Slashdot Mirror
UK Conservatives Slammed Over Open Source Stance
Golygydd Max writes "The UK government has been criticised by the opposition Conservative (Tory) party for its lack of support for open-source software. Now, according to Techworld, a security company that has examined the Tory plans has come out against the use of open source software, citing the number of security problems inherent in the software. This is a sensitive issue for the UK government, still smarting from the loss of 7m family records from HM Revenue and Customs in 2007. What makes this criticism interesting is that this is an attack on the policies of what will certainly be the next British government — it's unusual for a party to be criticised like this before it comes to office. It's an indication of how IT is going to be a battleground in the future general election."
> it's unusual for a party to be criticised like this before it comes to office
Clearly timothy is unfamiliar with UK politics.
A link to the company's study: http://www.fortify.com/servlet/download/user/OpenSource_Security_WP_V5.pdf
While they raise a couple interesting points, my first impression is that they broadly generalize from a small sample set. Specifically, they only look at about 10 Java projects (including Tomcat, Hibernate, and JBoss), and proceed to conclude that the open source community is unresponsive to security threats. Conspicuously absent are any Linux distributions (let alone any *BSD... they have obviously never heard of OpenBSD), OpenOffice, or any tools likely to make it into desktop use for the UK government.
Oh, and the solution to all this apparently is to rely on their company's security auditing services to make sure that your company doesn't have "hidden security holes".... Riiiight....
'Every story, if continued long enough, ends in death.' --Ernest Hemingway
Some branches of the UK Government still do develop software and publish it with very permissive licenses. For example, JISC (the Joint Information Systems Committee) has sponsored a number of projects to produce open source software in higher education. And various other arms of the British Government always have spent huge amounts of money through private firms, often falling flat on their faces. Government projects failing isn't a new invention.
Fortify Software is not exactly a neutral party for conducting studies of the fitness of FOSS for enterprise software use. Half its Board of Directors have ties to enterprise software and service corporations like PeopleSoft, Sybase, Oracle, and Microsoft. I think I might get a second opinion.
Here in Australia we have two main parties with the balance of power currently held by one or two minority groups. The main parties are virtually indistinguishable from each other except to the highly trained eye. In order to get any legislation through, the party in power has to woo the minority with predictable and hilarious results, such as the Great Australian Firewall.
Australian politics is best summed up by the fact that our most famous Prime Minister held the record for downing a pint and our current was caught in a strip club during a trip to the UN. This would have been a massive scandal, but he claimed he was too drunk to do anything or even know where he was, which only increased his popularity.
We're on much more familiar terms with yachts and boats. Members of parliament are likely to be found fishing from them, comparing engines and encouraging people to 'chuck a sickie' when we win the America's Cup.
A three-way homosexual romp would be considered un-Australian, unless you're in Sydney during Mardi-Gras when I believe it's mandatory.
Could we have the name of Obama's brother's drug-dealer's enforcer? He really couldn't do much of a worse job than any of the clowns we've currently got and at worst, could help 'shift' the balance of power.
I've yet to be in an enterprise which uses enterprise-level change control.
Working for one of the world's largest commercial companies: Closest thing to "source control" was a rigorous automated backup process across network shares.
Working for a small commercial company which sold commercial data processing tools for some of the world's largest commercial companies, and the U.S. Military, and various parts of the U.S. Government: Closest thing to "source control" was laws requiring our code be held in escrow for every release. We routinely released completely untested versions and claimed that it was a re-build of the same sources. Eventually management was convinced to start using source control after asking if anyone had an old copy of a file lying around and I quickly produced it from my local repository. Just before I left, I brought up the issue of segmentation faults and memory corruption, and was told "we can't avoid signalling if we're given bad inputs".
Working for possibly the largest I.T. Company in the world, processing data for the U.S. Government: One person in charge of source control. No branching allowed. Occasionally heard complaints from the guru that people were overwriting each-other's changes. Never heard the word "security" mentioned at any point. Found out I could get a root shell and modify anyone else's source code by passing bad parameters to the reporting system.
-- 'The' Lord and Master Bitman On High, Master Of All
err... less of the FUD please.
First of all, why on earth are you assuming a multi million dollar project is going to be using software supported by some guy called bob?
Rewrite that as using open source software supported by Canonical, Novell, Red Hat or Sun, and all of a sudden Open Source is competing on much more equal footing, and your first argument goes out of the window. After all, you could just have easily bought some closed source software off 'Bob' for your multi-million pound project.
What that, you don't trust Bob's software, and would rather buy from a big company? Funny that.
And do you *really* think Microsoft's EULA disclaimers don't apply to large organizations? Bill Gates didn't get Microsoft to where they are today by the company being dumb. I've seen their volume license terms, and if anything they're *more* restrictive, not less. By all means, quote me a paragraph or two from one of these 'favourible' EULA's that show me I'm wrong, but somehow I don't think that's going to happen.
OSS lacks QA - show me a OSS project that government is likely to use that has any quality assurances. the big font stating "use at own risk" is a massive turn off for government and rightly so.
That may be true, but part of accepting the risk of OSS is that you also can take an active part in making it better. And in some cases, perhaps more so than by being a beta-tester of a closed commercial software. Provided that a particular OSS is fairly mature in the project cycle, has a fairly large userbase, and has a big enough team of developers who are responsive and attentive to the users, you can get a nice development and feedback loop that rivals or exceeds the QA testing of comparable commercial offerings.
(Even if you can't program worth a gnat's fart nor read source code, nor have money to donate to a project, as an OSS user you can still contribute. You do your part by reporting all unknown bugs, the conditions that cause them, and by discussing particular interface issues and possible fixes or improvements.)
It may not have any assurance of quality, but with the great possibility for refinement in some OSS applications, that doesn't mean there isn't any quality there. More often than not, OSS also has the goal achieving excellence. Some very good OSS applications have made their name and reputation on that aspect.
Which means that he doesn't really know what goes on in London.
However, and you omit this reason (which is WHY it got informative mods) and it is 100% true. A HUGE number of people STILL blame anything that's going wrong now with what Mrs Thatcher did. They still say you can't vote Tory because Mrs Thatcher was a Tory. They complain that the problems are all because we've been turned into Americans by Mrs Thatcher.
REALLY weird.
I would beg to differ. I do this because I am one of the people advising, well indeed pushing OS within the Conservative Party, hence the AC moniker.
While it may used as a political football there is a good reason also for getting FOSS into Govt. It saves money, which is always good, and if we get Govt to use it, we can get schools to use it and hopefully start to reverse the abysmal decline in coding and computer science in our schools. That's my agenda for pushing it anyway - it's something that the country needs in the short term to save money and that will have real and tangible benefits in the long term in developing and furthering a knowledge based economy