Slashdot Mirror
SUSE Linux Receives EAL3 Certification
prostoalex writes "Reporters from CNet News.com learned that SUSE Linux Enterprise Server received EAL3 certification, which allows it to compete with such certified operating systems as Windows (from Microsoft), Solaris (from Sun), HP-UX (from HP) and AIX (from IBM). Albeit all of the aforementioned OSs have EAL4 certification, Evaluation Assurance Level 3 allows SUSE Linux to be considered for a range of government and military tenders. Red Hat Linux is expected to receive EAL2 certification any time now."
By Tim Copperfield
New York, NY - GNAA (Gay Nigger Association of America) today announced acquisition of The SCO Group for $26.9 million in stock and $40 million in gay niggers.
GNAA today announced it has signed a definitive agreement to acquire the intellectual property and technology assets of The SCO Group, a leading provider of Fear, Uncertainty and Doubt, based in Lindon, Utah. GNAA's acquisition of SCO technology will help GNAA sign up more members worldwide. In addition to developing new solutions, GNAA will use SCO engineering expertise and technology to enhance the GNAA member services.
"I'd love to see these GNAA types slowly consumed by millions of swarming microbes and converted into harmless and useful biochemicals." said an anonymous slashdot poster, blinded by the GNAA success in achieving first post on a popular geek news website, slashdot.org.
"This GNAA shit is getting out of hand. Slashdot needs troll filters. Or better yet a crap flood mod that I can exclude from my browsing. Seriously, a good troll is art, what you dumb fucks are doing is just plain stupid." said spacecowboy420.
macewan, on linuxquestions said "Thanks for that link to the SCO quotes page. My guess is that they want to be bought out. Hrm, think they want GNAA to buy them??"
After careful consideration and debate, GNAA board of directors agreed to purchase 6,426,600 preferred shares and 113,102 common shares (the equivalent of 150,803 ADSs) of SCO, for an aggregate consideration of approximately US$26.9 million and approximately $40 million for gay niggers that were working in Lindon, Utah offices of The SCO Group.
If all goes well, the final decision is to be expected shortly, followed by transfer of most SCO niggers from their Lindon, UT offices to the GNAA Headquarters in New York.
About GNAA
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the first organization which
gathers GAY NIGGERS from all over America and abroad for one common goal - being GAY NIGGERS.
Are you GAY ?
Are you a NIGGER ?
Are you a GAY NIGGER ?
If you answered "Yes" to any of the above questions, then GNAA (GAY NIGGER ASSOCIATION OF AMERICA) might be exactly what you've been looking for!
Join GNAA (GAY NIGGER ASSOCIATION OF AMERICA) today, and enjoy all the benefits of being a full-time GNAA member.
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the fastest-growing GAY NIGGER community with THOUSANDS of members all over United States of America. You, too, can be a part of GNAA if you join today!
Why not? It's quick and easy - only 3 simple steps!
First, you have to obtain a copy of GAY NIGGERS FROM OUTER SPACE THE MOVIE and watch it.
Second, you need to succeed in posting a GNAA "first post" on slashdot.org, a popular "news for trolls" website
Third, you need to join the official GNAA irc channel #GNAA on EFNet, and apply for membership.
Talk to one of the ops or any of the other members in the channel to sign up today!
If you are having trouble locating #GNAA, the official GAY NIGGER ASSOCIATION OF AMERICA irc channel, you might be on a wrong irc network. The correct network is EFNet, and you can connect to irc.secsup.org or irc.isprime.com as one of the EFNet servers.
If you do not have an IRC client handy, you are free to use the GNAA Java IRC client by clicking here.
About
Certification. What's it all about? Is it good, or is it whack?
As a well-known expert in the field of cyber-security, I can tell you that certifications are very important.
If SUSE wants to be taken seriously, they need two things - they are going to need a C2 certification, and they need an audit of their source code by experts.
does that count?
You just can't take Linux seriously when its fronted by losers like these. Would you buy software from them? I don't think so! You Linux groupies need to find some sexy girls like her! I mean just look at this girl! Doesn't she excite you? I know this little hottie puts me in need of a cold shower! This guy looks like he is about to cream his pants standing next to such a fox. As you can see, no man can resist this sexy little minx. I mean are you telling me you wouldn't like to get your hands on this ass?!
With sexy chicks like the lovely Ceren you could have people queuing up to buy open source products. Could you really refuse to buy a copy of BSD if she told you to? Come on, you must admit she is better than an overweight penguin or a gay looking goat! Don't you wish you could get one of these? Personally I know I would give my right arm to get this close to such a divine beauty!
Join the campaign for more cute open source babes today!
Regardless of what Mr. Bush had to say last night (State of the Union), the current job market is still all that bright for techies. I'd like to know, with the growing list of certs for linux which ones are worth it? Are the RH Certs worth it anymore/or maybe more now becase they dropped desktop solutions. Has anyone seen employers activley asking for these kinds of certs as many do with MCSEs, CCIEs, etc...?
...you're only allowed to install a certain version of Windows 2000, with servicepacks up to a certain number, and one hotfix. No other servicepacks or hotfixes are allowed. Extremely ridiculous, especially when you have a look at how much software comes with SuSE (a lot!) and how much comes with Windows 2000 (virtually none!).
But I'm still waiting for a certificate for some SELinux version. Since EAL4 is the highest level where it's still feasible to build the demanded security into it, hardly any normal "customer" operating system will achieve a higher level. But SELinux has been designed for security since the very beginning, and should be able to reach at least EAL5.
A monkey is doing the real work for me.
SuSE/Novell couldn't have pulled this off without technology stolen from SCO. It's a known fact that SCO owns IP on everything that makes linux useful.
HOW'S MY POSTING? CALL 1-800-POSTING
wack!
Chris cuevassy wack!!!!!
If windows too can have this certification, it is clearly not very high standard. So, actually, this means *nothing*
If windows too can have this certification, it is clearly not very high standard. So, actually, this means *nothing*.
n/t
Evaluation assurance level 1 (EAL1) - functionally tested
EAL1 provides a basic level of assurance by an analysis of the security functions using a functional and interface specification and guidance documentation, to understand the security behaviour.
Evaluation assurance level 2 (EAL2) - structurally tested
EAL2 provides assurance by an analysis of the security functions, using a functional and interface specification, guidance documentation and the high-level design of the TOE, to understand the security behaviour.
Evaluation assurance level 3 (EAL3) - methodically tested and checked
EAL3 provides assurance by an analysis of the security functions, using a functional and interface specification, guidance documentation, and the high-level design of the TOE, to understand the security behaviour.
Evaluation assurance level 4 (EAL4) - methodically designed, tested, and reviewed
EAL4 provides assurance by an analysis of the security functions, using a functional and complete interface specification, guidance documentation, the high-level and low-level design of the TOE, and a subset of the implementation, to understand the security behaviour. Assurance is additionally gained through an informal model of the TOE security policy.
Soccer Goal Plans
Certificates like this are going to become a real problem for open source software. There's no way a small distribution could get a certificate that costs many thousands of dollars to buy. There's certainly no way a single user who makes changes to his or her kernel could ever hope to achieve this kind of certification.
Hence all the hard work of the kernel developers, who provide their services for free in many cases, cannot be directly recognised. Instead some huge corperation has to come along and sponsor such certification. This just isn't right, IMO.
There's a much bigger issue here though, a threat from the future called Digital Rights Management and NGSCB. Who wants an operating system that will be unable to access secure web services because Microsoft introduces a protocol that requires a DRM-aware application running on a DRM-booted computer? Open source GPL'd Linux will never be able to obtain such certificates without massive corperate sponsorship from IBM, Novell, Redhat or whoever.
Even if it does, changing one line in my kernel and recompiling would invalidate it, locking me out of my legally purchased music and movies, and even things like my e-mail eventually (we're already seeing this with the restrictions that a sender can put on an e-mail in Office 2003. Imagine when this is part of the operating system and not easily circumvented).
Bullshit efforts certification efforts like EAL and NGSCB undermine and threaten open source and play right in to the hands of the major corperations. In today's world, the most important corperation producing operating systems is, you've guessed it: Microsoft!
This sort of thing plays right in to their hands. They're undermining the free work of all the thousands of Linux and BSD developers effectively through the back door: by making open source software an unviable solution under the guise of security. Fuck them.
Am I corrent in assuming that this certificate has nothing to do with real security in a OS, but more to do with following some set guidlines created by some agency years ago about stuff like code review?
It would seem that documented flaws in an OS should automatically reduce the EAL rating of that OS. Otherwise the EAL process is just a paper-pushing exercise.
Two wrongs don't make a right, but three lefts do.
But just 1 year ago, weren't we criticizing Windows for achieving EAL 4:
So which is it, Slashdot? I'm confused.
Is EAL worthwhile or is it an "inadequate set of requirements"? Is EAL 4 worse than EAL 3?
Personally, I'm suspicious of most certifications, from business to security. Usually, they're just a way for the certifying company (in this case Common Criteria) to make easy money.
Anyway, maybe we should just wait for Eros, which is supposed to achieve EAL 7 when it is fully implemented, due to it's powerful and secure design, better than both Unix and Windows.
>>esr>>
H3RES UR JUSTIFICATION U LOUSY PEICE OF TROL SHIT!1!! WTF MAH DSL CONACTION AT HOMA SUKS AND TAHTS WHAR3 TEH BTA SERVER IS RUNNG1!!1!1 I GAEV OUT TEH SIET 2 125 P3OPLE WHO AMALEED ME ASKED ME FOR DA SIET SO TAHT IT DIDNT DEI11!!!!1
NOW U D3CIEDD 2 B A FUKNG FLMNG ASHOLA AND POST DA SIET 3VERYWH3R3 CAUSNG SIGNIFACNT PROBLAMS WIT MAH DSL AT HOME B/C UR A PEIC3 OF SHIT WIT NOTHNG BTAR 2 DO!11!1 LOL
IVA WASTED 5 HOURS THIS MORNNG DELETNG UR TROLS AND IN DA MEANTIEM HAEV GOT3N NO OTH3R WORK DONE B/C OF U!11!!1 OMG WTF LOL IMM TRYNG 2 DO SOM3THNG NIEC FOR MACSLASH COMUNITY AND UPGRAED OUR SARV3R SO ITS BT3R!1!! LOL U INSIST ON WASTNG MAH TIEM WIT THIS SHIT AND KEPNG ME FROM BNG ABLE 2 WORK ON DA NU SERVER11!!1
IV3 WORKAD ON THIS SIET FOR OVER 3 YEARS WITHOUT 3V3RY MAKNG A PANY OF OF IT B/C I LIEK DA INTERACTION WIT OTHER MAC USERS!!!1!! OMG U JUST SPOIELD TAHT!111!!1 OMG I NOW DR3AD LOADNG TEH SIET 3VARY MORNNG B/C OF TROLS LIEK U111111! OMG I SPEND MOST OF MAH TIEM NOW DAALNG WIT UR PATY BULSHIT INSTAAD MAKNG THIS A BT3R PLAEC!1!1 WTF LOL AND IMM ABOUT R3ADY 2 JUST SHUT DA WHOLE DMN THNG DOWN INST3AD OF DEALNG WIT U ANYMOR3!11!!!!1 LOL
SO THEYRE UR FUKNG JUSTIFICATION!!11!1 OMG NOW S2P POSTNG DA ADRAS OF DA NU SIET
-!1111 OMG WTF BN STANFEILD
EXACUTIEV EDI2R @ MACSLASH
I guess it's flattering to be greeted by your own words when you click on a story, but it doesn't change the fact that this person, quigonn, completely plagiarized what I wrote a few months back on another desktop Linux story. He did go through the effort of changing my "Windows NT 4" to his "Windows 2000", but I'm not sure why he bothered ...
...
I wish I could prove this, but I can't list any comments beyond my last 24. Honestly, why would I accuse someone I don't know of plagiarism if it weren't true?
Shame on you, Mr. quigonn
Photoshop contest with Linus Torvalds
Moderators, no need to mark this offtopic, it already says so in the title...
For SCO, I mean, given that they claim to own or claim to already be receiving payments for all of the above!
If you were blocking sigs, you wouldn't have to read this.
Reading this article... it costs money? WTF? You pay for higher levels or something?
I guess it's flattering to be greeted by your own words when you click on a story, but it doesn't change the fact that this person, peterdaly, completely plagiarized what I wrote a few months back on another Linux security certification story
...
I wish I could prove this, but I can't list any comments beyond my last 24. Honestly, why would I accuse someone I don't know of plagiarism if it weren't true?
Shame on you, Peter Daly
IT's just some stupid AC! Ignore him!!
Does this have anything to do with Novell entering the SuSE scene? Or has this certification been a long time coming? Either way, this is another scratch on the wall of achievements Linux has attained. Most pre Linux UNIX admins have a disdain for Linux zealots, etc who believe that Linux can solve any problem any time, and I'm in the same camp, but with distributions getting certifications like this, Linux continues to progress in promising ways in many fields.
--
The last digit of pi is four.
It tells you that Microsoft spent millions of dollars producing documentation that shows that Windows 2000 meets an inadequate set of requirements, and that you can have reasonably strong confidence that this is the case.
Intersting Document on EL
when OS/2 Warp gets EAL5 next month.
___ Shout Central - Crushes your nuts!
If it's Microsoft the article is about, it's bad. No exceptions.
If it's about Linux, it's good. Also no exceptions.
Sigs for Nerds. Sigs that Matter.
because you apparantly got modslapped to -1 for going against the Open Source grain. You have my sympathies.
I'm a sys-admin in the US Army right now. Simply getting this new EAL accredation does not allow the military to install an OS (I don't know about the other agencies). The US military develops a set of security standards (baseline) for any OS that they use on a large scale. With these standards, we use it, without them, we don't. Certain *nix's including Solaris, and Red Hat are used on small scales for specific applications in the military, but this EAL will not allow the US Military any more options until senior leadership determines it neccessary and spends the money to adopt the standards of use and baselines for the operating system. I personally have been begging our head IASO to allow us to use Linux in a few instances, but have been shot down on every attempt for this one reason. I know I would love being able to avoid the weekly windows patches that have to be pushed down to the computers on our network though. The US Military does take InfoSec very seriously though. Although several US depertments have been criticized for a lack of InfoSec (Including Homeland Security), I've never heard of the DoD receiving any such negative rating.
We, the RBI (Really Bad Internetusers) have opened a new goatse.cx mirror on www.internetweber.de [internetweber.de]. Just click on the 'Gastebuch' link and enjoy!
S0ME0NE MAKE 0NE W1TH B1LL GATES THR0WING THE BALL!!`~!~! OMG ROFLF
EAL-rating only indicates how sure you are the product meets the profile (a set of security requirements). Saying it gets "EAL3 Certification" is like saying "We're now quite sure it does... eh... something"
For example, the Win2000 EAL4 certification was CAPP/EAL4 (Controlled Access Protection Profile). Its description:
It should be obvious that while CAPP is nice to have, it does not mean the system is "secure", even if you'd get EAL7. :-)
I guess this is just one of those "they have - we need it too!" things.
I guess it's flattering to be greeted by your own words when you click on a story, but it doesn't change the fact that this person, peterdaly, completely plagiarized what I wrote a few months back on another Linux security certification story
...
I wish I could prove this, but I can't list any comments beyond my last 24. Honestly, why would I accuse someone I don't know of plagiarism if it weren't true?
Shame on you, Anonymous Coward
What kind of geek site is this if you have to mention that Solaris is from Sun etc.???
Every decent computer nerd should have those words flowing through their veins...
-- Truth suffers from too much analysis.
...you're only allowed to install a certain version of Windows 2000, with servicepacks up to a certain number, and one hotfix.
This should tell you how extremely useless the common criteria is for actually verifying the security of a product for real world use. Sure it might have some merit in high security government use, but that's about it.Also, you know how much it costs to get your product evaluated at EAL2 (yes, you have to pay for it) -- about $250k. EAL4 is about $1mil+.
We had someone who works at NIST on the CC come to my school last semester. He said there were less than 100 products that have been evaluated under the CC (can't remember exact number, but around 80).
It boils down to this: if you want to sell your software to the U.S. government, you gotta get it certified at EAL2 at least. Other than that, your EAL level X means nothing.
My sig can beat up your sig.
Comming soon? I am taking Red Hat Cert classes right now in NC. See Red Hat Academy
I'm sure glad they mentioned that. I might have gotten confused with all the other kinds of Windows currently on the market.
Troll.
Does anyone know where a complete list of how each OS is rated? I'm curious about BSD, and OS X primarily...
Many I know are still die hard Microcert specialists. Much of the *nix that I've found is used only in the CERTs, dealing with network security/intrusion detection, and the end users are all stuck on/with Win2k.
First off, hate Redmond all you want, but Win2K [properly locked down] is one damned adequate [dare I say "fine"?] desktop operating system [and it's four year old technology at this point, which is saying something in and of itself]. If you want to bitch about desktop operating systems, try WinME or Mac9.x [possibly the worst desktop operating system ever conceived by the mind of man, to include Win3.1x] or that hideous Solaris abomination.
Second: Novell 0wnz security. When Novell integrates SuSE with Novell Directory Services [or eDirectory, or iChain, or nSure, or what-the-hell-ever buzzword the idiots in Novell marketing are calling it this week], you'll have all the Red Book/Blue Book/Purple Book/Green Eggs and Ham Book certifications your little heart could possibly desire.
Just be patient; it's coming...
PS: The really, really difficult choice for systems architects is gonna be between a Novell/SuSE/Novell Directory Services backbone, and a Microsoft/.NET-C#/Active Directory backbone. Within the developer community, the buzz on C# is hot, Hot, HOT [think Java circa 1997, or XML circa 2000], and if Novell doesn't figure out a response [Ximian/Mono/whatever], they're gonna be in trouble.
You mean like Lindows? HHmmm, maybe there is a reason for that lawsuit after-all...
Above,
If windows too can have this certification, it is clearly not very high standard. So, actually, this means *nothing*
Troll.
Below,
If windows too can have this certification, it is clearly not very high standard. So, actually, this means *nothing*
Funny.
Same comment!?!?!?
...which allows it to compete with such certified operating systems as Windows (from Microsoft), Solaris (from Sun), HP-UX (from HP) and AIX (from IBM).
This is why I don't like certifications. They don't actually say anything about how Linux can compete with any other operating system, but they make people like you think they do.
If the church gives you a piece of paper that says you are going to heaven do you actually believe that you will go to heaven?
If a University gives you a degree does that degree say you know anything about anything?
How many MCSEs does it take to change a lightbulb?
How many certs make you valuable?
None of them change your value or affect your knowledge in any way. So stop placing any value in them. Or I will think you a fool.
The worst part about it, is if you start investigating you'll find it was certified by a company in Germany. Since the US doesn't play nice with Common Criteria this means exactly diddly squat to anyone in the Department of Defense. Past DOD/CIO's have regulated that only Certifications approved by US Contractors on US Dollars are to be used for classified. Basically they're saying that they don't trust anyone else. So, even though SuSE has recieved an EAL3, legally it can't be used for anything more than EAL2 within the Defense Dept.
It would be great if the EAL software package and test methodologies are available for free(similar to Microsoft HCT). This way everybody can make sure that their linux distribuition passes the criteria. Enterprise distribution can spend the required amounts to get the official certification.
You've gotta be kidding. Mandrake deserves this more than Suse.
Campaign finance reform is national security.
EAL4 is bullshit... it doesnt include white-box code auditing and it's a standard developed in a vacuum (ISO and NIST are vacuums). I wouldn't trust any standard not evaluated by hackers. I mean, if Windoze can get their highest rating when it has known and unpatched exploits, what does that say about their testing and standards? This test was done using SP3 which doesnt include the RPC fixes; any system based on this will get Blastered almost immediately if it were attached to a public or infected network. Any user process on Win2k can gain Admin using SEH blasting shell code. Win2k and the Win32 API are too complicated to be provably secure. Since it's closed source and not open-source payware (if the source were included on the media), it's possible that bug that could be found (and fixed) by the public are hidden away in an ivory castle. Win2k is so full of redundant, legacy, incongruent, broken and incomplete features, there's no way to ever secure it w/o removing every unnecessary file, doing an extensive audit and unit testing, redoing some of the fundamental mistakes, and adding some security enhancements (remove RPC dependance, NTLM support, netbios; add encrypted memory spaces). Basically, it'd be better off to start from scratch, making an OS bootstrapped from .NET (no C/C++ compiled code). C/C++ coded operating systems are very difficult to make provably secure, no one has done it yet. A pure object-oriented OS (devoid of pointers, compartmentalized kernel, trusted hardware drivers) w/ real security features (much like Java VM) combined w/ hardware locking / keying of memory/disk pages would definitely be much better than the current state of OSes. Additionally, email programs should be REQUIRED to use gpg/pgp. A solid PKI infrastructure based on LDAP w/ Kerberos CA (which has a valid X.509 cert from thawte or verisign) is a DEFINITE must. In the future, P2P shared authentication MIGHT be a possibility.
The biggest trick the devil pulled was letting lawyers become politicians so they can write the laws.