Slashdot Mirror
Nessus Closes Source
JBOD writes "As reported at news.com, the makers of the popular security tool Nessus are closing its source code. Although it will will remain free as in beer, Nessus is dropping the GPL license for the upcoming version 3 of the software. The problem appears to be that Tenable Network Security (the company which primary author Renaud Deraison founded around Nessus) isn't making money because it's competition is simply repackaging their product. Deraison's writes "A number of companies are using the source code against us, by selling or renting appliances, thus exploiting a loophole in the GPL. So in that regard, we have been fueling our competition, and we want to put an end to that." He also notes that the OSS community has contributed very little to Nessus in the past six years, so they were reaping no benefit from using the GPL." Update: 10/06 22:48 GMT by CN : Nessus' Renaud Deraison wrote me to let me know that the company is "good money-wise," but has become annoyed with competitors repackaging their product.
No, fork.
That's *the* valid excuse. They were in fact drinking the kool-aid - they believed that by contributing to the codebase, that it would make everyone's project stronger. As it happened, they kept giving and the competition kept taking. The community didn't give back.
I agree, though, they could have written a license that gave other companies the right to reuse the code for non-commercial uses only, and that would have been a better compromise.
If their competitors were just repackaging their software, they should have put some massive bugs in it.
So (provided there are interested developers), the last GPL-licensed version will likely be forked and a new project formed... I'd guess "gnessus".
SATAN and SAINT appear to be gone. Now Nessus. What other projects are out there for security auditing tools? This is not a good trend.
-"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
Or rather, using the GPL as it was intended, to prevent vendor lock-in.
This sort of thing almost always results in someone making a fork. Is there really so little OSS involvement that a GPL fork (from the most recent GPL version) would not be able to compete with the closed app?
# cat
Damn, my RAM is full of llamas.
Hopefully, the time will come when Renaud and crew feel that they can re-open the code, possibly under GPLv3.
People haven't contributed anything special to the scanning engine. They would have to strip that out, but as already mentioned, it was no biggie. They hold the rest of the copyright, and are legally allowed to change the licence, but they cannot restrict any usage of previously released source code.
Dvorak on Doomtech
The "loophole" is an intended result of the GPL. Since this is it's purpose it makes no sense to call it a "loophole" whether you like or dislike the GPL.
In any case, they are perfectly free to do this. They are also free to release the source code in a way that does not have this "loophole", such as by using normal copyright. Equating "being able to see the source" with "GPL" is a bit of FUD.
That's not a loophole, that's how it's supposed to work.
He also notes that the OSS community has contributed very little to Nessus in the past six years, so they were reaping no benefit from using the GPL.
His code, his rules. As long as he's not including code that others contributed under the GPL, that is.
The question is, has he either cleared the code, acquired copyright, or licensed it from the authors?
Lacking <sarcasm> tags,
It is a plot.
Along with the MOSSAD aquisition of Snort/Sourcefire.
"Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
From their indication that they haven't seen any significant help in six years, we can presume that the third possibility is unlikely.
And, of course, old versions will still remain under the GPL (happily).
Throw the bums out!
They cant go "closed source" - they've licensed it under the GPL. Unless they rewrite the app from scratch, or remove any code from parties that havent agreed to the new license... If linus wanted to close-source linux all the sudden, he couldnt do it either.
That's actually not true at all. They still own the code, the GPL is a license, not relinquishing ownership. What they can't do is use any code contributed by anyone outside the company. That code they'll have to re-write since it's licensed under the GPL and doesn't belong to them.
And obviously, the existing version cant be relicensed either. The latest release under the GPL is stuck there from now until forever.
They can't relinquish the license of course. Anyone that wants to take that code and maintain it themselves is obviously free to do so.
AccountKiller
This is not a "loophole in the GPL". It is exactly how the GPL, and similar OSS licenses are intended to work. If you don't want other people freely using, modifying, and even selling your software, then do not open source it.
Also, it seems rather rich that they are selling a product that depends on a number of other OSS projects (expat, gettext, gmake, libiconv, libtool) and complaining about people making money off their code.
- H
I think you misunderstand. It is their program. The owner of the program can have multiple licences. The GPL gives non-owners specific rights and specific requirements, none of those licences necessarily have the same effect on the owner as it does the user.
While they can't "take back" the versions that are already out there, but the copyright owners themselves can make a variation and not release the source of the variation.
Considering that in EACH of those cases, the software IS distributed, they could have went after the offenders. Perhaps they can't afford lawyers to do so- I DID mention in numerous threads before that Copyright, etc. is only as good as the legal effort you can muster to defend your IP rights.
I don't buy this as a reason, mind- because the people in question are still infringing and making it free as in beer won't change the situation any more than it is now. You have to go after them for their infringements- licenses don't change this. If it were the case, MS (or any other BSA members, for that matter) wouldn't be so worried about piracy of their products...
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
What did happen to xfree86 project when they changed thier licensing?
Well, I just assume the same will happen with nessus, except if there is no interest in nessus when there was on an X server.
I gave up with the idea of an useful sig...
Anyway, speaking as a long-term user of Nessus, I have had direct personal benefit from it being Free; it enabled me to get familiar with it on my home network which (along with snort, nmap, ipf, tcpdump and a load of other Free stuff) enabled me to move into network security five years ago. Of course, it's Renaud's code and it's his right to release it under whatever licence he wants; but it's a shame. Let's hope someone's prepared to fork the GPL'd v2 codebase and start adding the improvements it needs.
Of course, I'm assuming that all the plug-in authors are happy with this. When Tenable released a closed-source Windows port (NEWT) I queried the position on a mailing list somewhere, I forget the outcome but it seemed odd to me. It seems really unlikely that Tenable would do this without the plug-in authors' agreement,.. anyone got info on that?
With my 'Free s/w zealot' hat on, I have to say that it'll be interesting to see how the community responds to this. In my copy of the FSZH (FS Zealot's Handbook... version 2 or later :) it says that a benefit of GPL licensing is that the community can pick up and continue with the remaining GPL'd source. Are there any coders out there interested and motivated enough to pick up the GPL'd project? It'll be interesting to see. Fingers crossed....
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
The GPL is a copyright
No, the GPL is a license with which a copyright owner can enforce their copyright on said code.
Help Brendan pay off his student loans
Open source software has worked pretty well in areas that provide services such as operating systems, development tools and server software because in those areas the people who need them also need support and have a vested interest that they are aware of in supporting the tools they use. I don't think that desktop software which is typically sold, however, works well in that respect. Most users have no reason to believe that they have a vested interest in supporting OpenOffice and I would bet that if Sun dropped their support the project would implode.
Let's be serious about this. The GPL provides **no** protection to companies whose business model is built on selling software that doesn't need support contracts or anything like that. If selling software is your business, then the GPL is basically a suicide pact for your company and the same applies to all other open source licenses because your competition can repackage your millions and billions of R&D dollars/Euros/Yet/etc. and you get... precisely what?
It's funny how much having a girlfriend that you are working toward marrying and realizing that your idealism cannot feed your children will change your perspective on open source software. I like Linux, love Tomcat and am eager to give PostgreSQL a shot and I run my own nightly builds of Firefox, Thunderbird and Sunbird on my Windows laptop, so I am definitely not some fanboy for either side. So let me just say this to most of the zealots: OSS is never going to win in the long run because developers have families to support and will not slit the throat of the goose that lays the golden eggs (though sometimes they seem a little bit like bronze) that pay the bills and support one's spouse and children.
Get to that point and you'll realize that Microsoft is good because they create work for you. Same thing with Oracle, Sun, IBM, etc. Infrastructure can and in some areas should be open. However, no one is going to make money on open sourcing things like Quicken or TurboTax and other common user apps unless they are utterly useless without some expensive services provided by the company that makes them. How else are they going to make money, eh? We ought to eliminate software patents and EULAs, those are things the OSS movement is right about. However, the OSS movement if successful (and I doubt it will be in the long run) will end up making it very hard to make money in software development and maintanence. Good for this company that they realized that before it was too late. I'm glad that they chose to protect their employees and stockholders instead of pursuing Stallman's dream of a world in which software developers effectively cannot make a living directly off their code.
Click here or a puppy gets stomped!
Keep in mind that the GPL is assigning a license, not the copyright itself. The original copyright owner on any copyright code can assign a new license to the code at any time. So long as all code that was contributed has had it's copyright assigned to them, they can do what they want. Otherwise they'd either have to obtain copyrights to that code now or gut that code from the product.
This sig has been temporarily disconnected or is no longer in service
Or is everyone scared that all the "You can't actually make money with GPL" rumours are true (especially for small start-ups)? ;)
-- Sig down
Choice 1) Pay (a likely non-existent) legal team huge amounts of cash to come up with a new license that is legally sound in all of the respects that need to be accounted for in their position.
Choice 2) Close source code.
Seems to make sense to me...
1. They get no more free code, since people can't hack on it and improve it for themselves. It appears that this has been the case for the last 6 years. Maybe the switch away from the GPL would cause people who only improve it for themselves to say "Hey, I'll participate if you let me back in!" If the people who actually do play with the source code keep the modifications to themselves, then the company might see little to no change in a year because they apparently weren't benefiting much from being open source anyway.
"Physics is to math what sex is to masturbation." - Richard Feynman
They have a batch of closed-source product offerings like NeWT (Closed, for NT/XP only...), NeVO, etc. that are priced at rather HIGH pricings so that people just simply can't afford the damn stuff unless they're as big as someone like IBM, TI, etc., it's no small wonder that they're hurting financially.
Sentiments aside, they look to be a small player that priced themselves out of the overall market, hoping to score support contracts for an Open Source project that was to showcase their abilities and hoping to sell at least a handful of this other stuff at an unrealistic $9-10k per instance. The closest thing that competes in price is only $4k and there's other solutions that ARE cheaper.
The reality is that Nessus will probably be forked, Tenable will keep sliding into the hole not because of the GPL but because of their own pricing themselves out of the market, and life will probably just go on all the same.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
The FSF says nothing about the GPL and community giveback. It says only that the GPL exists to give users freedoms to use and modify software. Indeed, "The freedom to use a program means the freedom for any kind of person or organization to use it on any kind of computer system, for any kind of overall job, and without being required to communicate subsequently with the developer or any other specific entity." (emphasis mine)
Penny - plain text accounting
Is this Kool-aid free as in beer or free as in openCola?
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
They gave it away already. They can create a proprietary branch, but taking something out of the public domain requires large bribes to congress. It amazes me that folks still use the GPL. I attribute it to mental laziness and hokey religeons (w/ ancient weapons).
Perl's Artistic License and the Apache License are better licenses.
BTW - I am a lawyer and this is personal opinion, NOT a legal opinion.
What? Me? Sig?
I responded for the Nmap Security Scanner project yesterday. We aren't planning to follow suit. Nmap has been GPL since its release more than 8 years ago and I am happy with that license.
I agree that this is not a good trend, and the question is how to reverse it. It is important to note a key reason Renaud gave: the lack of community involvement. It is easy to take the open source tools we depend on for granted, and forget that open source is a two way street. The bazaar model doesn't work so well with everyone taking and not contributing back. In the Nessus response, I suggest a few ways that programmers and non-programmers can support projects they use and enjoy. Rather than mope over the loss of open source Nessus, we can treat this as a call to action and a reminder not to take valuable open source software such as Ethereal, DSniff, Ettercap, gcc, emacs, apache, OpenBSD, and Linux for granted.
Meanwhile, I know at least one group of experienced open source programmers that is preparing to announce a new open source vulnerability scanner project or Nessus fork. It would be encouraging for such a fork to succeed.
-Fyodor
Contrary to a number of comments I'm already reading, Tenable Network Security can do this, as long as they control the copyright to the entire body of work. This would be impossible for some GPL-licensed software for which the copyrights to separate contributions are owned by their contributors. If I am not mistaken, I think Linux falls into this category, so Linux could not be taken out of the GPL unless everyone who holds copyrights over the many parts of the source code all agree on the new license. Won't happen.
For software that is copyrighted by a single entity, be it an individual or a company, the license can easily be changed. However, anyone who obtained the software under the terms of the previous license cannot have the rights that were granted revoked. This means if you downloaded the software and source at any time before the license change, congratulations. You have the GPL'd project in a relatively recent state, and the GPL applies.
This presents an opportunity to fork a GPL version. If enough people are interested, the fork can eclipse the original project, as X.org did to XFree86 when the latter changed its license.
When the 2.2.5 version of Nessus was released, Brian Weaver (formerly of OpenNMS fame) was puzzled why the GPL version wouldn't scan. After hacking through the source code, Weave found the answer: strong evidence suggesting Tenable Security, the sponsors of the GPL version of Nessus as well as a commercial version, deliberately crippled the GPL version of Nessus. With stunts like this, would you trust Tenable to protect your network?
Yep, this is just one real-life example of why Open Source can only work for some situations but simply does not make sense for others. At the end of the day developers have to eat and have shelter (and provide such for their spouse/children) too.
Most people understand this principle. But the OSS activists seem to believe that smart developers can donate forever and should be totally selfless. Why is it only the developers? Developers who spent many years of their lives learning to be experts at their complex trade (programming) are expected to donate. Yet the typical help-desk types are "allowed" to charge for their consulting services when they pop a CD in a drive and install the OSS software for a client.
I'll admit, I'm a software developer. But, I know OSS activist guys who charge companies $100/hr consulting fees to implement OSS solutions that they don't pay a dime for. These guys are walking in to a firm, spending a day setting up a PHP server (or whatever) and walking out with a fat-ass paycheck.
But when a developer wants to charge for the software he writes the OSS community of activists starts hissing at him and brand him with some sort of corporate greed type crap.
Can somebody please explain this OSS-mentality inconsistency????
What some open source zealots, and the vast majority of open source "consumers" don't recognize is that programmers need to eat to. Until these "consumers" stop taking advantage of open source, and start paying... Open source will stay in Microsoft's (and other big corporations) shadow, and very likely even shrink.
... It is not an easy life, I am $200k or more in debt and drive a 1989 CRX Si.
Nessus is not the first, and not the last. Even Hans Reiser has this problem:
See here... Hans Reiser: Doing GPL work is doing charity work [...] That should be and could be changed, but for now it is so. I have done my share of charity, and I would not have a problem doing proprietary work. I think people should keep their lives in balance, and that includes balancing charity work and better paid work.
Here is another: Mute file sharing. Not sure how long this experiment will last.
And one more: Daniel Robbins founded Gentoo linux, went bankrupt, got job at Microsoft
Either help these programmers feed themselves and their families, or expect other big and large profile projects to disappear and become pay-for-play.
I love open source, and contribute money to many projects -- but open source will just prove to be a fad that will start to wear thin on programmers as they get into debt and can't feed their families. The business case for open source software longterm survival is weak, unforunately.
m
hum.. isnt that exactly what i just said? "remove any code from parties that havent agreed to the new license"..
You also said in your first sentence that they couldn't go closed source, and compared the product to linux. That makes it sound like you're trying to say they can't do it, or it'd be very difficult to do. The big difference is they've said there hasn't been many contributions to Nessus by anyone outside of Nessus. This makes it very easy to rip out those sections that they don't own.
AccountKiller
I agree - in principle - but principle doesn't put food in your mouth or pay the rent.
These guys did a wonderful job. Six years contributing to software that was obviously so good that other people could make money off it. Its one thing to work on an open source project in your spare time, or to be employed by one of the few companies that can leverage free software to make money, but these guys aren't. So unless you are working on the kernel, on samba or one of maybe a dozen other projects, you can't give up your day job.
Maybe by closing the source, one of their competitors will buy them out and they will have enough money to live on and write open source code. Rather than berating these guys for leaving the fold, thank them profusely for the six years of hard work.
If you don't like it, fork it. Once GPLed, always GPLed, and only V3 and above is going closed.
Norman Cook's Ode to Sl
Open Source cuts into software revenue whether we like it or not. If somebody expects to Open Source their product and then earn a living from selling licenses, well they don't understand Open Source. Actually I tend to think they are living in a dream world! The key to Open Source is added value, and not sales of software. Obviously their competition understood that and created devices!
Their call that using devices is a GPL loophole is pure BS. If somebody sells a device with the software and does not make any changes then they are entitled to that. If they change the sources then the sources have to be made available and I am sure that they did. The point is that somebody was clever enough to create a device that maybe they should have in the first place!
Here is a question, if the person's competition was making money on GPL, why couldn't he? Oh yeah he wanted to sell software and only sell software! Here's my prediction, that he will bankrupt himself after close-sourcing the software and blame it on the Open Source community!
"You can't make a race horse of a pig"
"No," said Samuel, "but you can make very fast pig"
Free as in Jim Jones
"Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
This is one of the counter-arguments used against the GPL. When people start crying "Everything should be OSS", here's a case to point to of it not working.
The GPL does create problems for commercial viability in many cases. You spend tons of time and money developing something, others then market the solutions for it, you get squat in return. This is a problem. The "Well make money selling support" argument doesn't work when others are selling the support better than you can.
Now, perhaps you are inclined to think this is fine. They are better at it, so they should make the money right? Except the only reason they can, is that you put in the up front investemant to actually make the software.
What this will lead to is people deciding that open source is not the way to go, or at least GPL-style open source. If it just leads to other people making money off of your hard work, it'll really turn people off to it.
But sometimes I think the authors of popular open-source software see their user base and think "gee, what if I had $59 from each user!"... when in fact, "free" is their main competitive advantage and the only reason they have users in the first place. Charging for software licenses might save them, but it might just wipe them off the map.
At least one person - Dana Epp - alleges that there is a REASON why there are no ouside contributions to the scanning core engine:
t ml
http://silverstr.ufies.org/blog/archives/000864.h
Dana alleges there wasn't much give and take between Nessus and "the community" which discouraged any contributors.
[In 2002] "I was about a quarter of the way complete the port [to windows] when I ran into some issues with the NASL scripting and I tried to contact Renaud and his crew to point out some issues I found. The help I got? Squat. Nothing. Barely even communicated with me. I only ever got a couple of email responses saying "I was free to do it" when I asked if I could do it in the first place, and a follow up to an issue I found with a quick thanks."
I was about to go kick off Sussen but it seems MMG Security have beaten me to it:
Created On:24-Dec-2004 01:24:29 UTC
Last Updated On:26-Sep-2005 11:55:35 UTC
Expiration Date:24-Dec-2006 01:24:29 UTC
They've just released on 26 September 2005; hopefully it's a fork of Nessus rather than an unimaginative name for a new project, but I suspect the latter.
Who the fsck are Tenable anyway? I haven't heard of them before today and with any luck I won't hear of them again. If they didn't like the license they should not have released their Intellectual Property under it, and then someone else would have and they wouldn't have enjoyed the free publicity. Have they not seen how well MySQL is doing off the back of an Open Source product? Sounds to me like the problem isn't with the license...
This raises an interesting question about vulnerability scanning though... who could really care less about the scanning engine or how long it takes - the patterns are where it's at; so long as we keep the patterns up to date security doesn't suffer at the hands of this greedy company.
Incidentally, I like the way they're still advertising Nessus as 'THE Open Source Vulnerability Scanner' on their site.
The developer also expressed disappointment over the lack of community participation in developing the software, despite its open-source license.
I have to disagree. I'm a CISA (certified information security auditor) and have used Nessus in audits. About a year ago, I provided feedback regarding Nessus's tendency to damage production services, even in safe mode. These occurances were not Nessus's fault, but rather the consequence of very poor coding in various network devices. Often Nessus would cause old HP printers (HP Laserjet III was notoriously vulnerable), cheap network fax appliances, and in a couple of cases, Sonicwall firewalls to completely lose their configurations and reset to defaults. 10+ year old printers have a bit of an excuse in my book, but Sonicwall, which advertises as a security product, had no legitimate justification for this behavior. We were able to confirm this from outside Nessus scans as well.
I began reporting this behavior to the Nessus group and suggested a database of vulnerable devices to prevent analysts from getting in repeated hot water. The Tenable folks were not responsive at all and indicated their fear of civil liability due to potential disparagement of network equipment vendors products. Although I referenced numerous other sites, as well as the alternate "compatible device" approach which countless operating systems take, the idea was ignored. I did receive numerous emails from other analysts who had the same concerns.
Teneble has done a good job pushing away its user base and unfortunately moves into a hypercompetitive world of better proprietary tools. I wonder if there's an impatient VC pulling their strings.
I'll definitely support any open source effort that continues with the GPL code. How about calling it Hindmost (for all the Ringworld fanatics out there).
*scoove*
That's *the* valid excuse. They were in fact drinking the kool-aid - they believed that by contributing to the codebase, that it would make everyone's project stronger. As it happened, they kept giving and the competition kept taking. The community didn't give back.
I guess they didn't gain anything from Linux, libwhisker, nmap, Bugzilla (MPL, I know - but they use it, and the argument still works), or any of the countless other open source projects. Why is it that coders always feel they don't get their just rewards? Why ever release under the GPL to begin with? Didn't gain anything... pfft.
Nessus gained a reputation as a premier vulnerability scanner because it was open and free -- period. Nessus isn't terribly more special than Retina or ISS Internet Scanner. Look up "vulnerability scanner" in google and your first hit is Nessus because it was free AND open. Had it just been free it never would have gotten off the ground. Seems to me Linux probably wouldn't have gotten very far either. Hey its their code (I guess), so they can do what they want with it. I guess they just weren't making enough of their own black box implementation - but they'll need to have some insane tricks up their sleaves if they think they'll make money against whoever forks Nessus 2.x and keeps it free.
Hell the only reason anyone buys ISS's scanner is because it ties in with their whole SiteProtector line.
*shrug*
Some people do manage to make some money from their open source projects... SourceFire. Odd day in open source security land.
http://windows.scares.us
He even had to contact people around (who found security bugs) and ask them to check if Nessus check was valid for certain vulnerability. He did contact me twice, and I did test/review the check, but I never contributed anything to Nessus.
:), I simply never wanted to make it easier for those idiots to perform tasks they were not intended to do, in the first place.
Why?
In all honesty - because of the reason I went out of "security business". It became a business, where every idiot would try to take a "piece of security cake", even if they were complete idiots without clue about anything related to security. Or more precise - "it became a business".
Although I adore Nessus, and used it on few occasions (prefer to do things "by hand"
I admire Renaud for actually surviving this long with GPL license, and I sure admire his dedication to Nessus.
He is right for doing this, and I wish him all the best.
OK, the Sendmail cf is truly mind-taxing, and the manual equally so (to me at least), but I just don't get what's supposed to be so insanely difficult about Apache's config. I, at least, have always found it to be one of the most understandable configs out there (apart from mod_rewrite though) and the manual is excellent. What's the deal here?
BIND config - now that's a candidate for an Extreme Makeover if I ever saw one.
I'll give you THE REASON why there wasn't much of a community around nessus:
Renaud
Yes, that's right. Renaud himself. Schizophrenic, anti-social, flaming Renaud. Let me illustrate:
A few years ago the company I worked for wanted to provide Nessus scanning as a service to people. The CEO himself wanted us to be good citizens in the OSS community (he was a techie before he got into management) so, not quite understanding the GPL, he personally sent an email to Renaud asking if it was ok to do such a thing. He basically got "ya, sure. just tell people that you use nessus" as a response. Of course, providing a service using stuff under the GPL is perfectly legal, regardless of whether or not you modify source code (which we never got around to doing anyway).
Fast-forward a few months. We're creating the service. We join the mailing lists and start asking a couple questions. Almost instantly Renaud flips out. To paraphrase: WHAT THE ____ DO YOU THINK YOU ARE DOING USING NESSUS? WHO THE ____ DO YOU THINK YOU ARE? COMPANIES CAN'T USE NESSUS TO PROVIDE SERVICES! ESPECIALLY IF YOU CHARGE FOR IT! SUPER-ESPECIALLY IF YOU MANAGE TO MAKE A PROFIT (and don't give us a large cut)
Ya, ok. Whatever. Renaud subsequently (in emails to our CEO) threatened legal action against us for things such as "using nessus." Legal improbabilities aside, that totally spooked management and alienated myself and the rest of the development team. Several of us have participated in other OSS projects through irc, mailing lists, forums, contributing patches, reporting bugs, etc. Such OSS participation is generally well-received. With nessus, not one of us who ever tried to participate in its "community" ever felt welcome in the least. To the contrary, every time we dipped our collective toe in nessus's pool, we came away with frostbite.
Renaud appears to have finally woken up to the legal ramifications of having put nessus under the GPL. Namely, he can't dictate what others can and can't do outside the confines of the license. If any of you are considering using nessus in the future, I highly recommend going through his license with a fine-tooth comb. When he sells out to SCO [so he can actually get his threats into the courts and the news], you will want to know how many of your vital organs, children, and relatives that they are going to go after.
I say, GOOD RIDDANCE NESSUS.
With stunts like this, would you trust Tenable to protect your network?
No.
As I've already mentioned, Renaud has never considered his project to be under the GPL. Oh sure, he knew it was under it, but flaming anyone and everyone that he suspected of "working at a company" or "using nessus for profit" or "doing anything that didn't meet Renaud's fancy" was not exactly uncommon.
The reason that there's not a serious community around nessus is Renaud.
Uncheck this option to avoid killing (and eating) your sensitive network devices.
I think many of us in the security community have always had the feeling that Tenable was less than forthcoming about their plans. I can remember many a security colleague mentioning things to me about the people behind Nessus. It was that sort of hushed tones, something is wrong kind of thing. Being the skeptic, I initially discounted those conversations.
Later on, Tenable started to make commercial only modifications. The truth started to come out.
Lets get this straight - the only reason why many of us chose Nessus was because it was Free & OSS. We could have just as easily chosen other tools to use instead. The commercial vulnerability scanners of the earlier era were far better at that time.
Now they want to change? Good luck.
I'm looking forward to whatever OSS tool takes the place of Nessus.
Oh and another thing too, on setting the record straight. Tenable might be the sole authors of the core scanning engine, but they definitely benefited *GREATLY* from external plugin authors.
Oh yeah he wanted to sell software and only sell software!
That's always been one of my points. If I wanted to sell T-shirts and tote bags, I'd already be doing that. If I wanted to be a consultant, I'd already be doing that. If I wanted to repackage commoditized software like the IT equivalent of a bottled water company, I'd already be doing that.
I never wanted to do any of those things. I always wanted to sell software, so I'm hooked up with a company that does that, none of it's Open Source, and I'm quite happy. Oh, and might I add that thew new Slashdot CSS business is a piece of crap--I can't even preview this post properly because my text is layered on top of the parent post! Do I want to wade through Slashcode? Hell no! That's not freedom. That's Slashdot's job.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?