Is open source practical for military use?

This guy sure doesn't think so. Clicky.

What do you think?

As a former soldier I don't think I'd want to trust my life to something completely open source, however, I think if Uncle Sugar got away from using exchange servers in favor of something non-proprietary that would be a good thing.

To me, this article smacks of a guy who makes a living selling MSFT products to the government expressing sour grapes, but I do think he brings up valid issues. I also, however, doubt that orderly room clerks would ever be downloading something from sourcefire that is going to change the dynamics of the battlefield.

Talk amongst yourselves.

Well sir,

My answer is "no"................I have mil and weapons of mass destruction experience, and we tend not to trust open source.

Now, that is irrational, I know...............the enemy can buy and reverse engineer the closed sorce stuff?...........

All I can say is which side of the court martial table would you prefer to be sitting?

:D

No I do not think the Military will ever trust open source.

In the past year I have implemented several new systems to the Post I am on, all of them COTS and it almost takes an act of congress to get it approved for use on the Global Information Grid.

The militery is still running Windows 98 in some places. The technology may be state of the art in the militery but its still using Vietnam equipment. I am in a Signal Bn and we are using at least 30 year old stuff.

The militery is already using Linux in alot of areas.

http://slashdot.org/articles/03/03/0...id=103&tid=163

Not to mention that the NSA also put out its own form of Linux

http://www.nsa.gov/selinux/index.cfm

Another military guy weighing in.

When you folks are talking about all this 'important' stuff, its on a total seperate network, one that is not connect to the www. So whether or not open or closed programs are used, Joe Q. Public cannot physically/logically access the classified networks anyway. So the point is moot.

Just a side note, most of the important stuff is running off of some type of open source software/operating system. From database to perimeter security, open source is out there, at the very least as a backup/secondary measure.

In addition:

The author of that rant is the CEO of Green Hills Software Inc. Check out their partner list: http://www.ghs.com/partners/index.html

Now they have their hand in alot of pots. Since they program custom 'embedded' software for everything from anti-lock brakes to satellites, who's to say that they couldn't embed something into their software, granting them a backdoor into almost anything? Even the CEO asks this question

"Who would intentionally introduce malicious code into software that they knew was going to be used in military and critical infrastructure systems?"

Is he saying we trust him just because he has a monetary interest in the product? Can't we say the same about all the problems with closed programs like Windows? Did Bill Gates leave in vulnerabilites just so he has the government and the DoD by the short hairs, doomed to upgrade and patch till the end of time? Sounds like a good business model to me.

My point, if its open source, and anyone can 'introduce' malicious code, then its an atrocity. But when it code is purchased without source from a coporation, and its riddled with holes and vulenerabilities, then its a 'business model'

I call bullshit.

/rant

Why is air traffic control software not open source? Why is subway transit system software not open source? Why is NORAD software not open source? Why is SMG or LOCK software not open source? ect....

Do you even know what the CMM is?

http://www.sei.cmu.edu/cmm/

Open source is level 1.

*echo*

Open-source would be devastating to the military...www access or not...There is always a way. Linux has just as many holes as Windows does, but you don't hear about them..because as far as 90% of the world is concerned, Windows is the only OS. Many people I speak to know of two things: Windows, and Mac...and no one knows a damn thing about Macs. Windows is the most widely used OS in the world, therefore more vulnerabilities are found and exploited, as well as more viruses being written for it. Besides, I don't think the military would completely abide by the GNU-GPL, eventually turning Linux, and the open-source community's hard work, into a military-run project.

My $.07

A_T

The military wouldn't develop OpenSource Software, the example being for things like missile guidance systems. Why would you build something and let the enemy have the same thing?

The government has interests in computer technology. Ever heard of the NSA key built into Windows? I know someone here on AO mentioned finding references to it. Heard about those laptops in Afghanistan with encrypted information on their HDDs? You can probably (safely) assume that the government had a very easy time recovering the information.


Personally, I'd like to see things like the expensive annual licensing for exchange (e-mail) servers change to an opensoruce alternative. That is a lot of money. But it won't happen anytime soon, because there is a lot of stuff tied into using Microsoft products that is ages old.

I was at a (military) school in Japan, and they are primarly Windows. For a while I was working with the techs to setup an Apache server to be used inplace of an IIS one to face out to the world, but after hearing that it had to support AD and other MS features built into IIS, it was abandoned. Also because the techs would have to maintain the server and be responsible if it wasn't IIS. It is sad to think of how closely tied that computer is to the military networking infrastructure over there, and how it is just a huge gaping hole out there on the Internet, simply to maintain compatibility. May they be lucky and avoid Internet problems...

On a brighter note, that computer gets Internet access via one of the biggest military networking hubs/backbones in the area, where there are several people watching network traffic, etc., and actively working on...um...exploring...the Internet. So anyone who decides to ***** with it will have their packets traced back to them. :)

I say they should and could, but with a catch. By choosing OSS they would have free access to the source code of their choice (UNIX, BSD, Linux) and could alter it to their exact needs. However, make it closed source. For example, the NSA released it's SELinux patch for Linux based kernels to add extra layers of security to the kernel and processing stacks. Who knows what else they could have working behind their walls on open source?

See my point?

Work with the base OSS and then fork it to the government/military's specific needs. Then, close source that fork and lock it up. This way the source code isn't in the hands of civilians(linux) or in a buisness's grasp (Microsoft), but is fully underwatch, management, and kept secured by the military itself (those who would manage the project specifically).

I see tons of opprotunity if they follow that model, and I wouldn't doubt that NSA, CIA, and other similar high-technology groups have already done so.

It would be really, really difficult to trojan Linux in a way which makes it unsuitable for military applications while creating a deliberate "fault" that would not affect other software, and would pass all regression tests and sneak past the kernel maintainers.

It is not true that Linus reads every line of code personally. There are instead subsystem maintainers (Linus' Lieutenants) who collect patches for individual subsystems. I believe that they do generally read every line of code submitted.

There are a lot of other things which would be far easier to trojan than Linux of course - libc perhaps, or gcc - I've no idea what their policies are.

In any case, it would be fantastically difficult to create a deliberate error which would cause some predictable behaviour, when you don't know anything about the software running on it.

Bear in mind for governments outside of the US, worries about the integrity of the Windows source code prevail - the possibility that it contains US government trojans seems high to some analysists (I am not privvy to any classified information on this topic, and even if I was I obviously wouldn't be able to discuss it).

I love the way that some governments get to see the windows source code, but they aren't allowed to use it to build their own copy of windows, oh no, they still rely on binaries from Redmond. Hence they have no idea whether what they're looking at is the windows source code or not.

In any case even if Redmond hasn't got US government bugs in your Windows now, it could add them at the behest of Washington at any moment and distribute through Windows update faster than you can say "Terrorism".

I don't see how Linux can possibly be less trustworthy than Windows, to the US government, or anyone else. I can however understand if people don't want to use it for flight control software, nuclear reactor monitoring, missile guidance etc. But that would be more to do with bugs than trojan.

Anyway who's to say the US government haven't also got backdoors in WRS VxWorks? That is at least partially distributed pre-compiled.

Slarty

Well as that Dan O'Dowd said, parts of Linux is made by programers from places you wouldnt normally buy defence equipment from!

I wouldnt be happy if the army started using software that was made in Korea/russia/afgan etc.

I think the main problem with open source is that they dont know who has coded what.

Also due to the nature of what it would be used for the would be an awful lot of NDA's to be signed, which kind of defeats the purpose of the open source movement!

The british army is in the process of getting a new radio system, which runs Win2000, ....... they now pay Microsoft 3.4 Billion pounds a year for the privalige!! So there must be a good reason for those in the know why open souce isnt used as im sure they would prefer to save 3.4 billion quid if they could!!

Quote:

---

I wouldnt be happy if the army started using software that was made in Korea/russia/afgan

---

out of interest nokia.... why not? Software manufacturers in first world countries e.g. US, UK, most of europe etc are just as likely to miscode/introduce bugs/trojans/whatever as programmers in those countries you've listed. Sure I know the governments of Korea, Russia and Afghanistan might be a bit dubious at times... but is that any different for the US, UK etc? I think not.

Incidentally... nokia I really wouldn't hold up british army procurement as a model for something being good at the moment (not saying 2k isn't good mind ).... they spend money like water on some things

I think Pooh and Slarty both have very valid points - I think a partial open source implementation would be the best course

Quote:

---

Originally posted here by Nokia

The british army is in the process of getting a new radio system, which runs Win2000, ....... they now pay Microsoft 3.4 Billion pounds a year for the privalige!! So there must be a good reason for those in the know why open souce isnt used as im sure they would prefer to save 3.4 billion quid if they could!!

---

Geoff Hoon gets backhanders from Microsoft?

Seriously, they must have a pretty good reason to want to do that? Bill Gates did meet Blair a few years ago, I wonder if any favours were traded?

Slarty

[QUOTE] Originally posted here by MK19
[B]The militery is still running Windows 98 in some places. The technology may be state of the art in the militery but its still using Vietnam equipment. I am in a Signal Bn and we are using at least 30 year old stuff. [QUOTE]

As of 1 OCT 03 all Windows 98 machines were required to be gone from Military installations. 31 Dec 03 required all Win NT machines to be off the network only exceptions were for Win NT Server. That was a DA Directive I hope you still do not have them running on the network where you are.

The chinese were so paranoid that the US was going to trojan its software that it created its own linux distro, I think its called red flag linux. I think foriegn goverments have a rite to be concerned about buying software, there was an incident that is said to have brought the cold war to a close where the US goverment teamed up with a manufacturer selling the company incharge of the trans siberian oil pipe line chips containing a trojan (not in the sense of subsevern and that sort of thing) that caused the oil pipe line to explode.

A week ago before I started reading a book about shellcode, I would of argued that linux is good as you can assess the code and patch it (of course this works from both persectives), but now having read about things such as executing code on the stack and things, I think windows fundementally looks more secure...Looks being the key word.

im sure opensource is deployed in military applications, I sure as hell dont think GCHQ is running windows 95, on its HPC's

i2c

ohh yea...The thing is I believe if these things are properly auditted before there entrance into an operational world then thats surely a good thing, if goverments are just relying on the software being closed source as a protect then thats a grave error, i know the Uk goverment has a team that tests and audits called CESG, im sure the NSA do similar in the states..

Nihil definatly seems the most informed to comment on this topic

i2c

Quote:

---

Incidentally... nokia I really wouldn't hold up british army procurement as a model for something being good at the moment (not saying 2k isn't good mind ).... they spend money like water on some things

---

The SA80 was designed in 58, if memory serves me correctly. How long ago was it issued? In 87 i was still using the SLR. In 82/83 i forget now, i shot at bisley in the combined serves championships, vickers had a caravan there showing off there gear. The sales rep told me "The army have been trialing this (SA80) for 10 years, this is going to be the weapon you use in the future", basicaly, he said so much money has been spent on this, there is no way the MOD will not bye it!!

As for open close/source debate. We will all be back to waving flags to communicate once a few nukes have been slung. Due to EMP.

A couple things.....

1) The whole 'secret squirrel' thing doesn't really work very well in real security. Just like encryption algorithms can't
realistically be declared secure by their authors without massive independent peer review, the same is true of any software product. To compare Linux to a totally closed and obscure OS is like comparing DES against some algorithm that you and some of your freinds came up with last week. You can say it is more secure, but it really isn't until a whole bunch of people smarter than you have tried to break it and finally agree with you.

2) Remember what specifically we are talking about when we say 'Linux'. Most remote and local exploits for linux
are for optional services and software, not Linux proper (i.e. ther kernel). To judge Linux on the security of these packages makes as much sense as saying that Windows™ is unsecure because of all the exploits for ICQ, or because Kazaa is spyware. As to building secure systems, It should be relatively easy to construct a Linux system with just the bare essentials for it's task, thus mitigating risk, and making it more secure.

3) I see a lot of scoffing about open source not possibly being able to be secure enough for U.S. governement/Military use. To this all I can say is....

Only one remote hole in the default install, in more than 8 years! --- OpenBSD!

-- spurious