Nessus Closes Source

JBOD writes "As reported at news.com, the makers of the popular security tool Nessus are closing its source code. Although it will will remain free as in beer, Nessus is dropping the GPL license for the upcoming version 3 of the software. The problem appears to be that Tenable Network Security (the company which primary author Renaud Deraison founded around Nessus) isn't making money because it's competition is simply repackaging their product. Deraison's writes "A number of companies are using the source code against us, by selling or renting appliances, thus exploiting a loophole in the GPL. So in that regard, we have been fueling our competition, and we want to put an end to that." He also notes that the OSS community has contributed very little to Nessus in the past six years, so they were reaping no benefit from using the GPL." Update: 10/06 22:48 GMT by CN : Nessus' Renaud Deraison wrote me to let me know that the company is "good money-wise," but has become annoyed with competitors repackaging their product.

Comments

GPL Considered Dangerous?

[(1 -sqrt(5))*(2**-1)]

To that end, I've become an early adopter of the Artistic License 2.0, Perl 6's upcoming license. From the preamble:

This copyright license states the terms under which a given free software Package may be copied, modified and/or redistributed, while the Originator(s) maintain some artistic control over the future development of that Package (at least as much artistic control as can be given under copyright law while still making the Package open source and free software).

Re:GPL Considered Dangerous?

[Nasarius]

the Originator(s) maintain some artistic control over the future development of that Package (at least as much artistic control as can be given under copyright law while still making the Package open source and free software).

Is it just me, or is this bafflingly ambiguous? I'm sure if I read the whole thing it would be clear, but I have no idea what that sentence is trying to say. I'll just stick with BSD for now.

Re:GPL Kool-aid

[Mr. Underbridge]

Free as in beer is cool and all that, but if one excuse for dumping GPL is that they aren't getting any benefits in the way of free code, I guess they weren't really drinking the Kool-aid in the first place, eh?

That's *the* valid excuse. They were in fact drinking the kool-aid - they believed that by contributing to the codebase, that it would make everyone's project stronger. As it happened, they kept giving and the competition kept taking. The community didn't give back.

I agree, though, they could have written a license that gave other companies the right to reuse the code for non-commercial uses only, and that would have been a better compromise.

Competitors

[SpaceAdmiral]

If their competitors were just repackaging their software, they should have put some massive bugs in it.

Re:Competitors

[vladkrupin]

Yes, they will (and are) scrambling. But not because they have little understanding of the underlying code. No, that's trivial. The real value is in all the updates, signatures, definitions of various vulnerabilities, etc. People come up with them all the time, and nessus always has the latest & greatest, and everyone else seems to be weeks, if not months behind. Unless, of course, they are building on top of nessus as the engine, in which case they are always up to speed.

I am have some firsthand familiarity with this. I know of a company that essentially built their whole business around nessus as the core of their product. They added tons of bells and whistles to it, packaged it nicely, made it user-friendly, and shipped it. For a lot of money. Sounds silly, but I think they had a good product -- it actually made network security manageable. Just knowing what is vulnerable on your network is not good enough. In fact, if the network is of any appreciable size, that's not good at all. You need to filter out tons of noise -- false positives, things that you know are vulnerable but you do not care about for one reason or another, need to do some basic triaging, and be able to monitor trends and tendencies over time. So, there's a great need for a good presentation layer on top of nessus, and several companies recognized that need and built their business models on that. And that was good, it was really, really needed.

Then, a couple of years ago it became harder to get nessus updates. Nessus started detecting scrapers that were getting latest nasl updates and banning them. Then they started licensing those updates differently, I think, so it was harder for closed-source companies to use them. So, that company started rewriting newer NASLs in a "clean room" environment to stay in the legal clean waters. While the practice was silly, it made sense -- it was either that, or GPL the whole thing, and they could not figure out how to build a viable business plan if they were to GPL their whole product. I must admit that this is a very challenging, and at times an impossible task. I must say that I applaud them for going through all that extra effort to stay clean and respect the GPL -- a lot of other people do not do so.

So, has nessus just droppped a bombshell on all those companies that were building their stuff on top of its enine? Not really. The change has been coming for quite some time. Recent NASLs haven't been available for a while under a liberal license. In fact, I think that new software features and bugfixes in version 3 are not even all that important or needed. Signatures and definitions for newer vulnarabilities are. So, all those companies had ample time to change, if they wanted to. The company I was referring to did a good job, as far as I know -- they added a bunch of features beyond what nessus provided -- various network discovery, some windows-specific stuff, etc. I do not know much about what they are doing now, but I know that they worked hard to shift from a nessus-wrapper to a product that could stand on its own. And, to the best of my knowledge, they succeeed. Some others did not see the writing on the wall. So, they wasted time and this change of license will be the latest nail in their coffins. Stuff happens. Don't feel sorry for them. Nessus departing from the GPL is a sad fact of life, but... it's understandable. They can do it. And freeloaders deserve little compassion.

just my 2c...

nessus is dead, long live gnessus?

[nanop]

So (provided there are interested developers), the last GPL-licensed version will likely be forked and a new project formed... I'd guess "gnessus".

Re:nessus is dead, long live gnessus?

[dekemoose]

So a project which was getting very little contribution from the OSS community is going to be forked into a different project that will get all sorts of support from the OSS community? Good luck with that.

Re:nessus is dead, long live gnessus?

[robla]

> So a project which was getting very little contribution from the OSS community is going to be forked into a different project that will get all sorts of support from the OSS community?

Yup. Funny how that works. It happened that way with SourceForge/GForge. It sorta happened with NCSA httpd -> Apache. Probably a handful of other examples out there.

It'll probably evolve from the needs of the Debian package maintainer needing an "upstream" for security patches, etc. Or maybe Gentoo, Fedora, etc. You get the idea. I use Debian as an example because of they'll need something that continues to satisfy the DFSG. Thus, if Nessus is still going to remain, it'll eventually need to be updated.

Re:nessus is dead, long live gnessus?

[Principal Skinner]

"So, if it does fork and the open source fork gets a lot of development that would mean of two things. Either the developer is understating the community involvement or he wasn't that good at drumming up interest in community involvement."

A developer who wants community involvement really has a lot going against him. There are only a handful of Linuxes, Mozillas, and KDEs, out of the hundreds of thousands of OSS projects out there. Probably only a single-digit percentage of OSS projects get any significant community help. To get in that percentile, you have to have an interesting, high-profile project AND be VERY good at drumming up support.

Properly stated, there's a third possible interpretation of a successful fork: the maintainers were doing a fine and dandy job and no one from the community had an itch to scratch, until the gravy train stopped.

So what's left??

[eno2001]

SATAN and SAINT appear to be gone. Now Nessus. What other projects are out there for security auditing tools? This is not a good trend.

Re:So what's left??

[Kelson]

SARA (Security Auditor's Research Assistant) is based on the old SATAN design.

Re:So what's left??

[tgd]

One can only hope this one disappears. Anyone who has been on the receiving end of a security audit done by some dork who lives in his parents basement who hung out a shingle as a security analyist and basically only runs Nessus without any interpretation can tell you what a HUGE false-positive rate its got. I know how much time *I* waste responding to them, its staggerirng to think how much time throughout the industry is wasted because of them.

Security tools like SATAN and NESSUS (and even tools like NMAP) are a poor substitute for someone who knows what they're doing, and just make being secure harder for everyone who has to deal with them.

thus exploiting a loophole in the GPL.

[temojen]

Or rather, using the GPL as it was intended, to prevent vendor lock-in.

Fork?

[bcmm]

This sort of thing almost always results in someone making a fork. Is there really so little OSS involvement that a GPL fork (from the most recent GPL version) would not be able to compete with the closed app?

Well, this has been coming for some time...

[cowbutt]

As someone who encouraged a former employer to pay for a Nessus support contract when it voluntary, someone who personally contributed a minor enhancement to the engine, and as someone who actually used Nessus professionally (i.e. manually verifying the results it gave, rather than selling the reports as-is to customers), I've been pretty disgusted by the way competitors have abused Renaud's generosity.

Hopefully, the time will come when Renaud and crew feel that they can re-open the code, possibly under GPLv3.

Re:hmm

[Nichotin]

People haven't contributed anything special to the scanning engine. They would have to strip that out, but as already mentioned, it was no biggie. They hold the rest of the copyright, and are legally allowed to change the licence, but they cannot restrict any usage of previously released source code.

Hardly a "loophole"

[spitzak]

The "loophole" is an intended result of the GPL. Since this is it's purpose it makes no sense to call it a "loophole" whether you like or dislike the GPL.

In any case, they are perfectly free to do this. They are also free to release the source code in a way that does not have this "loophole", such as by using normal copyright. Equating "being able to see the source" with "GPL" is a bit of FUD.

Fair enough

[overshoot]

A number of companies are using the source code against us, by selling or renting appliances, thus exploiting a loophole in the GPL.

That's not a loophole, that's how it's supposed to work.

He also notes that the OSS community has contributed very little to Nessus in the past six years, so they were reaping no benefit from using the GPL.

His code, his rules. As long as he's not including code that others contributed under the GPL, that is.

The question is, has he either cleared the code, acquired copyright, or licensed it from the authors?

Re:hmm

[jsight]

I think the presumption is that one of the following is taking place:

• 
     
• There were no external contributers - Nothing needs to be done... just release the new version under the new license.
• 
     
• There were external contributers, who signed over copyrights - If all external contributers signed their copyrights over to Nessus (as is the policy for contributors to some products), then they would already own all copyrights.
• 
     
• There were significant contributions by external contributors, who did not sign over copyrights - They would have substantial rewriting to do.

From their indication that they haven't seen any significant help in six years, we can presume that the third possibility is unlikely.

And, of course, old versions will still remain under the GPL (happily).

Re:hmm

[Vellmont]

They cant go "closed source" - they've licensed it under the GPL. Unless they rewrite the app from scratch, or remove any code from parties that havent agreed to the new license... If linus wanted to close-source linux all the sudden, he couldnt do it either.

That's actually not true at all. They still own the code, the GPL is a license, not relinquishing ownership. What they can't do is use any code contributed by anyone outside the company. That code they'll have to re-write since it's licensed under the GPL and doesn't belong to them.

And obviously, the existing version cant be relicensed either. The latest release under the GPL is stuck there from now until forever.

They can't relinquish the license of course. Anyone that wants to take that code and maintain it themselves is obviously free to do so.

You do not get Open Source.

[RevDigger]

This is not a "loophole in the GPL". It is exactly how the GPL, and similar OSS licenses are intended to work. If you don't want other people freely using, modifying, and even selling your software, then do not open source it.

Also, it seems rather rich that they are selling a product that depends on a number of other OSS projects (expat, gettext, gmake, libiconv, libtool) and complaining about people making money off their code.

        - H

Re:hmm

[Jeff DeMaagd]

I think you misunderstand. It is their program. The owner of the program can have multiple licences. The GPL gives non-owners specific rights and specific requirements, none of those licences necessarily have the same effect on the owner as it does the user.

While they can't "take back" the versions that are already out there, but the copyright owners themselves can make a variation and not release the source of the variation.

Maybe an OSS future isn't that bright afterall

[ShatteredDream]

Open source software has worked pretty well in areas that provide services such as operating systems, development tools and server software because in those areas the people who need them also need support and have a vested interest that they are aware of in supporting the tools they use. I don't think that desktop software which is typically sold, however, works well in that respect. Most users have no reason to believe that they have a vested interest in supporting OpenOffice and I would bet that if Sun dropped their support the project would implode.

Let's be serious about this. The GPL provides **no** protection to companies whose business model is built on selling software that doesn't need support contracts or anything like that. If selling software is your business, then the GPL is basically a suicide pact for your company and the same applies to all other open source licenses because your competition can repackage your millions and billions of R&D dollars/Euros/Yet/etc. and you get... precisely what?

It's funny how much having a girlfriend that you are working toward marrying and realizing that your idealism cannot feed your children will change your perspective on open source software. I like Linux, love Tomcat and am eager to give PostgreSQL a shot and I run my own nightly builds of Firefox, Thunderbird and Sunbird on my Windows laptop, so I am definitely not some fanboy for either side. So let me just say this to most of the zealots: OSS is never going to win in the long run because developers have families to support and will not slit the throat of the goose that lays the golden eggs (though sometimes they seem a little bit like bronze) that pay the bills and support one's spouse and children.

Get to that point and you'll realize that Microsoft is good because they create work for you. Same thing with Oracle, Sun, IBM, etc. Infrastructure can and in some areas should be open. However, no one is going to make money on open sourcing things like Quicken or TurboTax and other common user apps unless they are utterly useless without some expensive services provided by the company that makes them. How else are they going to make money, eh? We ought to eliminate software patents and EULAs, those are things the OSS movement is right about. However, the OSS movement if successful (and I doubt it will be in the long run) will end up making it very hard to make money in software development and maintanence. Good for this company that they realized that before it was too late. I'm glad that they chose to protect their employees and stockholders instead of pursuing Stallman's dream of a world in which software developers effectively cannot make a living directly off their code.

Re:Maybe an OSS future isn't that bright afterall

[oGMo]

The GPL provides **no** protection to companies whose business model is built on selling software that doesn't need support contracts or anything like that. If selling software is your business, then the GPL is basically a suicide pact for your company and the same applies to all other open source licenses because your competition can repackage your millions and billions of R&D dollars/Euros/Yet/etc. and you get... precisely what?

Welcome to a disruptive technology. Guess what? New things happen. Things are invented. Trends happen. People go out of business because the business model they rely on is made irrelevant. That's how a free market works.

It's funny how much having a girlfriend that you are working toward marrying and realizing that your idealism cannot feed your children will change your perspective on open source software. I like Linux, love Tomcat and am eager to give PostgreSQL a shot and I run my own nightly builds of Firefox, Thunderbird and Sunbird on my Windows laptop, so I am definitely not some fanboy for either side. So let me just say this to most of the zealots: OSS is never going to win in the long run because developers have families to support and will not slit the throat of the goose that lays the golden eggs (though sometimes they seem a little bit like bronze) that pay the bills and support one's spouse and children.

The CD-ROM put encyclopedia salesmen out of business. We could apply your same argument: "It's funny how building a family changes your perspective on cheap mass storage. I like mass storage, but it's never going to win in the long run, because encyclopedia salesmen have families to support and will not slit the throat of the goose that lays the golden eggs that pay the bills and support one's spouse and children."

Guess what? They didn't slit the goose's throat. Someone else did, and put them all out of business. Technology happens. Trends happen. People go out of business. That's how a free market works.

If you're in a business that relies on software sales right now, and they're not looking at becoming a service-oriented company, start making your exit plans now. You may not have to use them for a few years, but software is simply becoming a commodity market. The big-bucks-for-trivial-software cash cow is already dying.

Get to that point and you'll realize that Microsoft is good because they create work for you. Same thing with Oracle, Sun, IBM, etc. Infrastructure can and in some areas should be open.

Microsoft is starting to get nervous themselves. Google is the next-generation; they've already found the trend, they're already there. Microsoft is like the RIAA; screaming and throwing tantrums because they're seeing their hold on the market diminish.

Oracle, Sun, IBM, etc. are all becoming service-oriented. Buy servers and service from IBM, Oracle, Sun, etc. Oracle still has ridiculous licensing fees, but they also have ridiculous consulting fees, and there's a whole market for DBAs, consultants, and DB programmers. And since when was Sun ever a software company?

However, no one is going to make money on open sourcing things like Quicken or TurboTax and other common user apps unless they are utterly useless without some expensive services provided by the company that makes them. How else are they going to make money, eh?

Where have you been? TurboTax is already moving on. (I don't know about Quicken.) The software is essentially the same, but the laws, the rules, the numbers change every year. This is what people pay for, or they'd not bother upgrading in the first place!

However, the OSS movement if successful (and I doubt it will be in the long run) will end up making it very hard to make money in software development and maintanence. Good for this com

Re:Maybe an OSS future isn't that bright afterall

[aafiske]

I'm not sure why rude, off-base replies like this get modded up. You seem to have missed the point, adrift in a sea of cliches as you were. The grandparent poster was saying that the OSS approach will not work very well for software that cannot be supplied as a service. There is no incentive for a company such as that to open source at all. If the company meets competition in the form of OSS developers, then yes, the free market will decide who will survive. I believe it is the grandparent's contention that overall, closed-source will win these battles because in the end, people would like to make a living doing what they're doing and as such, the good engineers will end up with the companies.

From their perspective?

[ivoras]

Why isn't anybody looking at it from *their* perspective: A small, young-ish company tried to make a great product but failed to remain financially viable with the GPL license. Free-as-in-speech code is all well and great but at the end of the day, philosophy doesn't pay the bills.

Or is everyone scared that all the "You can't actually make money with GPL" rumours are true (especially for small start-ups)? ;)

The choice was probably about cost...

[lullabud]

Choice 1) Pay (a likely non-existent) legal team huge amounts of cash to come up with a new license that is legally sound in all of the respects that need to be accounted for in their position.

Choice 2) Close source code.

Seems to make sense to me...

Re:The choice was probably about cost...

[damiam]

Honestly, when the source is equal, what did he really think would set his product apart from the competition?

Nonthing; Tenable is a software dev house, not a marketing firm. So to set themselves apart, they decided to no longer allow the competition to use their code. Sounds like a sensible business plan to me.

While I love the GPL, it's not for everything. There are some cases where it's just not profitable to give away your main product. This appears to be one of them. If you can come up with a better business plan that involves leaving the product GPLed, I'd be glad to hear it.

Re:GPL Kool-aid

[massysett]

I suppose everyone is entitled to his understanding of the purpose of the GPL, but it was not my understanding that the GPL is about having a community make free improvements to one's software. My understanding is that the GPL is about giving users freedoms, not about community giveback. The FSF seems to agree.

The FSF says nothing about the GPL and community giveback. It says only that the GPL exists to give users freedoms to use and modify software. Indeed, "The freedom to use a program means the freedom for any kind of person or organization to use it on any kind of computer system, for any kind of overall job, and without being required to communicate subsequently with the developer or any other specific entity." (emphasis mine)

Free as in Kool-aid

[Thud457]

Is this Kool-aid free as in beer or free as in openCola?

Moral of this Story and Nmap Response

[fv]

I responded for the Nmap Security Scanner project yesterday. We aren't planning to follow suit. Nmap has been GPL since its release more than 8 years ago and I am happy with that license.

I agree that this is not a good trend, and the question is how to reverse it. It is important to note a key reason Renaud gave: the lack of community involvement. It is easy to take the open source tools we depend on for granted, and forget that open source is a two way street. The bazaar model doesn't work so well with everyone taking and not contributing back. In the Nessus response, I suggest a few ways that programmers and non-programmers can support projects they use and enjoy. Rather than mope over the loss of open source Nessus, we can treat this as a call to action and a reminder not to take valuable open source software such as Ethereal, DSniff, Ettercap, gcc, emacs, apache, OpenBSD, and Linux for granted.

Meanwhile, I know at least one group of experienced open source programmers that is preparing to announce a new open source vulnerability scanner project or Nessus fork. It would be encouraging for such a fork to succeed.

-Fyodor

Re:Moral of this Story and Nmap Response

[scoove]

I know at least one group of experienced open source programmers that is preparing to announce a new open source vulnerability scanner project or Nessus fork. It would be encouraging for such a fork to succeed.

Fyodor, what can those of us out here do to help make that a possibility? One of my common frustrations is that much of the open source community thinks at a very low level and rejects broader perspectives because the initiators of the projects are often exceptional programmers (at the expense of not being exceptional documentation writers, analysts, managers, communicators, etc.). Some will want to shoot me for saying it, but every technology project needs a hell of a lot more than software developers to make it go. A project needs the help of great documentation writers, testers, managers, analysts, evangelists, etc. to make it, and more importantly, needs to have a culture of taking criticism and evaluating it objectively in order to have a chance at success.

Nessus's rejection of a system vulnerability database was unfortunate but not unexpected - I smell a VC in a room with a bunch of programmers (and nothing in between), plus a bunch of sensitive "Not Invented Here" egos. Nessus needed to integrate with its user community because its success was very dependent upon their feedback. Nmap has succeeded perhaps because it is a more concise tool with a focused objective and I've seen you take feedback out there and honestly respond to it.

I agree that this is not a good trend, and the question is how to reverse it.
Success in the open source community is still a rather unpredictable, undocumented (and too often, unrepeatable) event. Successful projects like nmap have happened through their founder's exceptional ability in demonstrating more than just coding ability, yet the community does little to document, educate and communicate this aspect. Projects tend to continue to make the same mistakes. Perhaps a start would be a FAQ on successful open source project methodologies that explains that brilliant code is only one of a dozen components required for success and details the others - perhaps building upon the best practices of the community's successful projects? If Nessus and others are to make it as viable open source, we need to build upon the understanding that it takes more than great code to succeed.

*scoove*

They can do it, but forks inevitable

[Random BedHead Ed]

Contrary to a number of comments I'm already reading, Tenable Network Security can do this, as long as they control the copyright to the entire body of work. This would be impossible for some GPL-licensed software for which the copyrights to separate contributions are owned by their contributors. If I am not mistaken, I think Linux falls into this category, so Linux could not be taken out of the GPL unless everyone who holds copyrights over the many parts of the source code all agree on the new license. Won't happen.

For software that is copyrighted by a single entity, be it an individual or a company, the license can easily be changed. However, anyone who obtained the software under the terms of the previous license cannot have the rights that were granted revoked. This means if you downloaded the software and source at any time before the license change, congratulations. You have the GPL'd project in a relatively recent state, and the GPL applies.

This presents an opportunity to fork a GPL version. If enough people are interested, the fork can eclipse the original project, as X.org did to XFree86 when the latter changed its license.

GPL Screws Tenable and Tenable Screws GPL

[Anonymous Asskicker]

A month ago I submitted a story (rejected, alas) about Tenable intentionally breaking the GPL version of Nessus:

When the 2.2.5 version of Nessus was released, Brian Weaver (formerly of OpenNMS fame) was puzzled why the GPL version wouldn't scan. After hacking through the source code, Weave found the answer: strong evidence suggesting Tenable Security, the sponsors of the GPL version of Nessus as well as a commercial version, deliberately crippled the GPL version of Nessus. With stunts like this, would you trust Tenable to protect your network?

OSS problem admitted

[EraserMouseMan]

Yep, this is just one real-life example of why Open Source can only work for some situations but simply does not make sense for others. At the end of the day developers have to eat and have shelter (and provide such for their spouse/children) too.

Most people understand this principle. But the OSS activists seem to believe that smart developers can donate forever and should be totally selfless. Why is it only the developers? Developers who spent many years of their lives learning to be experts at their complex trade (programming) are expected to donate. Yet the typical help-desk types are "allowed" to charge for their consulting services when they pop a CD in a drive and install the OSS software for a client.

I'll admit, I'm a software developer. But, I know OSS activist guys who charge companies $100/hr consulting fees to implement OSS solutions that they don't pay a dime for. These guys are walking in to a firm, spending a day setting up a PHP server (or whatever) and walking out with a fat-ass paycheck.

But when a developer wants to charge for the software he writes the OSS community of activists starts hissing at him and brand him with some sort of corporate greed type crap.

Can somebody please explain this OSS-mentality inconsistency????

open source killer

[mikers]

What some open source zealots, and the vast majority of open source "consumers" don't recognize is that programmers need to eat to. Until these "consumers" stop taking advantage of open source, and start paying... Open source will stay in Microsoft's (and other big corporations) shadow, and very likely even shrink.

Nessus is not the first, and not the last. Even Hans Reiser has this problem:
See here... Hans Reiser: Doing GPL work is doing charity work [...] That should be and could be changed, but for now it is so. I have done my share of charity, and I would not have a problem doing proprietary work. I think people should keep their lives in balance, and that includes balancing charity work and better paid work. ... It is not an easy life, I am $200k or more in debt and drive a 1989 CRX Si.

Here is another: Mute file sharing. Not sure how long this experiment will last.

And one more: Daniel Robbins founded Gentoo linux, went bankrupt, got job at Microsoft

Either help these programmers feed themselves and their families, or expect other big and large profile projects to disappear and become pay-for-play.

I love open source, and contribute money to many projects -- but open source will just prove to be a fad that will start to wear thin on programmers as they get into debt and can't feed their families. The business case for open source software longterm survival is weak, unforunately.

m

Re:GPL Kool-aid

[Mateito]

I agree - in principle - but principle doesn't put food in your mouth or pay the rent.

These guys did a wonderful job. Six years contributing to software that was obviously so good that other people could make money off it. Its one thing to work on an open source project in your spare time, or to be employed by one of the few companies that can leverage free software to make money, but these guys aren't. So unless you are working on the kernel, on samba or one of maybe a dozen other projects, you can't give up your day job.

Maybe by closing the source, one of their competitors will buy them out and they will have enough money to live on and write open source code. Rather than berating these guys for leaving the fold, thank them profusely for the six years of hard work.

If you don't like it, fork it. Once GPLed, always GPLed, and only V3 and above is going closed.

Re:GPL Kool-aid

[SerpentMage]

Open Source cuts into software revenue whether we like it or not. If somebody expects to Open Source their product and then earn a living from selling licenses, well they don't understand Open Source. Actually I tend to think they are living in a dream world! The key to Open Source is added value, and not sales of software. Obviously their competition understood that and created devices!

Their call that using devices is a GPL loophole is pure BS. If somebody sells a device with the software and does not make any changes then they are entitled to that. If they change the sources then the sources have to be made available and I am sure that they did. The point is that somebody was clever enough to create a device that maybe they should have in the first place!

Here is a question, if the person's competition was making money on GPL, why couldn't he? Oh yeah he wanted to sell software and only sell software! Here's my prediction, that he will bankrupt himself after close-sourcing the software and blame it on the Open Source community!

Re:Free as in Kool-aid

[Philip K Dickhead]

Free as in Jim Jones

It's a legit gripe though

[Sycraft-fu]

This is one of the counter-arguments used against the GPL. When people start crying "Everything should be OSS", here's a case to point to of it not working.

The GPL does create problems for commercial viability in many cases. You spend tons of time and money developing something, others then market the solutions for it, you get squat in return. This is a problem. The "Well make money selling support" argument doesn't work when others are selling the support better than you can.

Now, perhaps you are inclined to think this is fine. They are better at it, so they should make the money right? Except the only reason they can, is that you put in the up front investemant to actually make the software.

What this will lead to is people deciding that open source is not the way to go, or at least GPL-style open source. If it just leads to other people making money off of your hard work, it'll really turn people off to it.

Re:GPL Kool-aid

[timeOday]

Maybe by closing the source, one of their competitors will buy them out and they will have enough money to live on and write open source code.

Maybe, and you can't blame them for changing strategies when status quo fails.

But sometimes I think the authors of popular open-source software see their user base and think "gee, what if I had $59 from each user!"... when in fact, "free" is their main competitive advantage and the only reason they have users in the first place. Charging for software licenses might save them, but it might just wipe them off the map.

WHY there were no contributions:

[swmccracken]

At least one person - Dana Epp - alleges that there is a REASON why there are no ouside contributions to the scanning core engine:

http://silverstr.ufies.org/blog/archives/000864.ht ml

Dana alleges there wasn't much give and take between Nessus and "the community" which discouraged any contributors.

[In 2002] "I was about a quarter of the way complete the port [to windows] when I ran into some issues with the NASL scripting and I tried to contact Renaud and his crew to point out some issues I found. The help I got? Squat. Nothing. Barely even communicated with me. I only ever got a couple of email responses saying "I was free to do it" when I asked if I could do it in the first place, and a follow up to an issue I found with a quick thanks."

Nessus dead. Long live Hindmost

[scoove]

The developer also expressed disappointment over the lack of community participation in developing the software, despite its open-source license.

I have to disagree. I'm a CISA (certified information security auditor) and have used Nessus in audits. About a year ago, I provided feedback regarding Nessus's tendency to damage production services, even in safe mode. These occurances were not Nessus's fault, but rather the consequence of very poor coding in various network devices. Often Nessus would cause old HP printers (HP Laserjet III was notoriously vulnerable), cheap network fax appliances, and in a couple of cases, Sonicwall firewalls to completely lose their configurations and reset to defaults. 10+ year old printers have a bit of an excuse in my book, but Sonicwall, which advertises as a security product, had no legitimate justification for this behavior. We were able to confirm this from outside Nessus scans as well.

I began reporting this behavior to the Nessus group and suggested a database of vulnerable devices to prevent analysts from getting in repeated hot water. The Tenable folks were not responsive at all and indicated their fear of civil liability due to potential disparagement of network equipment vendors products. Although I referenced numerous other sites, as well as the alternate "compatible device" approach which countless operating systems take, the idea was ignored. I did receive numerous emails from other analysts who had the same concerns.

Teneble has done a good job pushing away its user base and unfortunately moves into a hypercompetitive world of better proprietary tools. I wonder if there's an impatient VC pulling their strings.

I'll definitely support any open source effort that continues with the GPL code. How about calling it Hindmost (for all the Ringworld fanatics out there).

*scoove*

That's not the half of it.

[Zaurus]

I'll give you THE REASON why there wasn't much of a community around nessus:

Renaud

Yes, that's right. Renaud himself. Schizophrenic, anti-social, flaming Renaud. Let me illustrate:

A few years ago the company I worked for wanted to provide Nessus scanning as a service to people. The CEO himself wanted us to be good citizens in the OSS community (he was a techie before he got into management) so, not quite understanding the GPL, he personally sent an email to Renaud asking if it was ok to do such a thing. He basically got "ya, sure. just tell people that you use nessus" as a response. Of course, providing a service using stuff under the GPL is perfectly legal, regardless of whether or not you modify source code (which we never got around to doing anyway).

Fast-forward a few months. We're creating the service. We join the mailing lists and start asking a couple questions. Almost instantly Renaud flips out. To paraphrase: WHAT THE ____ DO YOU THINK YOU ARE DOING USING NESSUS? WHO THE ____ DO YOU THINK YOU ARE? COMPANIES CAN'T USE NESSUS TO PROVIDE SERVICES! ESPECIALLY IF YOU CHARGE FOR IT! SUPER-ESPECIALLY IF YOU MANAGE TO MAKE A PROFIT (and don't give us a large cut)

Ya, ok. Whatever. Renaud subsequently (in emails to our CEO) threatened legal action against us for things such as "using nessus." Legal improbabilities aside, that totally spooked management and alienated myself and the rest of the development team. Several of us have participated in other OSS projects through irc, mailing lists, forums, contributing patches, reporting bugs, etc. Such OSS participation is generally well-received. With nessus, not one of us who ever tried to participate in its "community" ever felt welcome in the least. To the contrary, every time we dipped our collective toe in nessus's pool, we came away with frostbite.

Renaud appears to have finally woken up to the legal ramifications of having put nessus under the GPL. Namely, he can't dictate what others can and can't do outside the confines of the license. If any of you are considering using nessus in the future, I highly recommend going through his license with a fine-tooth comb. When he sells out to SCO [so he can actually get his threats into the courts and the news], you will want to know how many of your vital organs, children, and relatives that they are going to go after.

I say, GOOD RIDDANCE NESSUS.

Only the beginning of their stunts...

[Zaurus]

With stunts like this, would you trust Tenable to protect your network?

No.

As I've already mentioned, Renaud has never considered his project to be under the GPL. Oh sure, he knew it was under it, but flaming anyone and everyone that he suspected of "working at a company" or "using nessus for profit" or "doing anything that didn't meet Renaud's fancy" was not exactly uncommon.

The reason that there's not a serious community around nessus is Renaud.

A little background

[brennz]

I think many of us in the security community have always had the feeling that Tenable was less than forthcoming about their plans. I can remember many a security colleague mentioning things to me about the people behind Nessus. It was that sort of hushed tones, something is wrong kind of thing. Being the skeptic, I initially discounted those conversations.

Later on, Tenable started to make commercial only modifications. The truth started to come out.

Lets get this straight - the only reason why many of us chose Nessus was because it was Free & OSS. We could have just as easily chosen other tools to use instead. The commercial vulnerability scanners of the earlier era were far better at that time.

Now they want to change? Good luck.

I'm looking forward to whatever OSS tool takes the place of Nessus.

Oh and another thing too, on setting the record straight. Tenable might be the sole authors of the core scanning engine, but they definitely benefited *GREATLY* from external plugin authors.