Slashdot Mirror
DoD Study Urges OSS Adoption
Krishna Dagli writes to mention an Ars Technica article about the Open Technology Development road map, a report for the U.S. government advising the DoD on ways to integrate OSS into DoD policies. From the article: "The report argues that the standard practices associated with purchasing of physical goods are not adequate or fully applicable to software. According to the report, the DoD is 'limiting and restricting the ability of the market to compete for the provision of new and innovative solutions and capabilities' by 'treating DoD-developed software code as a physical good.' The report also points out that utilizing open source technology will force the commercial software industry to respond with greater agility and competitiveness."
How many applications can you name that the government owns and are written in Ada? (rhetorical).
You may not be able to name any, but I can, because I work on developing them [yes, now, 2006]. The general trend ATM in my particular little neck of the woods seems to be moving slowly towards Java, but there is a TON of legacy stuff we still support, and continue to develop.
Want to back that up? Or are you just a FUD-monger? Last I checked the DoD ran a pretty tight ship and actually bothered investigating their hardware and software purchases more thoroughly than most Fortune-500 types do.
- Michael T. Babcock (Yes, I blog)
I work in the defense industry, and just this past Friday I was chatting with some folks from the Air Force base where our products are used. We were talking about how the DoD is mandating that all ftp transfers be shut off by the end of this year due to the lack of security. Everyone has to move to OpenSSH within a few months, but this is in stark contrast to a few years ago.
When the DoD first started using ssh for secure data transfer over the internet, OpenSSH was banned because it was open source. The thinking was that since anyone could view the code, any attacker could analyse it and find exploitable flaws. It was mandated that a commercial, closed source alternative be used instead. According to the DoD, this was a lower risk since the evil hackers wouldn't have access to the source code of their implementation. Nevermind the fact that the defense department itself wouldn't have access either, and therefore wouldn't know what flaws or - gasp - backdoors might exist!
The people I spoke with still had the impression that the DoD considers open source to be a security risk, rather than buying the argument that it's more secure due to more eyes examining and refining the code. What's changed now is that they view this as a manageable risk, as opposed to the past when it was deemed an unacceptable risk.
So there's still a long way to go in changing the culture from one that views open source as a risk or liability to one that views it as a strength. But we're making progress.
Actually, the 'no military' clause was a takeoff of Asimov's First Law and said that a modification of the software was not allowed to be used to harm a human being. It's still a stupid clause though.
Please, for the good of Humanity, vote Obama.