Open Source Is Becoming a Military Necessity

In letting just anyone use your code, that has to include the bad guys. They're bound to find a way to compromise it, the thinking goes.

But that's not the way it works in real life. Having every potential victim working on your neighborhood code watch turns out to deliver more security, not less.

Having everyone who might be the victim of an online break-in organized, finding bugs, writing and testing fixes, constantly improving security tools, works.

Don't believe me? Well, maybe you'll believe the National Security Agency or the Department of Homeland Security. The open source process works for them, too.

For a decade, one of the most popular intrusion prevention and detection systems has been Snort, created by Martin Roesch. But the company he built around that software, Sourcefire, only gives away the basic package. If you need extensions, if you want a more complete system, you have to pay. That code is controlled by Sourcefire.

There is nothing unusual in that. Many open-source businesses create free community and paid "enterprise" editions of their software. This is what Red Hat(RHT ) is all about -- you can download Fedora Linux free or buy Red Hat Enterprise Linux. In both cases you get to see the code, but with the paid version you get the support needed to run it professionally.

But this model didn't work with Snort. The Department of Homeland Security, the military, and the NSA could not be "held hostage" to Sourcefire for improvements to the code, or for the specialized suite needed to protect the nation.

So the Department of Homeland Security got together with major contractors and formed their own open source project, the Open Information Security Foundation. OISF has its own intrusion system, called Suricata, whose syntax is based on Snort, so if you are accustomed to one you can use the other.

But Suricata will be a complete system, not just a "sniffer," as intrusion detection products are colloquially known. The whole Suricata suite will be open source. This process is now expanding, as I noted here at TheStreet.com on Monday.

John Weathersby of the OSS-Institute, which is now affiliated with Georgia Tech in Atlanta, told me most of the day was devoted to small "breakout" sessions, where contractors answered hard, detailed questions put to them by key government customers. The affair wasn't just a series of sales pitches, he said. It was the first step in a negotiation.

Among the open source projects the NSA supports is Security Enhanced Linux (SE-Linux), for which it has developed an access control module called Flask, hosted at the University of Utah. Open source and security, in other words, do go together.

Open source can only provide tools. Procedures are also needed to assure that people maintain security. So the Cloud Security Alliance offers an integrated stack of such procedures, called the GRC Stack. GRC stands for Governance, Risk management and Compliance. This is maintained in an open process with the support of both contractors and software vendors.

Point is, open source and security do mix. They mix well. With more businesses moving toward cloud technology, much of it based on open source software, they are going to be doing a lot more mixing.

Information in the cloud or wherever it is: Yesterday, I put my name in search and up came all this information on me. I then put in my friend’s name, and lots of info. came up on him and his wife’s name was also there. They can turn their computers on and send email, but they don’t know how to use the internet. For instance, someone gave him a Kindle one Christmas and he didn’t use it for a year until I visited them so I could connect it to Amazon for him. Yet, there is all this information on him on the net.

My name has a facebook acct. but I don’t write there and have no picture there. Have never done twitter at all.

Working in the Republican Party or other political organizations will get your name on the web even if you don’t put it there (like me).

What I am saying, is, if you are alive and take any action at all, information about you will be on the web.

I really don’t like that and I can’t get that info. off there.

Don-o, we appreciate you and all of our monthly donors and ALL of our donors very, very much. FR could not survive without your loyal support.

But here’s what’s happening. We have about 800 loyal monthly donors who contribute a good portion of our funding needs. And then another 1500-1600 donors who make up the rest. And many of our monthly or regular donors end up donating twice or more during the FReepathons too.

And the FReepathons are taking longer to complete. And for many reasons. One is the economy. Many of our members have had to cut back on expenses just to get by. Another is lack of enthusiasm. As the godless liberals take more and more control over our government and our society, and as the Republican party continues failing to slow it down, and worse are actually becoming part of the problem, our members are getting discouraged.

And the members who are not super pissed at the Republicans lack of ability to get the job done, get super pissed at me for no longer supporting the obviously failing, ineffective RINO candidates.

So, even though we’ve always been able to raise the funds we need, it’s taking longer to do so. Out of the 200,000 or more people who visit FR every day, sometimes many times a day, we have less than 2% of them who actually donate to help keep the site going.

It does get very discouraging at times. This fundraiser happens to be running a couple days ahead of the pace set by the prior fundraisers this year, and I hope the pace continues.

We’re getting real close to the yellow right now and then we’ll be on the home stretch. The “300 FReepers with $50 challenge” issued by I_be_tc last week was hugely successful and I suspect the next batch of checks received at the PO Box will have several more of those. When Amy next picks up at the PO Box, it’ll be the first batch received since that challenge was issued.

God bless our monthly, dollar-a-day, and mail-in donors. When we process their batches of contributions as received, they keep our FReepathons bumping along nicely.

And the efforts of our dedicated FReepathon teams on the threads help urge new members to become donors. If more of our members who use and enjoy FR daily would help support the site, these fundraisers wouldn’t take so long.

Plus, we have the New Monthly Donor campaign going strong. TheOldLady and her team of generous NMD Sponsors and our dedicated FReepathon teams are doing a terrific job of keeping the number of monthly donors from falling off as discouraged people drop out of that program.

So, please do not give our hard working FReepathon team members a hard time. As I said, if we had to depend on commercial advertising, we’d probably have to have 5 or 6 ads on every page. And that would be 24/7, 365 days per year.

And commercial advertising is very intrusive. I’m noticing lately that when I visit news sites and the blogs that are posted here I’m seeing more and more ads that are personally aimed directly at me. I’m noticing that if I search for something on google, or look at something on Amazon, etc, they’re placing tracking cookies on my computer and whenever I visit news sites or blogs, even the friendly conservative sites, I’m getting ads for the products I just viewed.

Now, a lot of people are not going to like that. They’re going to turn off the cookies or find ways to block the ads in the first place, then the revenue falls off. And don’t even want to talk about the demands the advertisers will put on us regarding content and commentary. Chick-Fil-A, anyone?

It’s a never ending vicious cycle. Thank God for our loyal FReepers!!

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.