development at any moment, and a contract with Redhat isn't going to change that.


    I don't think you understand how OSS works. See, if Linus&Co decide to stop whatever they're doing and go live fat and happy in Silicon Valley or somewhere, 'we' still have the code. Anyone can take it and continue the development -worst case scenario, they can't call it 'Linux' anymore. However, if Microsoft says 'well, that's all, folks! We'll start selling beach balls from now on!', there's not a single thing anyone can do about it. And no one can continue the development of those systems.

    E
    --
    Marxist evolution is just N generations away!
  24. In other news: by zakezuke · · Score: 3, Funny

    You can bring your baby or toddler to work, so long as it can talk, feed itself and stick effortlessly to the ceiling like a spider."

    In other news, Safeco has been reported to have replaced all their acustic cieling material with velco in order that their company wide pre-toddler policy can be implemented. In order to prevent possible liability, they had to replace their traditional furnature with what can only be described as a rubber room.

    When asked about the subject, representatives of Safeco were unavailable for comment, but issued the following statement, "we are cleaning baby vomit out of our clothing".

    According to one district manager, "I can't tell if productivity is up or down, i'm stuck. Help!".

    --
    There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
  25. Re:Contracs by Jason+Earl · · Score: 4, Insightful

    Oh please, no one has ever sued Microsoft for lack of "service," and it is not because Microsoft products are perfect either.

    Not only that, but Microsoft has done just about every other unfriendly thing that a software vendor can do. They have stopped development of projects, created spurious incompatibilities, and sold bugs as "features." If the government paid IBM (or RedHat or whomever) half of what they currently spend on Microsoft software they could almost certainly get a real service contract for a huge pile of Free Software, and if they didn't like the service they got, they could take that money next year and hire someone else without having to switch software.

    I agree that there are costs to switching to Free Software, and I definitely agree that Free Software can't currently fill everyone's computer needs, but your arguments against Linux amount to nothing more than FUD. There are plenty of valid reasons for not choosing Linux. However, service, support, and longterm viability are all parameters that favor Linux.

  26. Re:Contracs by Sancho · · Score: 2, Insightful

    A service contract with Microsoft doesn't usually include accountability.

    And that doesn't necessarily preclude a successful lawsuit, should the government choose to persue it. If a root exploit were discovered and widely used, and it affected government servers, and Microsoft chose not to do anything about it, I suspect they would be sued and the US would win.

    True, the core Linux maintainers could die or quit at any time. So could a software company drop a given application or operating system.

    But not for the duration of the service contract or, again, there would be repercussions. While this is part of the way Microsoft controls the market, it is also a guarantee of service. If the OSS developer drops the project, there is no guarantee that anyone will pick it back up. It may be likely, but that's not good enough for many officials. Without something in writing, there's no real security in your purchase/training.

    Skipping around:
    And yes, we had a service contract.

    Sounds like your legal department didn't do their job. Either the contract had some holes or PeopleSoft should have had their asses sued off.

  27. useful link by Anonymous Coward · · Score: 2, Informative

    link to ACTUAL pdf that we're discussing, not the second one referenced by the headline...

    http://www.egovos.org/pdf/OSSinDoD.pdf

  28. You're first assumption was right, sort of by mao+che+minh · · Score: 4, Insightful
    Our service contract was with Vantive, not PeopleSoft. Our lawyers dropped the ball because they didn't plan ahead and leave room in the contract for a scenario of another company buying them out. This is an issue with closed source.

    If the software was GPL, it wouldn't matter how the contract was structured, because our programmers could have fixed the code. Instead, 2 million bucks was spent.

    And PeopleSoft is not liable or accountable, because all they did was gain ownership of the closed code. The agreement of assurance was specifically with Vantive. We didnt' buy the patented works itself (which wasn't an option, and People Soft refused to sell Vantive after-the-fact).

    As a side note, PeopleSoft 8 is laughable. I could design a better tool using PHP-Nuke (I actually hacked up a solution that was based on PHP-nuke for real simple CRM fucntions to show that it could be done - it was ignored, of course).

    1. Re:You're first assumption was right, sort of by Phroggy · · Score: 2, Insightful

      2 million buys quite a few programmers :)

      I think somehow the beancounters make it look better to buy something for $2 million than to increase headcount by a dozen people. I'll never understand how that works.

      --
      $x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
      $x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
  29. Re:Contracs by sleeper0 · · Score: 5, Insightful

    yeah, this is the point. There is the same amount of risk or greater with closed source projects. Do you think the DOD has never used a piece of software the creator discontinued? Or went out of business? To protect against that I am sure they always manage to get the source code up front (to say nothing of the security issues that require them to get closed source)... In either case if something bad happens the dod can maintain their own systems, open source would just take a step out of the contract negotiations that allow that.

  30. Re:Questions: OSS and Dod? by wayne606 · · Score: 4, Insightful

    Right, then somebody implements a bad encryption scheme and because it's closed source nobody sees it and breaks it, and the DoD or other users fool themselves into thinking it's secure, until a foreign government breaks it and reads all our coded communications for years... (Or whatever it is that these people are afraid of). I'd much rather trust something like PGP that everybody can read and understand and crackers (black and white hatted) can do their worst at. Otherwise you are just buying a false set of security.

  31. Re:Contracs by Jason+Earl · · Score: 2, Interesting

    I agree with you 100%. Heck, I will even go so far as to say that in many cases replacing proprietary software with Free Software is a loser over the long term. There are plenty of commercial software systems that are good deals, and there are Free Software systems that do not measure up.

    However, the second the commercial software folks start talking about accountability (especially with regards to Microsoft) I can't help but cry foul. Microsoft sells their software "as is" they are not remotely liable for their software, and if you want a decent service contract you have to purchase one on top of your licensing agreement, and you probably have to get the contract from someone besides Microsoft. Purchasing a commercial contract is also no guarantee that the software in question will be developed in the future. The company I work for currently is in the middle of a JD Edwards ERP installation, and today PeopleSoft announced they will be purchasing JD Edwards.

    What do you bet that future JD Edwards "upgrades" will involve paying huge money for a completely different product?

    Like I said, there are plenty of hidden costs associated with switching to Free Software. However, service, support, and longterm viability of your software all play into the hands of Free Software adoptees.

  32. Earth Governments Are Fools by earthisfun · · Score: 3, Funny

    Why bother with OSS when you can simply pay $30,000 per Microsoft license? They paid that much for a toilet, they might as well pay that much more for something to flush down it!

    1. Re:Earth Governments Are Fools by petecarlson · · Score: 4, Informative

      It wasn'ta toilet, it was a toilet seat. The seats in question were for C-130 aircraft and had to meet a shitload of specs. I woked for the company that made them (Middle River Aircraft Systems)and saw the specs for them. Quit inane, as many aircraft specs are..

    2. Re:Earth Governments Are Fools by nathanh · · Score: 2, Insightful
      They paid that much for a toilet

      If you had a toilet that had to survive 1000 bums per day in a saltwater environment with no spares or repair shops for 5000 miles in all directions (this was a toilet on a SHIP) then you might expect to pay more than the HomeSpot $100 special.

    3. Re:Earth Governments Are Fools by YrWrstNtmr · · Score: 3, Insightful

      Quit inane, as many aircraft specs are

      If you've ever tried to take a dump on a C-130 in flight, going through a thunderstorm, after a 60 day deployment to a tent in Turkey, when your entire digestive tract is in full rebellion...you'd be damn glad that the toilet is designed properly.

  33. Re:Gawd. If code were written that way . . . by BuckaBooBob · · Score: 2, Insightful

    So Basicaly.. It needs to fit thier needs :) How else would you eval something :) Can't Imagine any IT manager giving a go ahead on a product that doesn't hold up to the current min standards. :)

    --
    Who needs WiFi when we can have Packet Over Sheep! http://datacomm.org/PoS-InternetDraft.txt
  34. Re:Contracs by 73939133 · · Score: 5, Insightful

    If a root exploit were discovered and widely used, and it affected government servers, and Microsoft chose not to do anything about it, I suspect they would be sued and the US would win.

    You are kidding, right? Windows is full of holes, and many of have been around for years by the time people get around to using them for break-ins, including into government computers. I don't know whether the US government could, in theory, win, but in practice, they don't seem to be sueing.

    If the OSS developer drops the project, there is no guarantee that anyone will pick it back up. It may be likely, but that's not good enough for many officials. Without something in writing, there's no real security in your purchase/training.

    Microsoft drops products constantly. And when Microsoft does that, you are completely stuck because nobody can pick up the software.

    Perhaps what's confusing you is that Microsoft refers to many different, incompatible products using the same trademark. But that doesn't do you any good when your programs stop running.

    The reality of it all is that if you buy Microsoft, not only do you have to put up with buggy software, but you get no guarantees, you have to expect security holes and accept the risk for them yourself, you can't fix anything, and the software likely has a much shorter usable life than comparable open source software.

  35. This is a good thing. by cyt0plas · · Score: 5, Insightful

    Having a policy that OSS must compare favorably with Non-OSS is reasonable, and a good sign. Any policy other than "No OSS" is a good sign, as it shows they are considering it. I would say that OSS's biggest worry is simply not being noticed, not just failing to measure up. After all, most Open Source projects simply don't have the advertising budget their Closed-Source, Commercial competitors do.

    --
    Contact Me (got tired of viruses emailing me).
  36. Re:Questions: OSS and Dod? by wayne606 · · Score: 2, Interesting

    The buzzword for what you're talking about is Security Through Obscurity. The problem is that it will keep away the casual hackers and script kiddies so you will have many fewer attacks, but to a determined attacker (think of Bletchly Park in WW2 attacking the Enigma) if there are any weaknesses, they will most likely be found and you will not know about it until it's too late. The KGB (or whatever the enemy is these days) doesn't brag about their exploits on IRC.

  37. Re:Questions: OSS and Dod? by Minna+Kirai · · Score: 4, Interesting

    I would NOT be offended if goverment agencies decided to use undocumented closed source protocals

    I wouldn't be offended- I'd be scared. The rule of thumb is that "Security through obscurity is no security at all", but realistically, it's good enough for some situations where there aren't large numbers of dedicated, well-fianced enemy spies. That is, anyplace other than National Security can get away with it for a while.

    It is critical that, if a software developer who knows the code defects, we can simply change everyone's password and not junk the entire system until the program can be re-written from scratch. But that's what relying on closed-source for security would require.

    Hell if they want to write their propriority software in ADA, more power too them.

    The US government doesn't write proprietary software. Or anything else proprietary for that matter- all their intellectual works are public domain. Some of them are protected under security classification, like the way Air Force bases belong to the public, but they're not allowed inside without permission.

    (And, a Top-Secret classification will expire long before copyrights do...)

  38. Be careful about Tony Stanco. by Anonymous Coward · · Score: 3, Insightful

    Be careful about Tony Stanco, the person who wrote the Slashdot story. He seems to be using computer issues as a way of promoting himself.

  39. Erm... by KrispyKringle · · Score: 2, Insightful
    In defense of timothy, I may as well point out that his statement was clearly not a comparison of OSS and toddlers. I don't think there was any opinion, either expressed or implied, metaphorically comparing Open Source Software with young, as-yet undeveloped children.

    It was a joke about how strict the regulations were. Didn't you see the part about sticking to the ceiling like a spider? That's not normal human child behavior, hence, the stated regulations that would require such would be unreasonably stringent. Timothy was drawing a parallel to the stringent regulations regarding OSS.

    And who says geeks don't have a sense of humor?

  40. More conspiracy theories by Timesprout · · Score: 5, Insightful

    The requirements listed in this memo make me think of a company policy along the lines of "You can bring your baby or toddler to work, so long as it can talk, feed itself and stick effortlessly to the ceiling like a spider."

    How you can make this out from that memo which basically says we have a set of procedures in place for software evaluation, if OSS passes those then fine, no problem and secondly be aware of the terms of the license that the OSS comes under.

    I know this is Slashdot but the fact that OSS may have to go through a regular selection process instead of being mandated as defacto standard, to the detriment of all others is proper procedure in most large organisations. You should be saying well done for leveling the playing and giving OSS a chance to compete on equal terms.

    --
    Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
    What truth?
    There is no dupe
  41. The Bird Report by _Sprocket_ · · Score: 4, Funny
    Military culture has a lot of its own urban legends and stories. One of my favorites is The Bird Report (mainly because I've run in to this kind of situation several times in various gov't and private bureaucracies):

    A Sgt. had developed a habit of blowing off a few hours each day by checking out a GOV and driving a circuit around the outside of the flightline and along some of the base's back roads. To justify his routine (and provide additional entertainment), the Sgt. made an informal count of the base bird population as observed during his drive. On returning to the office, he would burn off some additional time typing out a Base Bird Population Report and sending it on to HQ.

    The routine continued for the better part of a year. The Sgt. did his rounds and made his submissions to whatever HQ blackhole the bogus report would end up. But eventually the whole scam lost its charm, the Sgt. lost his interest, and the Base Bird Population Report ended.

    Three months passed. The Sgt. had all but forgotten about the Bird Report until he received a memo from HQ. The memo informed him, rather tersely, that he was 3 months late on the Base Bird Population Report.

    It seems someone at HQ had created a job of filing the Bird Reports. What had started as a bogus exercise with no real reason had become a requirement.
  42. Security-wise... by INT+21h · · Score: 2, Insightful

    The thousands of little fiefdoms with differing systems is a good thing, as due to the diversity, what knocks out one system won't necessarily knock out the one next door. Mono-culture is always a bad idea security and stability-wise.

  43. What do they really have planned? by dethl · · Score: 4, Insightful

    Working as an intern for a national laboratory, I noticed how getting new equipment worked. First, you find what you really want, like a computer for instance. Next, in your proposal, you go around and find different parts for that machine, and make sure the stuff you really want is the lowest price. Send it up to the people who double check this to see if they are getting a "good" deal, and bam, you get your computer.

    With this in mind, what Linux or Unix OS are they planning on using already? They must have one picked out if they are going to start making rules on the OSS situation.

    --
    "Some fight for law. Some fight for justice. What will you fight for? One day, you will see."
  44. Re:Gawd. If code were written that way . . . by orangesquid · · Score: 3, Funny

    How else would you eval something :)

    Depending on the time period:
    "Is it IBM? If not, you're fired." or "Is it IBM? If so, you're fired."

    --
    --TheOrangeSquid Is it any wonder things seem so awry? We swim in a sea of confusion and don't have to think to survive
  45. Close, but not quite by Arker · · Score: 2, Interesting

    The GPL never requires you to post code to a public site. You only have to give it to people who recieve binaries.

    Right.

    When you distribute that application to fellow DoD employees, you have two choices.
    • 1. Give them unlimited permission to pass out copies to whomever they want. This is a violation of security clearance, and you could be prosecuted for treason.
    • 2. Forbid them from handing out copies to anyone. Doing this will violate the GPL, meaning you have broken copyright law by duplicating the software.

    Umm no. As long as it doesn't leave the DoD it's not 'distribution' under the terms of the license. You don't have to do shit.

    If you have trouble understanding the second point, imagine that I want to sell a modified Gimp (GPL program), and that I first require all customers to sign a promise that they won't hand out copies. Then I sell them the Gimp, along with the GPL, whose permission to re-distribute I claim has been overridden by the other promise. See how that doesn't work?

    Selling the program to outside customers and simply using it in-house are two entirely different situations though. See this entry in the GPL FAQ.

    The only difference between GPL and BSD in this context would be if the DoD had some reason to distribute the program in question to the public. As long as it's used exclusively in-house it doesn't matter at all.

    --
    =-=-=-=-=-=-=-=-=-=-=-=-=-=-
    Friends don't let friends enable ecmascript.
    1. Re:Close, but not quite by Minna+Kirai · · Score: 2, Interesting

      Umm no. As long as it doesn't leave the DoD it's not 'distribution' under the terms of the license. You don't have to do shit.

      Do you know how many employees the DoD has? More than 1 million.

      The word "distribution" means passing something out. Nobody can claim that giving a program to 1 million people spread around the world is not "distribution". The fact that all the recipients get paychecks from the same place means nothing.

      See this entry in the GPL FAQ.

      I've seen that entry in the FAQ. FAQs, however, have no legal weight. Only licenses do. What I don't see is anything in the text of the GPL itself to modify the definition of "distribution" to something other than in the English dictionary.

      Quoting from that FAQ:
      an organization can make a modified version and use it internally without ever releasing it outside the organization.

      It says the organization doesn't have to release to the public. It does not say the organization can forbid its members from releasing to the public. (In any group of a million users, at least a few will feel like uploading to USENET)

      If a boss can forbid his employees from redistributing a GPLed program based on the strength of the employment contract between them, or because they're in the same "organization", then commercial software vendors could evade the GPL by requiring their customers to sign onto shell corporations first. Obviously, that can't fly.

  46. Re:Contracs by Tony · · Score: 4, Insightful

    Without something in writing, there's no real security in your purchase/training.

    As mentioned in the parent, companies like Red Hat and Suse make their money from support contracts. Since their bread and butter is in these contracts, and not in selling upgrades, they are more likely to take an active role in fixing problems, instead of having a vested interest in propogating problems (leading to more upgrades).

    Microsoft has, in the past, refused to fix bugs in "older" software. In many circumstances, the solution is to "upgrade." In several cases, bugs deemed non-critical by MS have been left unfixed for months. In several other cases, the fixes to these bugs have caused even worse problems.

    I have yet to see a contract stipulating Microsoft promises to fix any problems discovered, let alone take resonsibility for any defects. Doesn't mean they don't exist; but, like invisible ephemeral unicorns, until I see one (or the effects of one), I don't believe in them.

    The concept of manufacturer liability in the software market is laughable. Schools can get sued for millions for choosing co-valedictorians, but Microsoft sure as hell isn't going to pay for the privacy-raping holes in Passport.

    Something is fucked up here.

    --
    Microsoft is to software what Budweiser is to beer.
  47. What difference would it make? by Gordonjcp · · Score: 4, Funny

    If you GPLed the software that controls your guided missiles, where are you going to get a platform to run it on? Meanwhile, perhaps some of the guidance algorithms could be modified into something useful to the general public. After all, they are *my* missiles too - my taxes paid for them.

    1. Re:What difference would it make? by gbjbaanb · · Score: 2, Funny

      Dear Mr Bush.
      thank you for disseminating the binaries to the missle guidance software to me via the onboard computer in the handily packaged LBU100 bomb which was delivered by US Military couriers today.

      I find, however, that you neglected to include the software to this device, especially the arming and control routines.
      Please deliver to me, within a reasonable time, said software as you are obliged to under the terms of the GPL, and I shall ensure that the delivery package is returned as soon as possible.

      yours Sincerely.
      O bin Laden (Mr.) :-)

    2. Re:What difference would it make? by spitzak · · Score: 4, Funny

      You only get the source if the executable is delivered to you. If the US government is delivering a missle to you you probably won't have much time or incentive to use that source code!

  48. dont forget DARPA funded openBSD for 20 months... by evil_one666 · · Score: 3, Interesting
    As covered in slashdot and elsewhere, openBSD was being funded for 20 months by DARPA (that shady branch of the US military who originally invented the internet). Funding was eventually pulled after pro-peace comments from the (canadian) project leader, Theo de Raadt, 4 months early. It also had something to do with the hackathon convention he organised... maybe, DARPA has not officially commented.

    openBSD is of course reputed to be the most secure open source operating system.

    I think that it seems a little weird that the US military is on the one hand acting very anti opensouce, while on the other- it is actively funding its development.

    Additionally, I have seen one or two "discovery channel" type documentaries in recent months that have filmed computer terminals inside US military installations. There was no doubt that the personnel were running Unix, although the exact flavour remained unclear- but could it be openBSD...?

  49. Re:Contracs by ssimpson · · Score: 5, Insightful

    With Microsoft, and under contract, you know that's going to happen.

    Sorry - no you don't. Microsoft have previously claimed that Windows NTv4 is being supported for security hotfixes until 30 Jun 04 (see here) but then failed to fix a serious RPC based DoS attack.

    I should imagine this pisses "secure" government sites off quite a bit - they have been promised security fixes for another year now and then get shafted because MS claim that NTv4 "does not support the changes that would be required to remove this vulnerability".

    At least with OSS users are capable of fixing the problem themselves (or paying for it, or using a general release patch etc).

    But there are hidden costs that you just don't always see.

    Yep - and what are the costs of upgrading all of the Windows NTv4 to Windows 2000 servers to avoid this security bug?

    --
    "Mary had a crypto key, she kept it in escrow, and everything that Mary said, the Feds were sure to know."
  50. "As-is" by SgtChaireBourne · · Score: 2, Interesting
    With Open Source and Free Software, if one provider drops support anyone can pick it up. When commercial providers go bankrupt, the code becomes part of the asets and tied up in the courts. The only way for Microsoft, or any other closed-source vendor, to beat the saftey advantages of F/OSS would be to put the code in escrow before they go bankrupt, which in the case of Microsoft seems to be a distinct possibility. Here's a taste:

    Even MS if survives the summer, they've already left Win95/98 behind and tried (or have) dropped NT. So, in regards to "who do you sue?" logic, read your license. MS-Windows could be chock full of remote exploits or send your personal data abroad or monitor your files and habits or break your third party applications and you'd have no recourse whatsoever -- except maybe upgrade to OS X/*BSD/Linux/QNX/etc.

    Nice of Timothy to set up a straw man

    --
    Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
  51. Re:most important reason not to use OSS license by PhxBlue · · Score: 4, Insightful

    Is that the DoD, the DoJ, dictator-of-the-week, and any other offensive military/rights-quashing group, can use your code, and you have no control over it.

    Bullshit. Or can you actually think of cases where the "military/rights-quashing group" uses a developer's code without their permission? I personally don't see a need for the military to jackboot someone else's code, since there're about 1500 military programmers in the US Air Force alone. That doesn't count civil service or contracted personnel working with or for the Air Force.

    And frankly, if you think people join the US Armed Forces because they want to "quash people's rights," you are sadly out-of-touch with reality. Military members swear an oath to defend the Constitution of the United States--it's an oath we don't take lightly. If you're not happy with the Iraq war, that's fine. . . neither am I. But blame the politicians you elected into office, who sent the troops in the first place.

    --
    !#@%*)anks for hanging up the phone, dear.
  52. Family Guy - Da Bomb episode by CGP314 · · Score: 4, Funny

    You can bring your baby or toddler to work, so long as it can talk, feed itself and stick effortlessly to the ceiling like a spider.

    Stewie?

  53. DOD and OSS by Advectium · · Score: 3, Insightful

    Look, The DoD uses Windows for shear monstrosity of the network users and their demographics. Average 18 year olds entering the military to Major Generals have used some form of windows. The same cannot be said of Linux or UNIX unless they were Technologically savvy /.ers. Colonel's would have a hell of a time learning Linux, trust me - they have a hard time with email. The tech savvy individuals will probably pursue some sort of computer related field in the military as well, where windows is most definitely not the answer as many pointed out. I.e. up time, security, etc. The military doesn't use windows, as an end all is all, especially for it's weapons systems. Case and point: I work as a USAF weather forecaster, our weather product dissemination uses a Silicon Graphics box dual booting Linux and WinNT via VMware. They sent me to school just to operate this stuff, as I had never used it in the past. One would find the majority of network *stuff* that matters to the DoD, not access to Yahoo, runs from something other than windows. Just my .02 cents

  54. Re:most important reason not to use OSS license by Entropius · · Score: 2

    The problem is that in this age, that oath has little to do with what the military is actually ordered to do. Iraq is just the largest and most recent example; we also have all the invasions in the Reagan years (Grenada, etc.) and the invasion of Panama. The treatment of prisoners at Guantanamo is directly counter to the spirit of the Constitution.

    Earlier, we have Vietnam and the Bay of Pigs operation as examples of non-defensive military excursions.

    Hell, in the 1800's we picked a war with Mexico for no other reason than to take land we wanted for the railroad.

    While it is indeed the politicians' fault, the US leadership has a history of such things--Iraq is not a shot in the dark, but the worst and most recent example of misuse of the military. I will never join the military simply because I can not trust the leadership of this country not to order me to do something unethical/unconstitutional.

    What ever happened to the Department of _Defense_?

  55. Re:Gawd. If code were written that way . . . by stanmann · · Score: 2, Informative

    You know, Despite the humor of your comment, and grand-parent, You still even today cannot go wrong buying IBM. You may pay too much, but in a corporate or other enterprise(government, military, educational, etc) IBM is around today, and will be around tommorrow. They support their hardware and any software they supply. They even still produce a version of PC Dos and support it. They also continue to provide support for the last version of OS/2 Warp.

    --
    Food not Bombs is a nice platitude but it breaks down when you notice that the Bombees are usually well fed
  56. Re:most important reason not to use OSS license by PhxBlue · · Score: 3, Informative

    Then why, pray tell, aren't the military (since I'm guessing they have the might) arresting Mr Ashcroft and several other members of the US Government elite? Why also are they not refusing to fight in Iraq?

    Because it's not our job to arrest Mr. Ashcroft for exercising the duties of his office - and because it would be a violation of the worst sort for the military to actively remove politicians from office just because what they're doing might not be constitutional. Interpretation of what is or is not constitutional is not up to us, it's up to the courts.

    As for Iraq - what was actually iillegal about the invasion? Congress authorized use of force in October 2002 and gave the President the money he asked for to fight the war in the 2003 budget. If Congress didn't want the war, all they had to do was refuse to pay for it.

    Oh that's right, it's an oath you don't take "lightly", but when the alternative is court martial, you were just following orders.

    If the President ordered the military to arrest members of Congress or the Supreme Court, you can bet that oath would come into play. But the military does not act based on what some Anonymous Coward thinks is unconstitutional. Hell, the US Military isn't even allowed to participate in domestic peacekeeping--Google for "Posse Comitatus Act," and contrast it with the military's active involvement in such nations as Pakistan and Turkey. Where would you rather live?

    --
    !#@%*)anks for hanging up the phone, dear.
  57. Re:Contracs by bobv-pillars-net · · Score: 2, Interesting

    Do you think the DOD has never used a piece of software the creator discontinued?

    Yup. Personal experience in that area. A suprisingly large amount of DOD software was written for Clipper Summer '87.

    To protect against that I am sure they always manage to get the source code up front (to say nothing of the security issues that require them to get closed source)


    BWAAAAHAAHAHAHAHAHAHA!!!!! (thunk!)

    (/me gets back on chair.)

    (sniffle!)

    Oh, that's RICH!

    You almost had me fooled for a minute there.
    --
    The Web is like Usenet, but
    the elephants are untrained.
  58. URLs blead them Re:Gawd. If code were written.... by mrmeval · · Score: 2, Informative

    BTW, code IS written that way...

    http://niap.nist.gov/cc-scheme/

    This web site has all of the various policy documents.

    DOD Directive #8500.1
    DOD Instruction #8500.2
    NSTISSP #11 Fact Sheet
    NIST Spec Pub 800-23
    NSD 42
    NSTISSAM Compusec/1-99
    USAF CIO Memorandum
    Natl IA Acquisition Policy
    Pres. Decision Directive 63
    Info. Assurance Reg 6-8510

    And more.

    --
    I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty