Slashdot Log In
Open Source In the National Interest
Posted by
Zonk
on Tue Jul 11, 2006 11:12 AM
from the penguins-for-everyone dept.
from the penguins-for-everyone dept.
munchola writes "A new report from the Department of Defense's Advanced Systems and Concepts Office recommends that the DoD move to adopt open source software and methodologies as well as open standards in order to make the most efficient use of internal resources. According to CBR, the report states that a move to 'Open Technology Development' is not only in the U.S. national interest, but in the interests of U.S. national security. OTD incorporates open source methodologies and open standards, but also takes into account the fact that the DoD has systems that it would rather keep secret."
Related Stories
[+]
DoD Wary of That "Open" Word 165 comments
joabj writes, "Why is the U.S. Defense Department still reluctant to use open source software, despite assurances from within the DoD itself? Blogging for Government Computer News, I found at a recent D.C. conference that to some extent the roadblock might be with that word 'open'."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Yay! :) (Score:3, Funny)
Bring the fireworks!
Re:Yay! :) (Score:2)
Supplied by Raymond?
2 words. (Score:3, Insightful)
This all makes now but... (Score:5, Insightful)
Re:This all makes now but... (Score:2)
Re:This all makes now but... (Score:2)
How about demand and get a hundred billion more dollars?
Has the DoD ever done any wrong in the eyes of the administration or any body of congress other than the GAO?
Re:This all makes now but... (Score:3, Interesting)
"Always remember... (Score:5, Insightful)
That's a relatively old joke in the Military, and a relatively sick one when you consider the problems of faulty weapons (e.g exploding in your hands). But it points to something pretty basic. When it comes to things the DOD is rewarded for going cheap. This doesn't mean that they won't but they are rewarded for trying. In this gig Microsoft is at a disadvantage as their competitors are a) Free, and b) can be taken under total control by the DOD. Remeber that in-house changes to GPL'd code need not be released. Microsoft on the other hand is likely to worry about in-house changes to their stuff (e.g. document security restrictions for Office).
While I doubt Stallman will be welcome any time soon keep in mind that Theo De Raadt and the other BSD people have been welcomed (and financed) by the DOD before now. Ditto things like SELinux. In many ways this is only surprising because it took so long for them to say openly.
Re:"Always remember... (Score:4, Interesting)
"Nessus is unapproved software, we only allow xxxxxx(closed source) security scans to lock down your UNIX servers"
Yes I work for the DoD.
Re:This all makes now but... (Score:4, Insightful)
Except a few million is peanuts to the DoD. Their budget for 2006 was well over $400 Billion. I think they're going to make whatever decision will benefit them most, regardless of the cost.
NEWSFLASH (Score:4, Insightful)
Re:NEWSFLASH (Score:2)
As long as it takes for current systems to become obsolete. There are better things to spend taxpayer money on right now than a full-scale system switch-over to OSS just because.
As desktop computers need replacing, u
Re:NEWSFLASH (Score:3, Insightful)
The all-diesel thing is a hardware problem, and military hardware isn't cheap.
Who cares? The obvious has been stated. (Score:3, Insightful)
Govt. IT is highly fragmented. It took 20 years for DOD to switch to all-diesel. How long to switch to open-source?
Penis Cleaver, what a cute name you have. Oh well, it's worth the time to answer your silly question.
Intention is more important than t
Re:NEWSFLASH (Score:2)
The anti-OSS people do have one point. (Score:5, Insightful)
The solution for OSS is simple. Any OSS software that goes into a Command and Control system needs to have it's source code audited by an independent authority.
Of course the same thing should be done with any software that goes into a military, aerospace, or any other mission critical system. In this case OSS does have a clear advantage in that the end user can select any group to perform the code audit instead of depending on the vendor.
Of course if the military does a code audit on Linux they would have contribute back the patches so it is a win win situation.
Re:The anti-OSS people do have one point. (Score:5, Interesting)
The solution for OSS is simple. Any OSS software that goes into a Command and Control system needs to have it's source code audited by an independent authority.
Unfortunately, it's not as simple as auditing the source code. You also need to have complete control over the compiler, as implemented in machine code. For example, see Ken Thompson's comments [acm.org] on how to imbed self-replicating code into a compiler so that every program has a back door.
Re:The anti-OSS people do have one point. (Score:2)
Re:The anti-OSS people do have one point. (Score:4, Insightful)
Re:The anti-OSS people do have one point. (Score:2)
Countering Trusting Trust (Score:5, Informative)
Verifying code (Score:2, Informative)
The chicken-and-egg problem is a big problem. If you need to verify the security of a system, you need to have written the compiler, from scratch. You cannot rely on a third-party tool, unless you can verify the compiler executable (not its source code).
Re:The anti-OSS people do have one point. (Score:5, Insightful)
Only if they distribute it outside their organization, which in this case could be probably construed as the US government and the military and national guard.
Re:The anti-OSS people do have one point. (Score:4, Insightful)
This is hardly anything new. Look into how the DoD funded the development of the Internet (aka ARPAnet).
Actually, in most cases they didn't even develop their own patches. Rather, they told their academic and industry fundees about the problems in the latest code, let the hackers work out a solution, took the code for their own uses, and left it in the public code base for further use and development.
Yeah, they probably did a bit of development on their own, but the evidence is that there hasn't been as much of this as you might expect. The military has found the academic hacker community to be a much better testbed for most of the code, and a lot cheaper than trying to debug changes in a military setting. As long as the crypto stuff is highly modular (and it is), it's a lot more effective to just leave the code development in the public sector, where there are lots of eyes and people happy to show off their expertise by doing the hacking that a strictly-managed power structure finds highly distateful.
For a feel of the US government's relationship with the linux part of the open-source community, google for "secure linux" and do a bit of reading. There's a lot going on there.
Re:The anti-OSS people do have one point. (Score:2)
I have a sneaking suspicion that "State Secrets" privledge trumps GPL, since, you know, it trumps every other law in the land.
Re:The anti-OSS people do have one point. (Score:2)
Re:The anti-OSS people do have one point. (Score:5, Insightful)
Coarse...for the really paranoid type...I would like to point out that the DoD has played very large roles in quite a few other critical areas that I'm sure everyone holds near and dear...vehicles, aircraft, radar, computers, oh and that intarweb thingy...DARPAnet and all.
DoD has had a pretty good history of providing goodness to the populace as well as all the negative that people like to focus on. DoD doesn't start the fight...politicians do, remember that next time you see a service member. They bleed for the good causes, and the bad causes...its the leaders that determine what causes they are going to bleed for next.
Re:The anti-OSS people do have one point. (Score:4, Insightful)
The statement that people could introduce malicus code into Linux that then makes it's way into secure systems. Of course with companies outsourcing programming jobs to other countries the same thing could happen with a closed source system.
American programmers are just as capable of introducing (intentional) bugs as foreign programmers.
Of course the same thing should be done with any software that goes into a military, aerospace, or any other mission critical system. In this case OSS does have a clear advantage in that the end user can select any group to perform the code audit instead of depending on the vendor.
The US armed forces have enough spending power to convince even Microsoft to pony up the source code. And they do.
Of course if the military does a code audit on Linux they would have contribute back the patches so it is a win win situation.
Under the GPL, you only have to contribute patches if you distribute your modified code to third parties. The result of a code audit might also just be "don't use module X", in which case there's nothing to patch.
The way I read it the article is more about encouraging DoD programmers to be more like the open source community in sharing programs, ideas and sourcecode with each other, rather than continually reinventing the wheel.
Re:The anti-OSS people do have one point. (Score:2)
>it holds the potential to reduce software purchasing and development costs.
and to improve security. The Naval Academy has held "hacking" exercises. How about a code auditing exercise? At the end of that, the graduating officers will be much harder
Re:The anti-OSS people do have one point. (Score:3, Insightful)
Re:The anti-OSS people do have one point. (Score:3, Insightful)
No, they don't have a point. (Score:2)
No they don't. (Score:2)
Show me the section of the GPL that stipulates this.
Don't bother, it isn't in there.
The Government (or any contractor) is under no
Re:The anti-OSS people do have one point. (Score:4, Informative)
Re:The anti-OSS people do have one point. (Score:2)
Sandia Labs does a lot of GPL work. As a premire weapons lab, they have some bright people who write good code. MPQC [mpqc.org], for example.
Wasn't it closed source software (Score:2)
Re:Wasn't it closed source software (Score:2, Insightful)
Why is this? Because 99% of these systems were done in closed source. If they were done in open source than open source applications would be blowing up pipelines and rockets.
Training (Score:3, Informative)
They've been using OSS for years (Score:4, Interesting)
Too many cooks spoil the broth (Score:3, Insightful)
For example, is it good or bad that JavaScript has implicit typing? Many developers want explicit typing, and call implicit typing "lazy". I can barely have a conversation with a group of fellow geeks without getting shouted down on this topic. The problem with group-anything is that group-think will prevail. To quote one of my favorite posters from demotivators.com, "Meetings: None of us is as dumb as all of us".
In addition, alternative lanuages and tools tend to be stifled in so-called "open" (read group) environments, because the rest of the group immediately pushes to have the alternative tool or environment removed, unless the group agrees that it is a good idea. Is that the way inventions are made? No. Inventions are made by a single person with a radical idea avoiding all the intervention/interference, naysayers, etc. and presenting that idea DESPITE the opinions of others. I can see opening source after the fact for auditing and sugestions, but not for development.
It seems that a lot of the open source push has been a reaction to the fact that many of the development tools we use are not at a high enough level of abstraction. If you abstract away from code and languages where you are doing your own memory management, one would think that you would experience fewer memory-related programming issues. What kind of issues are most often discussed with open-source development? Exploits, buffer overflows, etc. I can see the database engine being open source, which would help with dealing with injection attacks, but the rest of the application (where the money is) can't possibly benefit from having lots of people "helping out".
Imagine the entire cast of The Food Network making soup together at the same time. "None of us is as dumb as all of us".
OSS has one solid advantage (Score:4, Insightful)
The point everyone seems to have missed... (Score:5, Insightful)
This is the time that Open Source activists and promoters need to run with the ball. Draw the attention of CEOs and business executives to the fact that the DoD advocates Open Source. Show them that we're not talking toy software. Show them that this isn't about not wanting to spend money. (Since when was the DoD afraid to spend money?) This is about an innately powerful method of developing high-grade - even military-grade - products that do what people actually need done.
We couldn't ask for better, but only if those outside of the IT industry actually hear of it. If only those who already accept the strengths of Open Source know that someone else has also decided it is a good solution, then that decision means nothing. Particularly as the DoD is very unlikely to do anything about it. It'll just be a decision. But if the business community got shown this... That would be a whole different ball-game.
Re:The point everyone seems to have missed... (Score:2)
We use open source in NM state gov. (Score:5, Interesting)
This is the real beauty of open source in government, not leveraging the work of others by running open source systems, but leveraging the large development force that most governments have to share in house apps wit less of the usual inter-agency squabbling. An agency that might be wary of using a non open source application developed by a rival agency will be less wary of using an open source app that just happens to be developed by said rival. Instead of reinventing the wheel, in house development staff can cooperate with other staff in other agencies.
That the DoD would recommend open source is exciting, because it really is a good fit for government agencies. Believe it or not, our little state government IT department is better run and more on the ball than most IT departments that I have worked for in big corporations. Moving to Linux hosted on blades running VMWare has freed up a lot of resources to plan for the future that used to be used in just putting out fires.
awesome (Score:4, Funny)
From: Kim Jong Il
To Whom It May Concern,
In accordance with the terms of the GNU General Public License, I'd like to receive a copy of the source code for your Pacific-based Ballistic Missile Defense System. I do not require it in CD form; please simply email it to me at the above address (k.il@korea-dpr.com).
Thank you for your prompt fulfillment of your obligations under the GPL.
Sincerely,
Kim Jong Il
Re:awesome (Score:5, Funny)
Mind you, the DOD is under no obligation to give the source to random members of the public, only those who received binaries... So he would have to wait until he got one of those missiles distributed to him first :-)
Not recommending open soruce software (Score:4, Informative)
Actual Report (Score:3, Interesting)
Haven't made it through the whole thing yet, but FTR:
The business model of purchasing physical goods and services has served DoD well in the past; but it falls short when applied to software acquisition. By treating DoD-developed software code as a physical good, DoD is limiting and restricting the ability of the market to compete for the provision of new and innovative solutions and capabilities. By enabling industry to leverage an open code development model, DoD would provide the market incentives to increase the agility and competitiveness of the industrial base. Currently within DoD, there is no internal distribution policy or mechanism for DoD developed and paid for software code. By not enabling internal distribution, DoD creates an arbitrary scarcity of its own software code, which increases the development and maintenance costs of information technology across the Department. Other negative consequences include lock-in to obsolete proprietary technologies, the inability to extend existing capabilities in months vs. years, and snarls of interoperability that stem from the opacity and stove-piping of information systems.
Absolutely.
There are over 100,000 publicly available open source projects available spanning most functional areas.4 Many of these projects provide mature and robust solutions in their areas of focus. When possible, OSS components should be leveraged rather than funding the development of equivalent proprietary components for specific programs.
Damn Skippy!.
Challenges Culture and Process The primary challenges to this transition will be cultural, not technical. Over time, government acquisitions and development processes have built a bureaucracy and rewards system that encourages and supports the status quo. Careers are advanced primarily on program size, not necessarily overall efficiency. Furthermore, government contractors are measured by revenue; government program managers are measured by the size of their organization and their overall budget. The canonical government contracting process creates high entry costs for small innovative companies -- the established contractors attempt to control their positions through proprietary implementations and interfaces. The system is very good at protecting itself -- new approaches, such as OTD, will have to endure legal, security, and process challenges. The current infrastructure will attempt to delay change, claim they are adapting by trying to assume control of the innovative process.
My Favorite Quote is in the DOD report.
There is one thing stronger than all the armies in the world, and that is an idea whose time has come.
-- Victor Hugo
All in All, I'd say the guy in charge of this report knows his stuff and I for one, welcome our new OSS-using DOD overlords.
Re:US Gov. Mandates ODF (Score:2)
Re:Wait a minute! (Score:3, Informative)