US Homeland Security to Support Open Source

An anonymous reader writes "CNET is reporting that the US Department of Homeland Security is extending its support to open source software. The DHS will be giving Stanford University, Coverity, and Symantec a $1.24 million grant to improve the security of open source software. From the article: 'The Homeland Security Department grant will be paid over a three-year period, with $841,276 going to Stanford, $297,000 to Coverity and $100,000 to Symantec, according to San Francisco-based technology provider Coverity, which plans to announce the award publicly on Wednesday.' It's nice that our tax dollars are being used for the right stuff."

Symantec?

[Anonymous Coward]

Symantec? Open source?? Where?!

Re:Symantec?

[killmenow]

I'll add to this...

The DHS will be giving Stanford University, Coverity, and Symantec a $1.24 million grant to improve the security of open source software.

I fail to see how giving Symantec money will improve the security of anything unless we're talking about securities...as in Symantec stock. Once upon a time the name Norton prepended was a good sign. I am not trying to troll or incite flames, but I find Symantec (and McAfee for that matter) sorely wanting these days. I would be leery of running anything with their name attached to it on one of my boxes.

At least they only get $100,000 and the bulk goes to Standford.

Symantec?

[marcushnk]

What has Symantec to do with OSS?
Surely there is a group/company more appropriate than Symantec to scrub for bugs?!?

Re:Sort of good..

[Bimo_Dude]

Looks like you're on the way to a +5 Flamebait (hehehe...)

While I normally am suspicious of almost everything done by DHS, I do see this as a good thing. It seems like a good start, anyway. If only we could get them to put the other 99.997% of their budget (based on their 2005 budget [whitehouse.gov]) behind Open Source...

Looks like someone has a well-placed friend

[2Bits]

Ok, so this is a grant. Does it mean that any software developed as a result of this grant will be open-sourced, and publicly available to all, free of charge? If not (and everything indicates that it won't be), I'd say, someone has a well-placed friend and got free money to develop their own proprietary software. Yeah, it will scan major open source softwares, and yeah, the database will be public (?), but then the tools from the grant money are still proprietary.

I thought only China has "guanxi" problem?

Re:Err wait a second.

[kfg]

Where's the conspiracy here?

Wait for it, wait for it!

Is it a good thing that DHS is supporting open source?

They are not supporting open source. They are supporting commercial code which can be applied against open source code.

The open soure developers and their code base are left to go scratch.

KFG

Potental Funding for Twelve Steps in TrustABLE IT!

[NZheretic]

See Twelve Step TrustABLE IT : VLSBs in VDNZs From TBA [blogspot.com].

Stanford is also the home of the Meta-level Compilation (MC) project [stanford.edu], a useful auditing tool for trusted build agents.

Now that Microsoft is getting into the signiture and behavour based antivirus industry, maybe Symantic could turn its patten matching technology to checking source code instead of binaries.

Wow... but is it right?

[MyNameIsFred]

You mean a whole 1.24 million dollars. Talk about pushing the budget

Your snide comment misses the point. What was the scope of work proposed? Does 1.24 million support the work they intend to do? Saying they should spend more without a reason is dumb.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Oxymorons

[delire]

The last thing Symantec can afford is the proliferation of secure operating systems.

They'd do better offering money to Linux/*BSD kernel development or the Mozilla Foundation (for instance).

Open sourse

[catahoula10]

It seems logical to me that if Symantic wants to be involved with "Open Source" that they should become open source first.

Then maybe the open sourse community can help them with some of their problems like this one:

"Symantec has admitted its flagship consumer security application, Norton AntiVirus 2005, has a security vulnerability that allows certain types of malicious script to infect a user's personal computer with a virus."

http://www.zdnet.com.au/news/security/0,2000061744 ,39165825,00.htm [zdnet.com.au]

Want to Improve OSS Security?

[Greyfox]

Start up the old auditing program again. Source code auditing is boring work, but another set of eyes going over the code with security in mind really does help a lot. Just go down every function in the C library and work your way out to common daemons and system utilities that usually run setuid. Maybe spend some quality time with common tools that access the internet like firefox, email clients, etc. Just read each function looking for buffer overflows and other ways it might be compromised, document what you find, write a test to try to crash it, submit patches to the original authors and publish your findings and tests on the web somewhere. That leaves you with a full set of security regression tests for every product you look at.

A team of 4-5 people could probably finish off the C standard library in a matter of months and make good progress on the more common daemons that are often run on Linux systems (Bind, apache, the various mail servers, etc) in the span of a year. The money DHS is spending on this would be more than enough to hire a team that size for a year to work on that.

Re:OpenBSD

[vmalloc_]

Amen, man. Here's a DHS security initiative that would have cost nothing: Switch to OpenBSD if security is a concern, and check periodically for security advisories.

This spending is just more pork barrel crap that will probably not accomplish anything and will just get pocketed by somebody. Security doesn't just get fixed with a couple million bucks and a year of coding, it's an ongoing long term process, and the #1 problem with security today is lack of education and/or indifference on security issues, NOT a lack of pork barrel spending.

OSS bug reports and bug fixing

[Frank T. Lofaro Jr.]

(I hope this post isn't moderated as flamebait. I love Open Source Software, but there are serious problems in our community which need to be addressed. I am not an outsider attacking OSS to destroy, but a community member pointing out shortcomings to help preserve and improve it.)

Do most Open Source projects even do anything with bug reports?

Other than:

1. Ignore them.
2. Claim they are not bugs, but features.
3. Claim they are valid "design decisions".
4. Say they'll get around to fixing bugs when they are done adding features - e.g. they'll fix the root exploit to the FTP daemon after they add a 3D Open GL interface to it.
5. Say it won't be fixed. Bugzilla has a "WONTFIX" status which is used quite often.
6. Fix the bugs by wholesale destruction and replacement of whole sections of code, or even the whole code base - now you got all new bugs!
7. Claim the bug is in another piece of software or hardware and they're code is just the unfortunate victim.
8. Blame software patents, George Bush, Hurricane Katrina, Microsoft, little green men/women from Mars, sunspots, quantum time fluctuations or anything else for why they can't or won't fix it.