Slashdot Mirror
DARPA Publishes Tons of Open Source Code, Data
An anonymous reader sends this news from The Verge:
"The Defense Advanced Research Projects Agency, or DARPA, sponsors a lot of technology through grants to universities and private labs, with projects running the gamut from robots to electroencephalography caps, to software and new programming languages. A lot of that knowledge is open source, but it hasn't always been easy to access. Today, DARPA has responded to requests from the research and development community by publishing the DARPA Open Catalog, a website that aggregates source code and other data for all public DARPA-funded projects."
Chris White, DARPA program manager, said, "Making our open source catalog available increases the number of experts who can help quickly develop relevant software for the government. Our hope is that the computer science community will test and evaluate elements of our software and afterward adopt them as either standalone offerings or as components of their products."
Can source code be measured in tons?
not open-sourced yet?
This is a good start. If "we the people" pay to develop software, then it makes sense to ensure that "we the people" can use it, improve it, and distribute those improvements by default. See http://freethecode.org/ for others who think that makes sense too.
The URL http://www.dwheeler.com/govern... has a longer list of software released by US governments (federal, state, or local) as open source software. It even identifies a few meta-lists like this one. I'm sure it's incomplete, but it shows that US governments do release open source software. I'd love to hear of other examples of such software (with URLs that prove that the government paid to develop or improve it).
- David A. Wheeler (see my Secure Programming HOWTO)
It used to be that everything the government made was public domain, so more open than open. There was a nice library of this software. Then the law changed. It should be changed back.
Pre-hacked software!
if ( strcmp( cmd, CMD_INNOCUOUS ) == 0 && user = root ) {
}
printf( pattern, arg1, arg2, etc );
In all seriousness, the code will need a huge audit before I'd use it. If any of it requires a special compiler then it's garbage (can't trust the compiler, as Ken Thompson showed). Even if obvious exploits are eliminated, it could still create a series of machine states that trigger firmware or microcode backdoors, etc. True, if your hardware is fucked you've got bigger problems, but what you fail to realize is that above espionage the malware tries even harder to remain undetected, so even if pervasively installed they must be triggered selectively and discreetly. The point isn't to wear a tinfoil hat; The point is why even risk it when there are alternatives?
TL;DR: Is was secret, it is unsafe.
Any code can have backdoors. Any open-source code can be checked in the same way for backdoors. So what's the difference?
On the headline: though one might call publications and code "data", that "term of art" is better applied to things like databases and actual "data"... And I don't see them here--just code and publications.
I'm not at my own computer but I'm at one I could log into slashdot on, except it loaded that god damned beta page with only two links: slashdot's front page, and Dice Holdings. Seriously, Dice, did you buy slashdot to kill it?? WTF???
HOW DO I FUCKING LOG IN ON THIS HORRIBLE, ABYSMAL, PIECE OF SHIT INTERFACE???
DARPA Publishes Tons of Open Source Code, Data
Why does everything think it's so cool to use a comma instead of the word "and" in a headline? Does the printed media even still do it?
systemd is Roko's Basilisk.
Your tax dollars at work
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo! http://goo.gl/J9bkO
I seriously don't get how this is possible. Weren't we all told that works by the federal government automatically fall into the public domain (except classified works) since the federal government *can't* hold copyrights? How is having a university create the work with federal money any different from the feds doing it themselves? (It would be a "work for hire" if it *were* copyrightable.) And the whole concept of copyleft licenses depends on copyrights, ironically, so you can't release something under GPL etc. if you don't hold the copyright.
So this all sounds as if we're supposed to be happy about the government actually doing much less than it was supposed to do, or overreaching and doing what it can't do, depending on how you look at it. Every single line of code they've ever written is ours ours ours, no strings attached, unless it's classified.
OK rip me to pieces.
Any code can have backdoors. Any open-source code can be checked in the same way for backdoors. So what's the difference?
AC's incredibly paranoid post was pointing out that completely innocent-looking code may put a given machine into a state that triggers some seemingly unrelated [closed] system into a backdoor state. And one would have no way to check for that in the code given. So your best bet is to destroy your computer and go live off the grid in Antarctica so nobody will spy on you ever.
I've worked on a few of these projects, and seen and written far more of such code than is really quite wise. (My eyes, my eyes!)
A lot of it, not all, but by far most is well past critical mass. I've gone to folks and said "I need a message whenever you reach state X", they say they can't do it. I look at the code, and they're right. You really can't get there from here.
I mean, bright people and all. Really talented folks! They don't start out trying to write bad code. But deadlines and late nights and constantly changing objectives, often changing radically/drastically more than a dozen times a week (aka many times a day) over a period of months or years, never time to rewrite or refactor, constant insane levels of overtime, it all takes a toll.
So, cool that they're doing it. But I wouldn't count on getting much productively out of it.
I'm from Belgium, so I'm all for this, but do any Americans mind that their tax dollars are paying for software that Russians, Chinese, Iranians, etc. can download and use free of charge?
I suppose this thing is hard to open "partially", it just seems strange to me.
Browsing a couple of random code repositories listed in their archive-
I noticed alot of Arabic datasets that seem to be created/dev in the Kuwait area...
Is the US outsourcing tech dev to the Arabs, and publicly posting the results?
Or perhaps the US ships developers over to Kuwait to code?
My first guesses seem unlikely.. but it is very very odd data.