Slashdot Mirror
NSA Releases Updated SELinux
darthcamaro writes "Looks like our federal tax dollars are hard at work - improving security on Linux! The NSA - you know the folks that are shadowy figures on X-files - have released the latest updates to SELinux (security enhanced). Internetnews.com has got a piece on it
where they talk to Gentoo and Red Hat about the release's significance."
Security = 1/Convenience Solve for your favorite variable.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Whoooo nelly... It kind of makes you wonder what kind of "enhanced security" those boys loaded that thing up with?
I am guessing it will either somehow steal every bit of information, including your fingerprints
or be totally sweet
Seeing as any changes the NSA make are presumably only used internally by the agency, they are under no obligation to release the source. So this is quite a community spirited move on their part.
:-)
Unless of course they are trying to sneak some NSA backdoors into Linux kernels
Homme petit d'homme petit, s'attend, n'avale
Shadowy? Since when are the NSA guys "Shadowy"? I have an uncle who used to work for them (he's retired), and he's a great guy.
Although, that may describe why he always has those blind marks across his face.
When life gives you crap, Make Crapade.
Sluggy Freelance.
Can we expect that NSA will also do EAL5 for Linux for free?
I find extremely disheartening that our tax dollars go into products, ideas and research that is then turned around and used for the benefeit of ONE company (see big drug companies, defense contractors, and certain university proffesors). That just seems plain "un-american". Here we have a rare exception, our tax dollar going to improve something for ALL americans (and the world too).
Sadly Microsoft is lobbying to shut down the NSA's involvement in free software, claiming that the government is essentially "competing" with them. Somehow our tax dollar going to work securing windows isn't communist according to MS. Just if it also helps someone that ISN'T MS. Lets hope they fail.
In the end, this can only be a good thing for ALL OS designers. It helps them look at how the people that stay awake at night worrying a lot think about security in an operating system.
AngryPeopleRule
"Science is about ego as much as it is about discovery and truth " - I said it, so sue me.
You can say whatever you like about backdoors and the like, but you can be goddamned sure i want some of the brightest minds in this country looking at the code i use as opposed to the dumbfucks that i graduate with that go to work for regular companies. As for the brightest minds? Just take a look at the requirements to work for the NSA vs. Microsoft (and NO, i'm not talking about security requirements).
Don't be silly. The three industries you mentioned are some of the most heavily subsidized markets in the world.
" We have government spending money on OS now? I think like car-building, airlines and railway, the operating systems should be left to private commercial markets."
The govt. can spend money on product development if it is necessary for govt. functions. In this case, the NSA is extremely motivated to have a secure OS to store their secrets. Rereleasing their mods to the public seems like a way to get more bang out of your tax dollar by letting you use their improvements.
Vote for Pedro
Outsourcing spooks. Yeah, that'll work just spiffy.
KFG
security -> tends to zero as Sum(Idiots) -> tends to infinity.
the combination of linux being open source plus the legal requirement that all US government employees must release code they develop as public domain results in SElinux.
in other cases it results in a very good statistical test suite being dumped into the public domain.
http://csrc.nist.gov/rng/
Do you read all of your source code before you use the software?
Chris
I'd rather pay taxes to support the stability of Linux, than to pay taxes to keep a piece of vulnerable software running any day.
"Instant gratification takes too long." - Carrie Fisher
Do you read all of your source code before you use the software?
:)
No, but if someone made changes and enhancements to my code or related to my code, I would most definitely like to see the changes.
Especially if its an agency like the NSA.
And am sure, so would the contributors to the various kernel and networking parts of Linux (or for that matter other Open Source works).
Besides, ever seen your average mail (and the number of mails) on Bugtraq or Security Focus mailing lists? There are quite a few people out there who would be quite interested.
Also, remember that even if NSA wanted to introduce backdoors, this would be too early - they would need to build up the trust to a level when people will get a little careless and then take advantage
You felt the need to link to microsoft's site in your post? You're new here so I'll give you that, but you don't have to do that. For example, the following phrases would all work too:
"The great satan"
"Bill the Impaler"
"The guys in Redmond"
"Generic Microsoft Comment #5F"
"OMG LINUX RAWKS. DIE M$ DIE DIE DIE!!!!1"
Just what 100% commercial private railway did you have in mind?
Almost all railways are national interests, including passenger service in the United States. Only _very_ recently has privatization become fashionable for railservice and it is usually marked by miserable failure. Take Britain where it was suggested that they basically dump British rail north of Manchester because there's no profit in servicing BFE. That's the point of state-owned services. The state will not dump a region simply because it isn't making a buck and the service is more important than profit.
The vast majority of airlines are state-sponsored (outside the U.S., that is) and vary from states as majority stakeholders to 100% state-ownership. American carriers being privately held is more the exception to the rule.
If not for massive government investment, international travel would still resemble an Indiana Jones plot line.
The government had always spent money in infrastructure, either directly or indirectly. The examples you choose illustrate this point.
Cars-building would not be so lucrative if there were not good roads. The government pays for these. In addition, most factories are now subsidized by tax incentives. We would probably have almost no cars built in this country if local and federal authorities did not pay the manufacturers to locate here.
In the early days airlines made their profits delivering mail. It was a while before they were independent. Also, airports are generally built and heavily subsidized by local and federal money.
It is my understanding that the railroads were given land. They wanted to own the rails so they built them, with immigrant labor, externalizing a number of costs related to said labor. Lately the rail lines have been complaining that they have to pay for maintain of the rails with the government pays for the airports. The difference is that the rail didn't want to share. Of course, the government spend huge amounts of money subsidizing the rail lines. Which is good because for many thing rail is more efficient than road or air. The rail people later used their exclusive use of the right-of-way to develop long distance telephone service, another thing that would not exist with heavy government support.
Operating systems are infrastructure. It is proper that the government helps to make sure that this important business tool is suitable. The government has always subsidized the development of these technologies through research grants, not to mention the computer time that gates and co original took from university computers. On a higher level, some analysts think much of the profit MS generates is due to specific tax breaks they have been given.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
Anyhow, don't tell me SeLinux is better because.. it would cause a flame-thread only...
So are you trying to claim Rule-set Based Access Control (RSBAC) is better? Have anything to back up that assertion?
Considering there are still too many junior and not so junior system administrations that fail to use standard Unix access controls correctly or to their full potential, I do not expect to see advanced fine-grain access controls like RSBAC, MAC, etc. to gain mainstream usage any time soon. The issue is that find-grain access control does not tend to scale well in complex and dynamic environments like found in the typical IT department of a commercial enterprise, or an academic computer centre, or the typical under (IQ) staffed government IT/IS department.
Anyone that can read and understand C. Thank God for OSS.
A better question would be, who would trust Microsoft?
...are among other research projects paid for by government money. Don't tell me that those things would be better developed by private industry.
That's like saying we would be better off with 5 different (and incompatible) digital TV standards.
Considering the target audience it makes sense. Fedora/Red Hat is the most popular used Linux distro by far. A more user-friendly approach to SELinux at least at first seems like a good idea. This is after all a bit of a landmark for linux and will be new to a lot of people.
I don't think its a loss as your implying that Fedora choose the path it did. Those who prefer be deeply involved with every aspect of their distro will of course be free to use Gentoo.
I have had numerous occasions to work with folks from NSA, NIMA (now GIA), DSS and others on projects. Despite the Hollywood induced perception that the GP has of them, they are normal guys like you and I that are: 1.) Just REALLY good at what they do, and 2.) Will do it for less money than they could in the private sector because they feel a patriotic duty to do so. Back doors...? Give me a break guys, it's Open Source for Pete's sake. You don't think the guys maintaining the kernel have a looksee?