US Dept. of Defense Creates Its Own Sourceforge

mjasay writes "The US Department of Defense, which has been flirting with open source for years as a way to improve software quality and cut costs, has finally burst the dam on Defense-related open-source adoption with Forge.mil, an open-source code repository based on Sourceforge. Though it currently only holds three projects and is limited to DoD personnel for security reasons, all code is publicly viewable and will almost certainly lead to other agencies participating on the site or creating their own. Open source has clearly come a long way. Years ago studies declared open source a security risk. Now, one of the most security-conscious organizations on the planet is looking to open source to provide better security than proprietary alternatives."

Comments

~obscurity = security?

[rlseaman]

Denigrating the concept of security through obscurity is not the same as claiming the inverse holds. This should be an interesting experiment in whether subjecting code to an early phase of public hazing reduces security holes and risks of all sorts.

Re:~obscurity = security?

[Anonymous Coward]

I have a server running somewhere on the internet.
It has an IPv4 address with an open port 666
The password is donkeydick69

If you can't find and login then obscurity does equal security.

Re:~obscurity = security?

[Anonymous Coward]

You have an unusual definition of security. Let me tell you a few ways that having an obscured login name does not make you secure:

Insecure server or service: By virtue of running a machine connected to the internet with an open port attached to a program, you are opening a potential security risk.

If you can't find and login then obscurity does equal security

You presume that login credentials and IP addresses are "unfindable". Warrants, interrogation, torture, greased palms, all of these things can easily circumvent the fact that one does not know information about your machine _right now_.

Obscurity always sucks. There are plenty of easy ways to provide security without having to rely on the fact that a second party does not know easily found information.

Re:~obscurity = security?

[Srin Tuar]

OK, you missed the entire point of the maxim "Security != Obscurity".

It is a truism. The point is this: any secrets will eventually be leaked, whether you know it or not. Things that are easy to change, such as keys and passwords, are relatively low risk. Things that are very difficult to change, such as algorithms, are very high risk.

If you count on the fact that your crypto algorithm or operating system is secure because its obscure, then when its leaked you will be facing a catastrophic disaster. Instead of losing the data on one communication or one server, you face a organization wide vulerability, and compromise of past communications.

The extra security gained from keeping the algorithms secret pales in comparison to the disaster of having them be weak.
Getting as many eyes on this type of code as possible is the best way to mitigate risk.

After that, you still keep as much secret as possible.

Re:~obscurity = security?

[FlyingBishop]

You're missing the point. Good processes are hard to come up with. Pick a good process that has some well-defined unknown, something that you need to keep safe, and you're assured that no one will break your security. Pick a bad process, and someone may tell you.

If you keep your process a secret, on the other hand, you have a host of unknowns - unknowns you do not know - that may provide someone access to your system. The point is, relying on a variety of ill-defined unknowns is inferior to relying on a single, well-defined unknown.

Re:~obscurity = security?

[mazarin5]

The point of it is that things like "Oh don't worry, nobody would think to look at /admin.pl so there's no point in putting a password on it" is not a good idea. Of course something has to be unknown or inaccessible for good security - that's not the same thing as claiming your system is secure when you're just hoping somebody doesn't notice a gaping flaw.

There's nothing wrong with obscurity in a secure system, but obscurity alone is not genuine security.

forgemil.com?

[1u3hr]

Okay, why the hell does the DoD call the site "forge.mil" but actually host it at "forgemil.com"? If they can't get a real .mil site, who can? I thought it was some phishing scam. "forge.mil" doesn't even resolve, let alone redirect. And ".com"? Government reserved .gov, .mil and some other domains for its exclusive use. Why on earth are they using .com?

Re:forgemil.com?

[1u3hr]

PS: checked out forgemil.com: It's registered at Godaddy. Great. Are we sure this isn't some Nigerian scam? (I think the Chinese or Russians would be more subtle.)

Re:forgemil.com?

[imamac]

Nice. It even points the user to ANOTHER non-.mil site to download a PKI certificate. That settles it for me. This is NOT the military.

Re:forgemil.com?

[legirons]

You know it's the right site, because its certificate is signed by the DoD CA.

Except that CA isn't installed in any browser.

And the site to download that cert is signed by the cert itself. Security by circular reasoning.
   

Re:forgemil.com?

[Anonymous Coward]

forgemil.com is for public access to information about what the project/service is. It explaines, quite clearly, that to access forge.mil, you will need either a DoD-issued pki cert (CAC for you DoD folks), or a cert from a DoD-trusted source. All .mil infrastructure stuff is pki protected by policy. It also explains in the FAQ why you get the ssl warnings about untrusted certs. It also tells you how you can download the DoD root certs (they only provide installs for Windows; you'll either have to dig around to get the certs for other platforms or just create an exception in your browser).

Re:forgemil.com?

[Vertana]

The reason for that is, you have to be in the DoD and you receive the cert by CaC (DoD ID cards which double as a smart card with your PKI certs and authentication information). This forces you to obtain the certs physically and in person at a DoD site (ie ID Center on a military base, etc.).

Re:forgemil.com?

[RyoShin]

But wait, there's more!

DefenseLink is a DoD site that lists all DoD sites. Forge.mil(.com) is not on that list. Of course, it could be bureaucracy acting slow.

Second, WHOIS contact connects to an individual at collab.net, another sourceforge-like site. Were this a government site, I would think they would have it registered to a position in a department, or at least a c/o address for a military/goverment institution, not an individual.

Just to be sure, popping the given address into Google Maps returns what looks like a residential area.

So this is either a horribly managed project (not surprising for the government), or some weird scam of sorts.

Re:forgemil.com?

[mysidia]

Nice. It even points the user to ANOTHER non-.mil site to download a PKI certificate. That settles it for me. This is NOT the military.

The homepage of the site they are pointing to https://www.dodpke.com/ Says the site has moved to: another url

Which refers you to: this document

Which states the following:

Alternate method of retrieving DoD Root Certificate

If you have trouble accessing the page listed above you can also visit the following page to download the DoD Root Certificates: https://www.dodpke.com/InstallRoot.

The dodpke.com site is also linked by http://www.nsa.naples.navy.mil/bno/PKI/index.htm.

I cannot conclude that this is a scam, it appears to be probably legitimate, or at least the cert information is legitimate.

What they don't mention though is it's probably more secure to use a workstation that already has the certificate installed, download the file to a medium, then use the medium to install the certs on the 'fresh' workstation (No risk of man-in-the-middle while connecting with SSL to a site without a trusted cert).

dodpke.com has a registration date in 2002

Huh?

[RDW]

If it's 'limited to DoD personnel for security reasons' in what sense is it 'Open'?

Re:Huh?

[Vertana]

Yes, which claims a standard United States Government agreement which claims they own the computer, the data, your soul and anything else that may come in contact with it... but it also states "Forge.mil is currently in beta with limited operational availability. General availability for unclassified use is scheduled for Spring 2009." So, one could safely assume (at this point) that with the PKI Certification that's needed and the agreement they expect only DoD computers to be accessing it at the moment. However, at some point everything stated will be changed (or they'll change their mission from being 'open').

We needed this years ago

[superid]

When I was first hired as a budding DoD programmer a long time ago, one of the first things I asked is "where is our library of stuff that has been developed locally?"

I might as well have asked "where is my +3 mace?" because we didn't have that either.

I'm glad this is finally happening.

Open the flood gates

[auric_dude]

Open source code, Open Government http://www.whitehouse.gov/ and Open Source Intelligence http://en.wikipedia.org/wiki/Open_source_intelligence all good ideas that may well speed things along and save the tax payers some cash.

Studies?

[Wolfbone]

Years ago studies declared open source a security risk.

Since when did risible falsehood and fallacy filled rants written by swivel-eyed ideologues count as 'studies'?

http://www.sourcewatch.org/index.php?title=Ken_Brown

Hopefully all the GOTS software will be there too.

[robkill]

In most cases, if software was developed under a government contract, then the government has full rights to the source code. It would be a great starting place for updating a number of existing applications. Version control and vetting of results could be problematic in some cases, but not impossible to overcome.

For those of you trying to connect...read the FAQ

[Bearhouse]

"Though it currently only holds three projects and is limited to DoD personnel for security reasons, all code is publicly viewable"

No, it's not. Code posted to .mil is only available to those with sufficient authorisation. The .com site is publicly available for those seeking more information.

So, code will be NOT be 'publicly' available - only to those on secure. Kinda as you'd expect, but rather a long way away from real FOSS.

One project already works and is in use.

[will_die]

It looks like the military has solve the problem of time travel and web master has let it slip. According to the FAQ
The Forge.mil effort started development in October 2009 and the first capability, SoftwareForge, is now available for limited, unclassified use.

I hope this is a fishing site

[yorkshiredale]

Clicked through the site a little to the 'PKI Online Training' section, and I'm informed that I must :

1. enable flash

2. enable cookies

3. enable javascript

4. disable pop-up blocking

I desperately hope this is a scam, since the alternative possibility is just frightening