Slashdot Mirror
Tech Companies Ask U.S. to Regulate Cyber Security
qtp writes "Wired reports that a group called the National Cyber Security Partnership, which consists of 'leading software companies' including Microsoft and Computer Associates and industry organisations such as the BSA, has asked the Department of Homeland Security to regulate what they call 'Cyber Security'. Representatives from Microsoft, Computer Associates, and the BSA headed the Security Across the Software Development Cycle Task Force that submitted this report to the Bush administration today. (For all of you who dread reading 123 page reports, there is a three page summary available as well. The Washington Post, Forbes, and Other Sources are covering this story as well. I hope this is just another [late] April Fools Day joke, but I'm afraid that this looks too scary to be real."
Back in the early 1900s, there used to be a ton of independent phone companies. In spite of using different voltages, ringing systems, etc, they interoperated pretty darned well. But AT&T wantd to be big and was buying them up, and those who wouldn't sell were effectively isolated, the main excuses being interoperability problems. The stink began getting stronger, and eventually AT&T got the government to regulate it as a utility, so it could remain intact and simply be THE phone company. Only the ignorant think regulation was imposed on AT it was their idea.
This smells to me of the same process. Being sued for security holes would be much more effective at increasing security than some hare-brained government regulation scheme. After having thought up all those EULAs which disclaim all responsibility, and blustered about Linux having no-one responsible, this is just another big corporate scheme to maintain their power and squash the small guys, and place the blame elsewhere.
The proper way to improve security is invalidate all those EULA disclaimers. A few big lawsuits with billions in damage verdicts would do far more to focus Microsoft's attention than any government regulatory body.
Infuriate left and right
they propose that gov't should regulate security in specific industries, like banking or telecom, and not a blanket "one-size-fits-none"
1) "This is your wife's divorce attorney". 2) "Hi. I'm from the government and I'm here to help".
Too lazy to create a sig...
Business gets .gov to regulate security.
Regulation and "Approved By.." nonsense costs money.
MS, et al pay.
Open Source can't pay.
Non-approved things can't be used, ergo closed source wins.
or is it really hard to take this seriously when Microsoft's name is on it? On the other hand, pretty much anything that MS is involved in (other than anti-trust lawsuits) with the US is equally scary.
Bored? Why not join a decent mess
If it's true, MS and BSA will argue that the open-source software has to be stopped because it will let terrorist see the code and come up with exploits based on it.
1f u c4n r34d th1s u r34lly n33d t0 g37 l41d
NetForce isn't that far off :p
The process sub-group will work with major software vendors and key critical infrastructure customer organizations to encourage and aid vendors in their adoption of the recommended low defect, higher security-oriented practices and processes.
Wouldnt it just be easier to pass laws making software vendors responsible for the bugs that they produce instead of spending our tax money to provide a shelter for insecure code?
I can see the next big M$ lawsuit...
Plaintiff: Their buggy code cost us millions.
M$: But we follow the homeland security software development model.
Judge: So the software must be good. Perhaps the plaintiff was trying to do something illegal?
Plaintiff: Shit... *sigh*
Adopting a "top-ten" list detailing industry best practices. Patches should be well-tested, small, localized, reversible, and easy to install. Patches would also not require reboots, use consistent registration methods, include no new features, provide a consistent user experience, and support diverse deployment methods.
I thought Microsoft was involved in the partnership. How is that going to work??
This is not a troll. MS patches generally violate some or all of the goals stated above.
I want to drag this out as long as possible. Bring me my protractor.
Are you sure Microsoft is backing this ?
Big businesses ask the gov't to step in, because their processes are flawed and produce bad software.
Gov't is expected, in turn, to mandate these measures. Mandating them, of course, requires that gov't money be spent 'fixing' the systems that were flawed.
Hmm. I smell pork.
Sure, Microsoft and the BSA aren't the bosom buddies of most Slashdot readers. And for good reason. However, a quick look through the 3-page summary document revealed what seemed to be a reasonable plan of action, rather than a scheme for total world domination.
Of course, if it turns out that the outcome of the regulation process is Microsoft-controlled security protocols and procedures, then there's something to beef about. However, at this early stage I see nothing more than an attempt to codify a national stance on computer security. Accordingly, I'm going to leave my tinfoil hat in its box for the moment.
Tubal-Cain smokes the white owl.
Big businesses like regulation. It costs them, but it costs their smaller competitors more in relative terms.
How to solve most of our problems: 1.Lots of nuclear plants. 2.Cure aging.
The BSA isn't just in business to chase down pirates of commerical software, they're also in the business of getting people to buy more. Effectively, what the BSA wants is for companies that don't buy any information security products to get in trouble with the SEC... therefore practically mandating that everybody by something from one of the BSA members.
Quote from the Washingtonpost.com article:
"[It] is possible that national security or critical infrastructure protection may require a greater level of security than the market will provide," it said. "Any such gap should be filled by appropriate and tailored government action that interferes with market innovation on security as little as possible."
In other words, "The legal climate is such that we are very likey to start getting sued for coding sloppy, insecure software. Rather than properly staffing to test our code, we'd rather have the taxpayers pay for this. This a.) saves us money and b.) puts the responsibility on someone other than us if there is a security problem."
Do not fold, spindle or mutilate.
"The report says programmers should be held personally accountable for security holes in the software they write."
Now we see, a shift of responsibility, to the programmers. Lets just try and put as many layers, as possible between the Corp Entity and responsibility as possible why don't we.
"The report said industry groups should work with the Homeland Security Department to look at ways to reduce liability, as well as examining whether new rules are needed."
And now we see a way to tie, the mass collection of data, that the GOV. is asking for, and private industry together.
This is one small step, further towards the Corp, Entity as Goverment.
My cat's picked up a Hammer. HEY! Put down that Hammer. Put Down that Hamm...THUNK!
I find it fascinating that some of the parties involved are standing-on-soap-box-high beating a cyber-security-drum when they themselves have a myriad of security issues to take care of in their own backyard. Seems to me if they can't handle the responsibility, or action required, to make or maintain a resonably secure software product, they have no credibility in a matter such as this.
boycott slashdot February 10th - 17th check out: altSlashdot.org
This is not a troll, but where was RMS and others?
It would seem that computer security would be important for the whole computing community, not just Microsoft, CA, and HP.
Patches should be well-tested, small, localized, reversible, and easy to install. Patches would also not require reboots, use consistent registration methods, include no new features, provide a consistent user experience, and support diverse deployment methods. The world is falling apart!
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
It shouldn't be surprising that the major software vendors are calling for government regulation and licensing. This is not unusual, the hidden agenda is it protects the established players by making it harder for new players to gain entry to the market.
Who's going to sit on the regulatory board? Why, the industry insiders, of course. And they're going to work in the best interests of the established players, which means keeping out the new guys by establishing, among other things, licensing and certification of software professionals.
The same as every other regulated industry.
I said nothing about open source being more secure. I think it is more secureable, and I think it is better all around, but what annoys me is Microsoft whining that there is no one to sue with open source, when their EULAs have all manner of disclaimer. Microsoft should be sued for fraud. They claim to be more secure, brag about how they are secure, etc etc etc, and yet not only do the security holes continue to roll in, Microsoft blames everybody else for the problems.
Whereas open source fixes the problems without blaming others.
Infuriate left and right
Yeah - that was some good work to do.
As a bank, we were well on our way to getting everything ready to go, and then we had our exam and were "asked" to document everything.
Long story short - the regulators tripled the amount of work to do without effectively adding any additional safety to the banking system.
A fine is a tax you pay for doing wrong and a tax is a fine you pay for doing all right.
Ensure that Software Assurance and other Information Technology Centers of Excellence include an information protection component (Emphasis mine).
Is it any surprise that Microsoft's security recommendations would include Palladium?
====---====
Together, we will drive the rats from the tundra.
Congressional Hearing
Bill Frist Testimony...
Now we will elect a new Security Head - a strong Chancellor. One who will not let this tragedy continue.
Bill Gates: Mr. President - Members of Congress, if I am elected, I promise to put an end to this CyberTerrorism..."
Later (to steve Ballmer) I have the Senate bogged down in procedures. They will have no choice but to accept your control of the system.
Much later, in Seat..(an undisclosed location)
Steve Ballmer: I bring you good news, my Lord. The war has begun.
Darth. . er Bill Gates: Excellent. Everything is going as planned.
As the three page summary says, we need to teach security when you START to learn to program.
Too often I hear that schools are not teaching of security. Almost no high school teachers who teach programming even consider security (if they even understand the issues). In college, many schools offer an optional security class. What is up with that. At my school, the assembly language course doesn't even deal with security. New initiatives need to be taken to bring security out of the closet.
The government loves getting more and more power. More laws mean they get to grow bigger and spend more of our tax money.
Once in place you get a real big, dumb organization that can't fire anyone and will use it's power to try to grow even bigger.
The only people whose opinions matter then are lobbyists with lot's of cash and the people that make money from things staying the way they are.
If the government starts regulating security, they will be even slower to respond than MicroSoft is.
It's very similar to the reason why medical marijuana remains illegal. There is a lot of money invested in keeping people in jail and enforcing the current drug laws. The reality is that the government would make even more money from taxes if the wacky weed were legalized. Greed can be very blinding.
The subtle irony of it all is that the Government is inherently anti-democratic.
Laugh at my ignorance while I learn Rails - a Real ne
Although, we all know from the DeCSS case that code "isn't free speech" when it's convenient. So the end result of this would be that the government can tell you what can and can't code.
I was fine with everything in the summary until I got to the "certification" part, but who knows, maybe my tinfoil hat is on too tight.
Qualitas edurus commercium, nullus penitus net rimor, nullus deus beneficium
Let's see if I got this right...
1. Distribute a development platform called .NET that allegedly does away with insecure coding practices.
2. Influence laws and regs such that any software not coded on a "secure platform" such as yours is illegal.
3. Let the feds regulate your competition out of existence.
4. Profit!
If this comes about, the only way F/OSS software will survive in the US is if both a Linux distribution and a Linux development platform can be constructed that will meet the same requirements that the conglomerate is pushing for. Of course, we're screwed with a capital F if the regs call for technology that Microsoft (or one of the other member companies) has patented.
So I guess now it's "If you can't innovate, litigate... unless of course you have political influence, in which case, regulate!"
Yes, my only tool is a hammer. And you're starting to look like a nail.
You've noticed how EULA is typically attached to things you pay MONEY for? (and get sued for using if you have not).
Have you also noticed how GPL'ed products are free (as in speech, but also, often, as in beer).
Notice how EULA does NOT usually cover things for which you have access to source code?
The point is simple - when you BUY software, the software VENDOR should carry responsibility.
GPL'ed software is given away - no money is charged. Thus, the GPL can say "we're just doing this for fun, use at your own risk"
In contrast, paying money and accepting the license as part of the transaction makes it a contract. The contractor should be held responsible for his work.
(I know, IANAL, playing fast/loose with the term ``contract'', etc.. But the chief distinction is MONEY)
Yup, that was pretty much my take on things (Rule 1: industry *never* asks for regulation without an ulterior motive), although I think that there's a bit more to it -- if any cronyism can be used by existing players, it might be a useful tool against challengers, forgetting about Open Source for a moment.
I'm all for the government issuing advisories, but regulation of security is not feasible. I remember reading about older military software -- the government used to try to do much more comprehensive security reviews of all kinds of software it used with tiger teams. Unfortunately, it turned out the extreme expense of this kind of thing isn't feasible in the real world, and still left holes.
If I had to give a government recommendation, it would probably be along the lines of:
* Issue advisiories. There are organizations like CERT that do this. Unbiased (not from a vendor), trustworthy information is difficult to come by.
* Issue best-practices papers. These are probably most useful to IT professionals, though it might even be a good idea to produce them for software developers. Microsoft recently collaborated with the Fed to produce a set of best security practicees documents for Windows. This is an easy thing to add to a company security policy ("[] must comply with USG Document #135F3 Best Practices"). It just tried to deal with a couple of common misconfigurations. It's *hard* to get this kind of stuff directly from a vendor (which frequently wants to hand out information that will encourage you to buy more or is more interested in putting a positive spin on their mistakes) or a consultant (who frequently wants you to buy more consulting services) or a security software (like a firewall) company, which is primarily interested in scaring companies into thinking that they need security software.
* Government certification of software intended for non-government use is a bad idea. It takes a long time, allows cronyism, can be used to attack some sections of the market (like most Open Source). It's perfectly reasonable for USG-use purchase requirements, but it's not reasonable for broader use.
* Producing a classification system *could* be very useful, where the government writes documents describing particular classes of software, but it not responsible for ensuring that a particular version of a program fits into a class of software. For example, a hypothetical class-local/1 might require that:
a) The software bounds-checks all memory accesses to data at the compiler level (free with some languages like Java, and can be done in C if necessary).
b) The software does not access the network.
c) The software does not write to any data files.
Others useful requirements for various classes of software might be: "The software does not provide privilege escalation within the UNIX operating system's privilege system (as a suid/sgid program or a daemon running as a different user does...there would be an equivalent for the Windows security system)", "All data that the software uses from the network is either exact-match checked or bounds-checked prior to use of any of that data, and a failure to pass checks results in that data not being used" (might be useful for simple network software, like clients of the daytime protocol). The government is great at writing requirements and making them publically available--let's use that. Then, if a company guarantees that they are compliant to a particular document in a contract, there is a clear point that they can be called on for non-compliance. Finally, there would be a market for software that can check software for some elements of compliance. Automated security checking is a major issue -- it's neat, it's more and more feasible (see CMU's Java proof-carrying compiler for some neat stuff. The problem is that there are currently no standards written by security folks who know what they're doing, so it's hard for businesses to ask for compliance to a particular level of security, and no tools that can certify programs to a particular level.
There are probably a lot more suggestions that the government could use, but this is a start...
May we never see th
"Create Software Security Certification Accreditation Program."
If MS is involved, is it going to be just another paper tiger giving corps a false sense of security, because someone did a 'security bootcamp' and can pass a test. Even if there is no real world experance to back him up, just like most MCSEs I've meet in the past 10 years?
"All software should pass valadation processes"
Yea all fine and dandy until someone like me writes a small patch for an open source project, I have neither the time, inclination or resources ($$$) to have my patch certified by 'experts' that have gotten their position by appointment of the BSA, MS, or were just next in line on the cival service exam?
I don't know anymore... places other then the US are looking better and better each day....
"The word "genius" isn't applicable in football. A genius is a guy like Norman Einstein," - Joe Theisman
Did the poster read the summary? I mean, maybe the full report is scary, but this isn't. Unless you are scared due to the clear inability of these things to change anything in the short term. But why would that be scary? It's not going to be fixed in the short term by anyone but you and I.
Can someone who actually read at least the summary please tell me what's so scary. And leave the tinfoil hats off - it gets very tiring.
The government is the people's union. The problem is that most people are ignorant and/or lazy and dropped the ball.
Bill Clinton: Pimp we can believe in. - The Shirt!!!
ITAA is the lobbying arm of high tech corporations.
For insight on how ITAA sets up these "blue ribbon panels", read this article about a meeting of electronic voting manufacturers. They brought in Harris Miller, ITAA's president, to see how he could help them.
Highlights from the article:
"Similarly, when we get press calls and the press says 'Joe Academic says your industry's full of crap and doesn't know what it is doing.' What do you say Harris? The reporters always want to know what are the companies saying?.. And there can be two scenarios there: The companies may want to hide behind me, they don't want to say anything... frequently that happens in a trade association, you don't want to talk about the issues as individual companies.
How is any of that related to the topic at hand? These panels we see approaching the government are coalitions formed by a lobbying firm that is paid to protect the interests of its clients. The panels are made to look as if they are unbiased experts that are only looking out for the good of all Americans. The truth is they want to control the conversation so it seems as if they are the only ones with relevant information on the subject at hand.
Harris Miller and the ITAA have been doing this for many years, and their MO is always the same. This The National Cyber Security Partnership is nothing more than an extension of ITAA's lobbying efforts.
displacedtechies.com
The report that is...
So they propose that:
- certifications
- awards
- educational programs
and that these are going to result in secure software? So they still believe in Silver Bullets.Sounds like all these software houses -- who have been touting the superiority of the proprietary development model and decrying the open source development methodology for some years now -- cannot seem to figure out how to adapt their "superior" process to produce secure software. Oh, and let's get academia involved to educate future software developers in the proper way to create secure software. Which means, I take it, that the proprietary software houses have been unable to get their current developers to produce secure software. Following this plan will result in the first crop of (supposedly) secure software developers getting their first jobs in, oh, about 2015.
So... I see this report and the suggestions contained in it as an indication that that Microsoft (and others but predominantly MS) has utterly failed in the attempt to introduce security into their product lines. Even after all of Bill Gates's pep talks and internal memoes. Now they think that creating a bunch of undergraduate courses in secure programming, certifications, and awards to software companies will somehow result in a new breed of software that won't be susceptible to worms and viruses. To me that says: ``We, the proprietary software industry have finally come to realize that writing secure software is quite beyond our capabililties and we make these suggestions so that other people can figure this out for us so that we merely have to hire new people who are already trained to do this. And, of course, these programs should be paid for by the Government.'' No. Strike that. They'd be paid for by you and me. Twice. First in the taxes that would go to create these educational programs and the certification organizations. Then, again, when the price of the software goes up because, well, now it's secure software and that's worth paying extra for isn't it?
Funny that open source software -- and, to be fair, some proprietary software -- isn't anywhere nearly as vulnerable to the sorts of attacks that Microsoft's is. Because, it seems, those Neanderthal open source programmers didn't have the insight to include features that automatically run code by clicking on mail attachments, include scripting languages inside applications that have the ability to destroy user data or launch unrelated programs that damage the local and/or remote systems, or, ... (the list goes on).
Wonder where all those open source programmers managed to learn about writing secure software (yes, yes, yes... I am aware even OSS can occasionally have bugs that affect security) without a college program, certifications, and industry awards? And how do they do it without a government subsidy? Oh, yeah. I forgot. They're able to do it because they don't have some pinhead from Marketing ranting and raving that seven new features need to be in the product in time for the next trade show and there is no time to waste with any discussions about how these features destroy the integrity of the software. Companies like Microsoft won't create more secure software once these programs are in place. Even if they are able to grab every straight-A, magna cum laude graduate of these programs in the country. Why? Because these poor folks are still going to have to answer to some pinhead from Marketing ranting and raving that all these new features need to be in the product in time for the next trade show.
I sure as hell hope that some articulate luminaries in the open source development community have the opportunity to submit a report to the folks that are going to be reviewing this piece of tripe. The opposing viewpoint and an alternate plan needs to be heard.
(Heh. If reading the summary got me this ticked off, imagine if I'd read the entire report!)
CUR ALLOC 20195.....5804M
You need read no further (in the summary) than:
"The Department of Homeland Security should support US-CERT, IT-ISAC, or other entities to work with sofware producers to determine the effectiveness of practices that reduce software security vulnerabilities."
Translation: We'd like to hop on the government gravy train under the guise of "Homeland Security." Can we get some free money please? I mean seriously, why should we pay to fix our own programming errors when we can get the government to pay us to do it?
We have a Republican president and they control half of Congress.
Since this proposal would extend the reach and powers of the Gov't, it will never pass. Republicans are for a smaller government, remember?
Wait. Why are you laughing?
Look at it as a certification process. Each project tasked with protecting data on a computer (networked or not) has a security posture and a security officer responsible for ensuring that the declared posture is enforced.
This is what a bunch of people at /. fear: they expect the government to try and make it all completely secure and fail, but rather what they fail to see that government will only quantify and validate the level at which an information system is protected. This means it's not a black and white world, but rather the level of protection is paired against the threat of compromise.
A bunch of you also think this has only to do with preventing a network-based attack. And while that is in play, don't forget corporate espionage. That foreign temp worker your boss hired could be walking out with all the spreadsheets the accounting department values. This problem, by the way, is addressed in trusted operating systems such as talked about in this article asking about Trusted Linux vs. Trusted Irix or Trusted Solaris.
DCID 6/3 works both sides of that problem and quantifies for management what kind of protection their dollars have bought them.
rather than a scheme for total world domination.
These companies are basically trying to erect additional barriers to entry into the software market: costly certification and training requirements, costly documentation requirements, etc. They know that they can satisfy them, but a small software vendor or an OSS project can't.
And they make those recommendations knowing full well that they won't work. If they knew how to make more secure software, they'd already be doing it. A bit of training and certification just is not sufficient for making software more secure.
what seemed to be a reasonable plan of action [...] However, at this early stage I see nothing more than an attempt to codify a national stance on computer security.
What's there to "codify"? What's reasonable about it? There is not a shred of evidence that the "strategy" described in the report will do anything to improve security.
At this point, we have to conclude that people continue to buy insecure software either (1) because they don't have a choice because of Microsoft's monopoly, or (2) because they don't care about security. If (1) applies, then the solution is to break up Microsoft's monopoly and give people a choice in software; then they can pick the level of security they like. If (2) applies, then what business does the government have to force a level of security into products that buyers don't want?
Grayscale, actually.
Some OSS developers will point fingers, primarily with "Autoconf 1.4 is crap. Use 1.7 instead" or "The DRI Radeon driver doesn't handle that well, try using the ones from ATI's website."
You'll often see a conflict between keeping the code elegant and keeping it broadly compatible. The OSS developers I've interacted with tend to focus on the "elegant" aspect.
tasks(723) drafts(105) languages(484) examples(29106)
Regulations cost money and create hurdles. If they succeed in getting laws that require software to be certified as secure by some mixed public-private authority (read BSA, some universities, and the nsa) then free software will just have a complex process to go through before it can be used in government and perhaps even before it can be distributed. Whatever the claims of Microsoft and the BSA their ultimate goal is not security but to prevent the commoditization of software which is going to destroy their business model. Big companies are already warming up to the idea that money should be spent on hardware and support, not on overpriced proprietary software that is not any better than whay they can get for free.
Wouldnt it just be easier to pass laws making software vendors responsible for the bugs that they produce instead of spending our tax money to provide a shelter for insecure code?
Security is an engineering tradeoff, just like speed and usability. I don't want every software vendor to have to conform to the highest level of security out of fear of getting sued.
The people who should worry about this sort of thing are the buyers of software. If your car mechanic can't fix your car in time because his PC got broken into, you go to a different car mechanic and he will go out of business. If a hotel can't accept reservations because their reservation system got hacked, they go out of business. For small businesses, those kinds of feedback mechanisms work pretty directly and after that sort of thing has happened once to a small business owner, they'll generally have learned their lessons.
The problem is with non-competitive markets: many people have to buy Windows no matter how insecure it is because the software they need only runs on Windows. And you can't change airlines or banks just because they keep having security problems--there are too few of them around.
If we create efficient, competitive markets in software, banking, airlines, etc., then the security of software will adjust to the optimal levels demanded by the market. Our problem is not lack of government regulation, it is lack of efficient markets.
In short, if we want secure software, the government should simply get more aggressive on anti-trust enforcement again. And they should do so first of all against Microsoft so that buyers have a real choice. That's the sort of government activity we need, not bogus "security standards" which aren't going to work anyway.
Has there ever been a documented case of actual 'cyberterrorism' against the US? It seems like all the laws and hoopla around it seem to do is hand out extremely long prison sentences to script kiddies. Most of the criminal hacking I've ever heard of was for person gain or just for reputation/attention getting. Has any actual group successfully launched anything that could be considered a terror attack?
Even the fairly cohesive stuff like the long-running India vs Pakistan web site defacement battle is just a really annoying flame war.
I'll make you a deal. Pass ONE law about cybersecurity. Make it illegal to run an open relay mail server. See if you can enforce it. We'll know if it works if spam decreases.. If you can, and it does, you can pass another law. See if you can enforce that, too. Then we'll talk.
(see you sometime in 2036)
I had a sucky sig.
Yup. It can be read right here Computer Security Report Card
Is this a case of the blind leading the sighted?
IANAL, but I've seen actors play them on TV
It is appropriate that this 'report' was released on April 1st. Halloween would also have been appropriate. Here is what it will do:
1) Give M$ a shield from responsibility for the massive insecurity of their software by making a 'security organization' the accountable party. "Software companies" (i.e., mainly M$) would fund the company. The security organization would lay down rules about how bugs and holes are discovered (not a certified programmer? -- then you can't look for/report bugs. See the story of the French scientist who is being sued for pointing out vulnerabilities.), how they are reported (no public reports at all until the patch, if ever, is released, then no announcement as to how long the bug/hole has been open), and how they are released -- through 'special' sites, for a fee, of course, so that the consumer pays even more for M$ bugs.
2) Require programmers to get "security certifications" from "accredited" schools. These are schools which have received funds (guess from whom) to finance/"reward" faculty members who establish such programs. Guess which OS will have certification programs, and which won't be allowed on campus. (Just ask youself which platforms aren't allowed equal billing with Windows on Dell computers.) Programs written by "uncertified" programmers will not be allowed distribution through 'certified' channels. Uncertified channels will be made illegal.
3) No answers as to which programmers gets 'grandfathered' in but the entire MS programming staff would be a good guess.
4) Independent Software Vendors (ISV's ---i.e., OpenSource folks) will have to meet requirements which are, in effect, designed to keep them from developing software drivers for new hardware, effectively locking them out of future markets.
Microsoft, the BSA (enforcement arm of MS licensing), and other companies with less than desirable security records would then use the courts to completely muzzle news of the vulnerabilities in their software. With that accomplished they can essentially shut down their repair operations and move the whole program into the public law enforcement arena, using local and national law enforcement agencies as their "security repair" division. Just remember that French scientist who was sued as a 'terrorist' for revealing security holes in software which the vendor claimed in their ads was "100% secure". This will be in no way different than what coal mine owners did in their efforts to keep slave labor trapped in their mines, but this time it will be consumers trapped into using buggy, insecure software with no alternatives. The end result is that the software will get worse because the incentive to repair is removed and will become more expensive because there will be no Open Source competition.
The current crop of "Security Organizations", most of whom have already knuckled under to Microsoft, will not be needed in the "New Order", but I'll wager most of them haven't figured that out yet and are probably jumping on the bandwagon because they have, like so many companies Microsoft has deflowered and plundered, visions of increased revenues as Microsoft 'partners' in this new scam.
The 'security problem' doesn't need a 123 page report to identify the security problem and create solutions for it. The problem is Windows. The solution is for Bill Gates to spend some of his $50 Billion to fix the code, not buy off congressmen and judges and make their problem a law enforcement issue at the public's expense. Is there no end to this man's greed?
Running with Linux for over 20 years!
While you're right about that clause, that clause does not apply to end users. End users do not have to agree to the GPL to use GPL'd software. It is a distribution license, not a EULA. An end user would not be restricted from suing anyone by any clause in the GPL, because, quite simply, the end user never agreed to the GPL in the first place.
If you had super powers, would you use them for good, or for awesome?
Realize that this is a *distribution* license. So, the best way to take the above is that if you distribute a GPLed program to someone and that someone never distributes the program under the GPL, but they try to sue you, you can't punt the problem up to the person who gave you the program.
The GPL, at each link, prevents handing over liability to the next level. So, generally, each company who distributes a GPLed program is liable. This, nicely, also fits well if companies become the main provider of GPLed software since they're likely selling it to you. Works pretty nice, eh?
Eurohacker European paranoia, gun rights, and h
Even if adopted, this won't be fatal to free software. It would cripple the US economy, but free software would continue to be developed elsewhere. Eventually, once the US was driven back into a depression, other interests would win out, and the law would be overturned.
Admittedly, not a pleasant prospect, especially in the short term.