Nessus Closes Source 394
JBOD writes "As reported at news.com, the makers of the popular security tool Nessus are closing its source code. Although it will will remain free as in beer, Nessus is dropping the GPL license for the upcoming version 3 of the software. The problem appears to be that Tenable Network Security (the company which primary author Renaud Deraison founded around Nessus) isn't making money because it's competition is simply repackaging their product. Deraison's writes "A number of companies are using the source code against us, by selling or renting appliances, thus exploiting a loophole in the GPL. So in that regard, we have been fueling our competition, and we want to put an end to that." He also notes that the OSS community has contributed very little to Nessus in the past six years, so they were reaping no benefit from using the GPL." Update: 10/06 22:48 GMT by CN : Nessus' Renaud Deraison wrote me to let me know that the company is "good money-wise," but has become annoyed with competitors repackaging their product.
GPL Considered Dangerous? (Score:4, Informative)
Re:GPL Considered Dangerous? (Score:5, Insightful)
Is it just me, or is this bafflingly ambiguous? I'm sure if I read the whole thing it would be clear, but I have no idea what that sentence is trying to say. I'll just stick with BSD for now.
time to spoon! (Score:2, Funny)
Maybe we can see... (Score:2)
Re:Maybe we can see... (Score:2)
Better (Score:2)
Re:Definitely worse (Score:2, Informative)
1. They get no more free code, since people can't hack on it and improve it for themselves. It appears that this has been the case for the last 6 y
Re:Maybe worse (Score:2)
In a sense, many of the potential benefits of open source are just that, "potential" benefits. People say that the code is more secure if more people look at it, and better if improved and patched... but that assumes that other people do look at it, do make improvements, do fix bugs, and do return those improvements.
But the fact remains there are a lot of open source projects and a finite number of people with the time and the ability
Competitors (Score:4, Funny)
Re:Competitors (Score:2)
Maybe there are... and they're going to fix them for v3 and share all the details of the v2 bugs.
And all those companies would be scrambling since they didn't write it in the first place and therefore probably have little understanding of the underlying code.
Re:Competitors (Score:4, Interesting)
I am have some firsthand familiarity with this. I know of a company that essentially built their whole business around nessus as the core of their product. They added tons of bells and whistles to it, packaged it nicely, made it user-friendly, and shipped it. For a lot of money. Sounds silly, but I think they had a good product -- it actually made network security manageable. Just knowing what is vulnerable on your network is not good enough. In fact, if the network is of any appreciable size, that's not good at all. You need to filter out tons of noise -- false positives, things that you know are vulnerable but you do not care about for one reason or another, need to do some basic triaging, and be able to monitor trends and tendencies over time. So, there's a great need for a good presentation layer on top of nessus, and several companies recognized that need and built their business models on that. And that was good, it was really, really needed.
Then, a couple of years ago it became harder to get nessus updates. Nessus started detecting scrapers that were getting latest nasl updates and banning them. Then they started licensing those updates differently, I think, so it was harder for closed-source companies to use them. So, that company started rewriting newer NASLs in a "clean room" environment to stay in the legal clean waters. While the practice was silly, it made sense -- it was either that, or GPL the whole thing, and they could not figure out how to build a viable business plan if they were to GPL their whole product. I must admit that this is a very challenging, and at times an impossible task. I must say that I applaud them for going through all that extra effort to stay clean and respect the GPL -- a lot of other people do not do so.
So, has nessus just droppped a bombshell on all those companies that were building their stuff on top of its enine? Not really. The change has been coming for quite some time. Recent NASLs haven't been available for a while under a liberal license. In fact, I think that new software features and bugfixes in version 3 are not even all that important or needed. Signatures and definitions for newer vulnarabilities are. So, all those companies had ample time to change, if they wanted to. The company I was referring to did a good job, as far as I know -- they added a bunch of features beyond what nessus provided -- various network discovery, some windows-specific stuff, etc. I do not know much about what they are doing now, but I know that they worked hard to shift from a nessus-wrapper to a product that could stand on its own. And, to the best of my knowledge, they succeeed. Some others did not see the writing on the wall. So, they wasted time and this change of license will be the latest nail in their coffins. Stuff happens. Don't feel sorry for them. Nessus departing from the GPL is a sad fact of life, but... it's understandable. They can do it. And freeloaders deserve little compassion.
just my 2c...
nessus is dead, long live gnessus? (Score:5, Interesting)
Re:nessus is dead, long live gnessus? (Score:2)
It would be interesting if this happens. It would certainly make the developers statement in need of a second look (the statement above was not the developers statement):
The developer also expressed disappointment over the lack of community participation in developing the software, despite its open-source license.
So,
Re:nessus is dead, long live gnessus? (Score:2, Flamebait)
Or maybe the community couldn't give a damn about helping until it's an underdog project competing against an evil proprietary product? Some people are more motivated by zealotry than improving the world...
Re:nessus is dead, long live gnessus? (Score:4, Insightful)
A developer who wants community involvement really has a lot going against him. There are only a handful of Linuxes, Mozillas, and KDEs, out of the hundreds of thousands of OSS projects out there. Probably only a single-digit percentage of OSS projects get any significant community help. To get in that percentile, you have to have an interesting, high-profile project AND be VERY good at drumming up support.
Properly stated, there's a third possible interpretation of a successful fork: the maintainers were doing a fine and dandy job and no one from the community had an itch to scratch, until the gravy train stopped.
Nessus dead. Long live Hindmost (Score:5, Informative)
I have to disagree. I'm a CISA (certified information security auditor) and have used Nessus in audits. About a year ago, I provided feedback regarding Nessus's tendency to damage production services, even in safe mode. These occurances were not Nessus's fault, but rather the consequence of very poor coding in various network devices. Often Nessus would cause old HP printers (HP Laserjet III was notoriously vulnerable), cheap network fax appliances, and in a couple of cases, Sonicwall firewalls to completely lose their configurations and reset to defaults. 10+ year old printers have a bit of an excuse in my book, but Sonicwall, which advertises as a security product, had no legitimate justification for this behavior. We were able to confirm this from outside Nessus scans as well.
I began reporting this behavior to the Nessus group and suggested a database of vulnerable devices to prevent analysts from getting in repeated hot water. The Tenable folks were not responsive at all and indicated their fear of civil liability due to potential disparagement of network equipment vendors products. Although I referenced numerous other sites, as well as the alternate "compatible device" approach which countless operating systems take, the idea was ignored. I did receive numerous emails from other analysts who had the same concerns.
Teneble has done a good job pushing away its user base and unfortunately moves into a hypercompetitive world of better proprietary tools. I wonder if there's an impatient VC pulling their strings.
I'll definitely support any open source effort that continues with the GPL code. How about calling it Hindmost [larryniven.org] (for all the Ringworld fanatics out there).
*scoove*
Re:nessus is dead, long live gnessus? (Score:3, Funny)
Re:nessus is dead, long live gnessus? (Score:5, Interesting)
Yup. Funny how that works. It happened that way with SourceForge/GForge. It sorta happened with NCSA httpd -> Apache. Probably a handful of other examples out there.
It'll probably evolve from the needs of the Debian package maintainer needing an "upstream" [debian.org] for security patches, etc. Or maybe Gentoo, Fedora, etc. You get the idea. I use Debian as an example because of they'll need something that continues to satisfy the DFSG [debian.org]. Thus, if Nessus is still going to remain, it'll eventually need to be updated.
Re:nessus is dead, long live gnessus? (Score:3, Funny)
So what's left?? (Score:5, Interesting)
Re:So what's left?? (Score:4, Informative)
Moral of this Story and Nmap Response (Score:5, Informative)
I responded [seclists.org] for the Nmap Security Scanner [insecure.org] project yesterday. We aren't planning to follow suit. Nmap has been GPL since its release more than 8 years ago and I am happy with that license.
I agree that this is not a good trend, and the question is how to reverse it. It is important to note a key reason Renaud gave: the lack of community involvement. It is easy to take the open source tools we depend on for granted, and forget that open source is a two way street. The bazaar model doesn't work so well with everyone taking and not contributing back. In the Nessus response, I suggest [seclists.org] a few ways that programmers and non-programmers can support projects they use and enjoy. Rather than mope over the loss of open source Nessus, we can treat this as a call to action and a reminder not to take valuable open source software such as Ethereal, DSniff, Ettercap, gcc, emacs, apache, OpenBSD, and Linux for granted.
Meanwhile, I know at least one group of experienced open source programmers that is preparing to announce a new open source vulnerability scanner project or Nessus fork. It would be encouraging for such a fork to succeed.
-Fyodor [insecure.org]
Re:Moral of this Story and Nmap Response (Score:5, Insightful)
Fyodor, what can those of us out here do to help make that a possibility? One of my common frustrations is that much of the open source community thinks at a very low level and rejects broader perspectives because the initiators of the projects are often exceptional programmers (at the expense of not being exceptional documentation writers, analysts, managers, communicators, etc.). Some will want to shoot me for saying it, but every technology project needs a hell of a lot more than software developers to make it go. A project needs the help of great documentation writers, testers, managers, analysts, evangelists, etc. to make it, and more importantly, needs to have a culture of taking criticism and evaluating it objectively in order to have a chance at success.
Nessus's rejection of a system vulnerability database was unfortunate but not unexpected - I smell a VC in a room with a bunch of programmers (and nothing in between), plus a bunch of sensitive "Not Invented Here" egos. Nessus needed to integrate with its user community because its success was very dependent upon their feedback. Nmap has succeeded perhaps because it is a more concise tool with a focused objective and I've seen you take feedback out there and honestly respond to it.
I agree that this is not a good trend, and the question is how to reverse it.
Success in the open source community is still a rather unpredictable, undocumented (and too often, unrepeatable) event. Successful projects like nmap have happened through their founder's exceptional ability in demonstrating more than just coding ability, yet the community does little to document, educate and communicate this aspect. Projects tend to continue to make the same mistakes. Perhaps a start would be a FAQ on successful open source project methodologies that explains that brilliant code is only one of a dozen components required for success and details the others - perhaps building upon the best practices of the community's successful projects? If Nessus and others are to make it as viable open source, we need to build upon the understanding that it takes more than great code to succeed.
*scoove*
Re:So what's left?? (Score:5, Interesting)
Security tools like SATAN and NESSUS (and even tools like NMAP) are a poor substitute for someone who knows what they're doing, and just make being secure harder for everyone who has to deal with them.
thus exploiting a loophole in the GPL. (Score:5, Insightful)
Re: thus exploiting a loophole in the GPL. (Score:3, Insightful)
The GPL can prevent vendor lock-in because people can study the code and resolve compatibility issues if any.
Not in the sense that anyone can pick up the code and be a competitor - although it is also permitted under the GPL, it is not what prevents vendor lock-in.
Fork? (Score:4, Interesting)
Well, this has been coming for some time... (Score:5, Interesting)
Hopefully, the time will come when Renaud and crew feel that they can re-open the code, possibly under GPLv3.
Re:Well, this has been coming for some time... (Score:3, Insightful)
But the code was released under the GPL. The 'competitors' merely manufactured a device that (legitimately) included a copy of code made available under the GPL.
What's wrong with that?
Nothing, under the terms of the present GPL, hence I didn't say that competitors had "abused the license" or whatever. However, Nessus has been one of the most shamelessly exploited GPLed projects, and it that respect, it abuses Renaud's ge
Hardly a "loophole" (Score:5, Informative)
In any case, they are perfectly free to do this. They are also free to release the source code in a way that does not have this "loophole", such as by using normal copyright. Equating "being able to see the source" with "GPL" is a bit of FUD.
Re:Hardly a "loophole" (Score:2)
Not at all - the GPL requires that they provide the source to anyone who purchases the software. It's one of the key components of the GPL.
Other than improvements to the software, I assume that the other key benefit to making the source code available is for many eyes to see it to provide security and functional updates. But if all that's happening to the source is that competitors are taking it and repackaging it under another name and n
Perhaps "Unintended consequence" (Score:2)
It's clear here that there's no sharing of the work here. They do all the work and get little benefit. What's interesting about this though is what happens to the previous Nessus release. You
It's a legit gripe though (Score:4, Insightful)
The GPL does create problems for commercial viability in many cases. You spend tons of time and money developing something, others then market the solutions for it, you get squat in return. This is a problem. The "Well make money selling support" argument doesn't work when others are selling the support better than you can.
Now, perhaps you are inclined to think this is fine. They are better at it, so they should make the money right? Except the only reason they can, is that you put in the up front investemant to actually make the software.
What this will lead to is people deciding that open source is not the way to go, or at least GPL-style open source. If it just leads to other people making money off of your hard work, it'll really turn people off to it.
Fair enough (Score:5, Informative)
That's not a loophole, that's how it's supposed to work.
He also notes that the OSS community has contributed very little to Nessus in the past six years, so they were reaping no benefit from using the GPL.
His code, his rules. As long as he's not including code that others contributed under the GPL, that is.
The question is, has he either cleared the code, acquired copyright, or licensed it from the authors?
You do not get Open Source. (Score:5, Interesting)
Also, it seems rather rich that they are selling a product that depends on a number of other OSS projects (expat, gettext, gmake, libiconv, libtool) and complaining about people making money off their code.
- H
Re:You do not get Open Source. (Score:2, Insightful)
Selling or Renting Appliances? (Score:3, Insightful)
I don't buy this as a reason, mind- because the people in question are still infringing and making it free as in beer won't change the situation any more than it is now. You have to go after them for their infringements- licenses don't change this. If it were the case, MS (or any other BSA members, for that matter) wouldn't be so worried about piracy of their products...
Re:Selling or Renting Appliances? (Score:3, Informative)
Selling or distributing an appliance is not against the license. You are selling the hardware with the free software installed on it. You can even make changes to the software so long as you release the modified code. This is exactly how the Cobalt RAQ servers were sold. They sold hardware and a proprietary web based GUI wrapper that configured the GPL'd web server applications. Nothing illegal a
They haven't learnt the lesson (Score:2, Insightful)
Well, I just assume the same will happen with nessus, except if there is no interest in nessus when there was on an X server.
Sad day (Score:3, Interesting)
Anyway, speaking as a long-term user of Nessus, I have had direct personal benefit from it being Free; it enabled me to get familiar with it on my home network which (along with snort, nmap, ipf, tcpdump and a load of other Free stuff) enabled me to move into network security five years ago. Of course, it's Renaud's code and it's his right to release it under whatever licence he wants; but it's a shame. Let's hope someone's prepared to fork the GPL'd v2 codebase and start adding the improvements it needs.
Of course, I'm assuming that all the plug-in authors are happy with this. When Tenable released a closed-source Windows port (NEWT) I queried the position on a mailing list somewhere, I forget the outcome but it seemed odd to me. It seems really unlikely that Tenable would do this without the plug-in authors' agreement,.. anyone got info on that?
With my 'Free s/w zealot' hat on, I have to say that it'll be interesting to see how the community responds to this. In my copy of the FSZH (FS Zealot's Handbook... version 2 or later :) it says that a benefit of GPL licensing is that the community can pick up and continue with the remaining GPL'd source. Are there any coders out there interested and motivated enough to pick up the GPL'd project? It'll be interesting to see. Fingers crossed....
Maybe an OSS future isn't that bright afterall (Score:4, Interesting)
Let's be serious about this. The GPL provides **no** protection to companies whose business model is built on selling software that doesn't need support contracts or anything like that. If selling software is your business, then the GPL is basically a suicide pact for your company and the same applies to all other open source licenses because your competition can repackage your millions and billions of R&D dollars/Euros/Yet/etc. and you get... precisely what?
It's funny how much having a girlfriend that you are working toward marrying and realizing that your idealism cannot feed your children will change your perspective on open source software. I like Linux, love Tomcat and am eager to give PostgreSQL a shot and I run my own nightly builds of Firefox, Thunderbird and Sunbird on my Windows laptop, so I am definitely not some fanboy for either side. So let me just say this to most of the zealots: OSS is never going to win in the long run because developers have families to support and will not slit the throat of the goose that lays the golden eggs (though sometimes they seem a little bit like bronze) that pay the bills and support one's spouse and children.
Get to that point and you'll realize that Microsoft is good because they create work for you. Same thing with Oracle, Sun, IBM, etc. Infrastructure can and in some areas should be open. However, no one is going to make money on open sourcing things like Quicken or TurboTax and other common user apps unless they are utterly useless without some expensive services provided by the company that makes them. How else are they going to make money, eh? We ought to eliminate software patents and EULAs, those are things the OSS movement is right about. However, the OSS movement if successful (and I doubt it will be in the long run) will end up making it very hard to make money in software development and maintanence. Good for this company that they realized that before it was too late. I'm glad that they chose to protect their employees and stockholders instead of pursuing Stallman's dream of a world in which software developers effectively cannot make a living directly off their code.
Re:Maybe an OSS future isn't that bright afterall (Score:2)
Re:Maybe an OSS future isn't that bright afterall (Score:3, Insightful)
Welcome to a disruptive technology. Guess what? New things happen.
Re:Maybe an OSS future isn't that bright afterall (Score:5, Interesting)
Re:Maybe an OSS future isn't that bright afterall (Score:3, Insightful)
If you think that the driving force for the software industry is the need for developers to make money you need to go back to school.
Everybody needs to make money, and yet industries come and go.
Re:Maybe an OSS future isn't that bright afterall (Score:3, Insightful)
The money is made in doing custom modifications of the software.
Anyway, nothing prevents FOSS and proprietary software, sans software patents, from coexisting stabily.
The GPL isn't necessarily the best license for all software, as well. Non-commercial use/commercial dual licensing might have been better for the project.
Re:Maybe an OSS future isn't that bright afterall (Score:3, Insightful)
If they drop the GPL... (Score:2)
Such copying of copyrighted works without permission is copyright infringement, and is, I'm afraid, quite against the law. The copyright holders can press charges for infringement at their leisure, and could probably win (since there is now docum
From their perspective? (Score:5, Insightful)
Or is everyone scared that all the "You can't actually make money with GPL" rumours are true (especially for small start-ups)? ;)
Considering that... (Score:3, Interesting)
Sentiments aside, they look to be a small player that priced themselves out of the overall market, hoping to score support contracts for an Open Source project that was to showcase their abilities and hoping
Re:Considering that... (Score:3, Insightful)
You obviously missed the above article, it lists a few companies that make money purely with GPL'd/OSS software. The include SugarCRM, MySQL, and many others. These companies were once startups (and some would still be considered startups). They are largely pure software development plays (IE they don't sell appliances/hardware).
The article mentions that MySQL AB will make 40 million this year. That's pretty good. SugarCRM h
Fork (Score:2)
They can't "close the source" (Score:2, Interesting)
Perl's Artistic License [perl.org] and the Apache License [apache.org] are better licenses.
BTW - I am a lawyer and this is personal opinion, NOT a legal opinion.
They can do it, but forks inevitable (Score:4, Informative)
Contrary to a number of comments I'm already reading, Tenable Network Security can do this, as long as they control the copyright to the entire body of work. This would be impossible for some GPL-licensed software for which the copyrights to separate contributions are owned by their contributors. If I am not mistaken, I think Linux falls into this category, so Linux could not be taken out of the GPL unless everyone who holds copyrights over the many parts of the source code all agree on the new license. Won't happen.
For software that is copyrighted by a single entity, be it an individual or a company, the license can easily be changed. However, anyone who obtained the software under the terms of the previous license cannot have the rights that were granted revoked. This means if you downloaded the software and source at any time before the license change, congratulations. You have the GPL'd project in a relatively recent state, and the GPL applies.
This presents an opportunity to fork a GPL version. If enough people are interested, the fork can eclipse the original project, as X.org did to XFree86 when the latter changed its license.
GPL Screws Tenable and Tenable Screws GPL (Score:5, Informative)
When the 2.2.5 version of Nessus [nessus.org] was released, Brian Weaver (formerly of OpenNMS [opennms.org] fame) was puzzled why the GPL version wouldn't scan. After hacking through the source code, Weave found the answer: strong evidence suggesting Tenable Security [tenablesecurity.com], the sponsors of the GPL version of Nessus as well as a commercial version, deliberately crippled the GPL version of Nessus [spellweaver.org]. With stunts like this, would you trust Tenable to protect your network?
Only the beginning of their stunts... (Score:3, Interesting)
No.
As I've already mentioned [slashdot.org], Renaud has never considered his project to be under the GPL. Oh sure, he knew it was under it, but flaming anyone and everyone that he suspected of "working at a company" or "using nessus for profit" or "doing anything that didn't meet Renaud's fancy" was not exactly uncommon.
The reason that there's not a serious community around nessus is Renaud.
OSS problem admitted (Score:3, Insightful)
Most people understand this principle. But the OSS activists seem to believe that smart developers can donate forever and should be totally selfless. Why is it only the developers? Developers who spent many years of their lives learning to be experts at their complex trade (programming) are expected to donate. Yet the typical help-desk types are "allowed" to charge for their consulting services when they pop a CD in a drive and install the OSS software for a client.
I'll admit, I'm a software developer. But, I know OSS activist guys who charge companies $100/hr consulting fees to implement OSS solutions that they don't pay a dime for. These guys are walking in to a firm, spending a day setting up a PHP server (or whatever) and walking out with a fat-ass paycheck.
But when a developer wants to charge for the software he writes the OSS community of activists starts hissing at him and brand him with some sort of corporate greed type crap.
Can somebody please explain this OSS-mentality inconsistency????
open source killer (Score:4, Insightful)
Nessus is not the first, and not the last. Even Hans Reiser has this problem:
See here... [kerneltrap.org] Hans Reiser: Doing GPL work is doing charity work [...] That should be and could be changed, but for now it is so. I have done my share of charity, and I would not have a problem doing proprietary work. I think people should keep their lives in balance, and that includes balancing charity work and better paid work.
Here is another: Mute file sharing [sourceforge.net]. Not sure how long this experiment will last.
And one more: Daniel Robbins founded Gentoo linux, went bankrupt, got job at Microsoft [gentoo.org]
Either help these programmers feed themselves and their families, or expect other big and large profile projects to disappear and become pay-for-play.
I love open source, and contribute money to many projects -- but open source will just prove to be a fad that will start to wear thin on programmers as they get into debt and can't feed their families. The business case for open source software longterm survival is weak, unforunately.
m
Re:open source killer (Score:3, Insightful)
The problem is not the GPL, or free software, the problem is one company with a business model that didn't work.
Saying that a piece or software can't be good unless you throw money at it is j
WHY there were no contributions: (Score:5, Interesting)
http://silverstr.ufies.org/blog/archives/000864.h
Dana alleges there wasn't much give and take between Nessus and "the community" which discouraged any contributors.
[In 2002] "I was about a quarter of the way complete the port [to windows] when I ran into some issues with the NASL scripting and I tried to contact Renaud and his crew to point out some issues I found. The help I got? Squat. Nothing. Barely even communicated with me. I only ever got a couple of email responses saying "I was free to do it" when I asked if I could do it in the first place, and a follow up to an issue I found with a quick thanks."
That's not the half of it. (Score:5, Interesting)
Renaud
Yes, that's right. Renaud himself. Schizophrenic, anti-social, flaming Renaud. Let me illustrate:
A few years ago the company I worked for wanted to provide Nessus scanning as a service to people. The CEO himself wanted us to be good citizens in the OSS community (he was a techie before he got into management) so, not quite understanding the GPL, he personally sent an email to Renaud asking if it was ok to do such a thing. He basically got "ya, sure. just tell people that you use nessus" as a response. Of course, providing a service using stuff under the GPL is perfectly legal, regardless of whether or not you modify source code (which we never got around to doing anyway).
Fast-forward a few months. We're creating the service. We join the mailing lists and start asking a couple questions. Almost instantly Renaud flips out. To paraphrase: WHAT THE ____ DO YOU THINK YOU ARE DOING USING NESSUS? WHO THE ____ DO YOU THINK YOU ARE? COMPANIES CAN'T USE NESSUS TO PROVIDE SERVICES! ESPECIALLY IF YOU CHARGE FOR IT! SUPER-ESPECIALLY IF YOU MANAGE TO MAKE A PROFIT (and don't give us a large cut)
Ya, ok. Whatever. Renaud subsequently (in emails to our CEO) threatened legal action against us for things such as "using nessus." Legal improbabilities aside, that totally spooked management and alienated myself and the rest of the development team. Several of us have participated in other OSS projects through irc, mailing lists, forums, contributing patches, reporting bugs, etc. Such OSS participation is generally well-received. With nessus, not one of us who ever tried to participate in its "community" ever felt welcome in the least. To the contrary, every time we dipped our collective toe in nessus's pool, we came away with frostbite.
Renaud appears to have finally woken up to the legal ramifications of having put nessus under the GPL. Namely, he can't dictate what others can and can't do outside the confines of the license. If any of you are considering using nessus in the future, I highly recommend going through his license with a fine-tooth comb. When he sells out to SCO [so he can actually get his threats into the courts and the news], you will want to know how many of your vital organs, children, and relatives that they are going to go after.
I say, GOOD RIDDANCE NESSUS.
Sussen? (Score:3, Interesting)
Created On:24-Dec-2004 01:24:29 UTC
Last Updated On:26-Sep-2005 11:55:35 UTC
Expiration Date:24-Dec-2006 01:24:29 UTC
They've just released on 26 September 2005; hopefully it's a fork of Nessus rather than an unimaginative name for a new project, but I suspect the latter.
Who the fsck are Tenable anyway? I haven't heard of them before today and with any luck I won't hear of them again. If they didn't like the license they should not have released their Intellectual Property under it, and then someone else would have and they wouldn't have enjoyed the free publicity. Have they not seen how well MySQL is doing off the back of an Open Source product? Sounds to me like the problem isn't with the license...
This raises an interesting question about vulnerability scanning though... who could really care less about the scanning engine or how long it takes - the patterns are where it's at; so long as we keep the patterns up to date security doesn't suffer at the hands of this greedy company.
Incidentally, I like the way they're still advertising Nessus as 'THE Open Source Vulnerability Scanner' on their site [tenablesecurity.com].
He's right about contributions from community (Score:3, Informative)
Why?
In all honesty - because of the reason I went out of "security business". It became a business, where every idiot would try to take a "piece of security cake", even if they were complete idiots without clue about anything related to security. Or more precise - "it became a business".
Although I adore Nessus, and used it on few occasions (prefer to do things "by hand"
I admire Renaud for actually surviving this long with GPL license, and I sure admire his dedication to Nessus.
He is right for doing this, and I wish him all the best.
A little background (Score:5, Interesting)
Later on, Tenable started to make commercial only modifications. The truth started to come out.
Lets get this straight - the only reason why many of us chose Nessus was because it was Free & OSS. We could have just as easily chosen other tools to use instead. The commercial vulnerability scanners of the earlier era were far better at that time.
Now they want to change? Good luck.
I'm looking forward to whatever OSS tool takes the place of Nessus.
Oh and another thing too, on setting the record straight. Tenable might be the sole authors of the core scanning engine, but they definitely benefited *GREATLY* from external plugin authors.
Re:GPL Kool-aid (Score:5, Insightful)
That's *the* valid excuse. They were in fact drinking the kool-aid - they believed that by contributing to the codebase, that it would make everyone's project stronger. As it happened, they kept giving and the competition kept taking. The community didn't give back.
I agree, though, they could have written a license that gave other companies the right to reuse the code for non-commercial uses only, and that would have been a better compromise.
Re:GPL Kool-aid (Score:2, Informative)
Along with the MOSSAD aquisition of Snort/Sourcefire.
Free as in Kool-aid (Score:5, Funny)
Re:Free as in Kool-aid (Score:4, Funny)
The choice was probably about cost... (Score:5, Insightful)
Choice 2) Close source code.
Seems to make sense to me...
Re:The choice was probably about cost... (Score:3, Insightful)
Honestly, when the source is equal, what did he really think would set his product apart from the competition? His only advantage is that he wrote it. Thats not a technical advantage since he GPLed it. But it sure is a marketing and support advantage.
The flaw is not in the GPL but in his business plan that did not match the fact that he was GPLing his code.
Re:The choice was probably about cost... (Score:5, Interesting)
Nonthing; Tenable is a software dev house, not a marketing firm. So to set themselves apart, they decided to no longer allow the competition to use their code. Sounds like a sensible business plan to me.
While I love the GPL, it's not for everything. There are some cases where it's just not profitable to give away your main product. This appears to be one of them. If you can come up with a better business plan that involves leaving the product GPLed, I'd be glad to hear it.
Re:The choice was probably about cost... (Score:3, Insightful)
Let us assume this is the case, then you've only got the quality of your code and your extra features over the competition. Oh wait, they're USING YOUR CODE!
Hmmm, suddenly, there is pretty near zero differentiation. Oh wait, you are trying to pay for having invested the time and money to write it. They are not. So there is a differentiation. In their favour!
No, I can see why they'd want to go back closed source. Open source is no panacea. It has some exc
Re:GPL Kool-aid (Score:2)
Kind of like Trolltech's license approach for Qt.
Re:GPL Kool-aid (Score:5, Insightful)
The FSF says nothing about the GPL and community giveback. It says only that the GPL exists to give users freedoms to use and modify software. Indeed, "The freedom to use a program means the freedom for any kind of person or organization to use it on any kind of computer system, for any kind of overall job, and without being required to communicate subsequently with the developer or any other specific entity." (emphasis mine)
Re:GPL Kool-aid (Score:5, Insightful)
These guys did a wonderful job. Six years contributing to software that was obviously so good that other people could make money off it. Its one thing to work on an open source project in your spare time, or to be employed by one of the few companies that can leverage free software to make money, but these guys aren't. So unless you are working on the kernel, on samba or one of maybe a dozen other projects, you can't give up your day job.
Maybe by closing the source, one of their competitors will buy them out and they will have enough money to live on and write open source code. Rather than berating these guys for leaving the fold, thank them profusely for the six years of hard work.
If you don't like it, fork it. Once GPLed, always GPLed, and only V3 and above is going closed.
Re:GPL Kool-aid (Score:5, Interesting)
But sometimes I think the authors of popular open-source software see their user base and think "gee, what if I had $59 from each user!"... when in fact, "free" is their main competitive advantage and the only reason they have users in the first place. Charging for software licenses might save them, but it might just wipe them off the map.
Re:GPL Kool-aid (Score:4, Insightful)
Their call that using devices is a GPL loophole is pure BS. If somebody sells a device with the software and does not make any changes then they are entitled to that. If they change the sources then the sources have to be made available and I am sure that they did. The point is that somebody was clever enough to create a device that maybe they should have in the first place!
Here is a question, if the person's competition was making money on GPL, why couldn't he? Oh yeah he wanted to sell software and only sell software! Here's my prediction, that he will bankrupt himself after close-sourcing the software and blame it on the Open Source community!
Re:GPL Kool-aid (Score:3, Insightful)
Oh yeah he wanted to sell software and only sell software!
That's always been one of my points. If I wanted to sell T-shirts and tote bags, I'd already be doing that. If I wanted to be a consultant, I'd already be doing that. If I wanted to repackage commoditized software like the IT equivalent of a bottled water company, I'd already be doing that.
I never wanted to do any of those things. I always wanted to sell software, so I'm hooked up with a company that does that, none of it's Open Source, a
Its a big freekin pitcher... (Score:3, Interesting)
I guess they didn't gain anything from Linux, libwhisker, nmap, Bugzilla (MPL, I know - but they use it, and the argument still works), or any of the countless other open source projects. Why is it that coders always feel they don't get their ju
Re:Its a big freekin pitcher... (Score:3, Interesting)
For them, those are the benefits of free (gratis) software. In this case - their *project* - the GPL didn't work because it didn't foster collaboration. No one else was working
Re:GPL Kool-aid (Score:2)
Re:GPL Kool-aid (Score:2)
Re:GPL Kool-aid (Score:2)
This is no "loophole", this is the GPL. Free as in speech, free as in beer, free...
Whining about it years later because you're not getting rich off it doesn't really seem like an honest answer
Re:hmm (Score:5, Informative)
Re:hmm (Score:5, Insightful)
From their indication that they haven't seen any significant help in six years, we can presume that the third possibility is unlikely.
And, of course, old versions will still remain under the GPL (happily).
Re:hmm (Score:5, Insightful)
They cant go "closed source" - they've licensed it under the GPL. Unless they rewrite the app from scratch, or remove any code from parties that havent agreed to the new license... If linus wanted to close-source linux all the sudden, he couldnt do it either.
That's actually not true at all. They still own the code, the GPL is a license, not relinquishing ownership. What they can't do is use any code contributed by anyone outside the company. That code they'll have to re-write since it's licensed under the GPL and doesn't belong to them.
And obviously, the existing version cant be relicensed either. The latest release under the GPL is stuck there from now until forever.
They can't relinquish the license of course. Anyone that wants to take that code and maintain it themselves is obviously free to do so.
Re:hmm (Score:2)
hum.. isnt that exactly what i just said? "remove any code from parties that havent agreed to the new license"..
Maybe i'm just sour for getting modded flamebait and im missing something, but i would swear that was almost exactly
Re:hmm (Score:3, Insightful)
hum.. isnt that exactly what i just said? "remove any code from parties that havent agreed to the new license"..
You also said in your first sentence that they couldn't go closed source, and compared the product to linux. That makes it sound like you're trying to say they can't do it, or it'd be very difficult to do. The big difference is they've said there hasn't been many contributions to Nessus by anyone outside of Nessus. This makes it very easy to rip out those sections that they don't own.
Re:hmm (Score:2)
Re:hmm (Score:3, Insightful)
No, the GPL is a license with which a copyright owner can enforce their copyright on said code.
Reformatting doesn't help... (Score:2)
I imagine (Score:2)
This is only a dodgy strategy if anyone *has* been contributing, and didn't turn their copyrights over to TNS. Anyone gonna put their hand up here?
Re:hmm (Score:5, Informative)
While they can't "take back" the versions that are already out there, but the copyright owners themselves can make a variation and not release the source of the variation.
Re:hmm (Score:2)
Re:hmm (Score:2)
Yes they can (Score:3, Informative)
Re:Its (Score:2)
You meant to say its.
Surely you mean that he meant to type "its."
There is a point at which this sort of nit-picking is useless. If you understand what the originally writer was trying to express, then they have succeeded. I don't think most people care to have minor spelling/grammar errors pointed out (unless they are funny). Feel free to point out any errors I make though, as I am trying to develop better habits.
Re:Its (headline article to diff standards) (Score:2)
---
I think "to say" is okay grammar in this context. Message boards are similar to talking as much as they are to typing. In any case, it would probably be "to write" instead of "to type" tho I lack the grammatical sophistication to tell you why.
Since you asked...
You typed:
If you understand what the originally writer
Which would be
If you understand what the original writer (no ly)
You probably don't need "have". Succ
Proper English (Score:2)
Whom....cares?!?!
Re:Won't GPL3 fix this? (Score:2)
Are you questioning whether or not you heard this? Anyway, version 3 of the GPL is still in the drafting/comment period, with people suggesting new 'features' and such.
Maybe someone can post actual links to the relevant posts.
Maybe that someone should've been you, seeing as how you're so keen on it.