US Dept. of Defense Creates Its Own Sourceforge 131
mjasay writes "The US Department of Defense, which has been flirting with open source for years as a way to improve software quality and cut costs, has finally burst the dam on Defense-related open-source adoption with Forge.mil, an open-source code repository based on Sourceforge. Though it currently only holds three projects and is limited to DoD personnel for security reasons, all code is publicly viewable and will almost certainly lead to other agencies participating on the site or creating their own. Open source has clearly come a long way. Years ago studies declared open source a security risk. Now, one of the most security-conscious organizations on the planet is looking to open source to provide better security than proprietary alternatives."
~obscurity = security? (Score:5, Insightful)
Re:~obscurity = security? (Score:5, Funny)
I have a server running somewhere on the internet.
It has an IPv4 address with an open port 666
The password is donkeydick69
If you can't find and login then obscurity does equal security.
Re: (Score:2, Funny)
I left you a present :)
Re: (Score:3, Insightful)
You have an unusual definition of security. Let me tell you a few ways that having an obscured login name does not make you secure:
Insecure server or service: By virtue of running a machine connected to the internet with an open port attached to a program, you are opening a potential security risk.
If you can't find and login then obscurity does equal security
You presume that login credentials and IP addresses are "unfindable". Warrants, interrogation, torture, greased palms, all of these things can easily circumvent the fact that one does not know information about yo
Re: (Score:2)
> You presume that login credentials and IP addresses are "unfindable". Warrants, interrogation, torture, greased palms, all of these things can easily circumvent the fact that one does not know information about your machine _right now_.
Sure, but that means nothing can be secure unless nobody knows about it and nobody can find out about it OR it in inaccesable for everyone. If we assume an opponent who plays without any rules whatsoever and has unlimited resources and can find out where you live, you al
Re: (Score:1, Informative)
It isn't even about having unlimited resources. For instance, take the great grandparent scenario. Lets say I offered some slashdot intern $4000 to get the IP address of the person who made that anonymous post, then I offered $4000 to some underpaid tech support person at his ISP to give me some information about this person. If he was posting at home, I could find out where he lived. A plane ticket, a rental car, a gun, and you would be able to hack into his "security through obscurity" server.
$12,000 (est
Re: (Score:2)
> $12,000 (estimating fees) isn't anywhere near unlimited funds. If he had something that was worth the effort, an average businessman could spend that much to get it.
Sure, but an average businessman doesn't go around kicking peoples doors in and threatening people with a gun to force them to give up their secrets (well, not where I'm from). Even if they do, the password great great grandparent gave us is useless: if you visit him and threaten him with a gun, you don't ask for the ip and login of his ser
Re: (Score:2)
Then again, great great grandparent's computer could be behind a router blocking incomming connections...
Then it's no longer simply obscurity.
Re: (Score:3, Funny)
But it IS irrelevant if you are prepared to go to his home and beat any information you need out of him.
Re: (Score:2)
Re: (Score:1)
There is a solution to this: metal detectors on all doors and windows, and a degaussing coil.
If someone steps in with a gun, the secrets automatically get blown away.
Re: (Score:3, Insightful)
Sure, but that means nothing can be secure unless nobody knows about it and nobody can find out about it OR it in inaccesable for everyone. [...]
Yes and no. Security is not absolute, it's not binary. It is the factor by which the amount of time and resources needed to break a certain security measure outnumbers the value of what's protected (or the effort needed to go through a different vector).
Obscurity does not add anything on your side of the scale because you can't depend on it, you can't measure it, you can't audit it, and in most cases you will only know it has been broken when it is too late. It is a good idea to keep information about your
Re: Here is a way... (Score:2)
Re: (Score:1)
Where you at?
Re: (Score:2)
Just because I can't find it and login does not make it secure. You need to take into consideration the massive bot nets currently operating that constantly search IP addresses for security holes.
Even if a setup is never compromised it is not necessarily secure. I hate to get all philosophical but if you build they will hack it.
For example I give you any copy protection that has ever been implemented.
Re: (Score:2)
> For example I give you any copy protection that has ever been implemented.
That's a bad example. Copy protection can easily be circumvented because you have physical access to and root permissions on the machine the to-be-copied data is on. DRM gives you the encrypted data and the key.
Re: (Score:2)
Re: (Score:2)
Back of a napkin: Using my modest (hypothetical) botnet of about 10,000 hosts, there's a decent (~25%) chance I will find and exploit you inside of a day, and a near-certainty that I will get you within 3 days. Just to be charitable I could throw in a random fudge factor of one week.
I could probably speed it up if I could depend on certain assumptions or if I have a little additional data.
Point being, the internet seems huge but it's not really all that big.
Re: (Score:1)
If you can't find and login then obscurity does equal security.
If a tree fell and there was nobody in the forest to hear it, would it still make a sound?
Re: (Score:2, Interesting)
Re:~obscurity = security? (Score:5, Insightful)
OK, you missed the entire point of the maxim "Security != Obscurity".
It is a truism. The point is this: any secrets will eventually be leaked, whether you know it or not. Things that are easy to change, such as keys and passwords, are relatively low risk. Things that are very difficult to change, such as algorithms, are very high risk.
If you count on the fact that your crypto algorithm or operating system is secure because its obscure, then when its leaked you will be facing a catastrophic disaster. Instead of losing the data on one communication or one server, you face a organization wide vulerability, and compromise of past communications.
The extra security gained from keeping the algorithms secret pales in comparison to the disaster of having them be weak.
Getting as many eyes on this type of code as possible is the best way to mitigate risk.
After that, you still keep as much secret as possible.
Re:~obscurity = security? (Score:5, Insightful)
You're missing the point. Good processes are hard to come up with. Pick a good process that has some well-defined unknown, something that you need to keep safe, and you're assured that no one will break your security. Pick a bad process, and someone may tell you.
If you keep your process a secret, on the other hand, you have a host of unknowns - unknowns you do not know - that may provide someone access to your system. The point is, relying on a variety of ill-defined unknowns is inferior to relying on a single, well-defined unknown.
Re:~obscurity = security? (Score:5, Insightful)
The point of it is that things like "Oh don't worry, nobody would think to look at /admin.pl so there's no point in putting a password on it" is not a good idea. Of course something has to be unknown or inaccessible for good security - that's not the same thing as claiming your system is secure when you're just hoping somebody doesn't notice a gaping flaw.
There's nothing wrong with obscurity in a secure system, but obscurity alone is not genuine security.
Re: (Score:1, Informative)
This is NOT an official DoD site. It's pointing to too many non-DoD sites, including for CAC/PKI sig's registered through GoDaddy, hosted on Collab.net.
Using Slashdot as a large DoD Fishing Scam is interesting...
Re: (Score:2, Informative)
Re: (Score:2)
This should be an interesting experiment in whether subjecting code to an early phase of public hazing reduces security holes and risks of all sorts.
It's extremely unlikely that any SourceForge type repository for government-used code will have much if any public access.
forgemil.com? (Score:5, Interesting)
Re:forgemil.com? (Score:5, Interesting)
Re: (Score:1, Insightful)
Re:forgemil.com? (Score:5, Informative)
Re: (Score:3, Insightful)
Nice. It even points the user to ANOTHER non-.mil site to download a PKI certificate. That settles it for me. This is NOT the military.
It's almost certainly a phishing site to gather CAC data from unsuspecting CAC holders.
Re: (Score:1)
It's almost certainly a phishing site to gather CAC data from unsuspecting CAC holders.
The CAC is a smart card, which shouldn't willingly reveal any of the keys stored on it.
Moreover, I suspect it would be impossible to authenticate without the server itself having certain keys and credentials.
I don't know enough about it to declare that phishing is completely impossible, but I would say that phishing seems unlikely.
It would also be pretty hard with a SSL client certificate.. although a man-in-th
Re: (Score:2)
Re:forgemil.com? (Score:5, Insightful)
But wait, there's more!
DefenseLink [defenselink.mil] is a DoD site that lists all DoD sites. Forge.mil(.com) is not on that list. Of course, it could be bureaucracy acting slow.
Second, WHOIS contact connects to an individual at collab.net, another sourceforge-like site. Were this a government site, I would think they would have it registered to a position in a department, or at least a c/o address for a military/goverment institution, not an individual.
Just to be sure, popping the given address into Google Maps returns what looks like a residential area.
So this is either a horribly managed project (not surprising for the government), or some weird scam of sorts.
Re: (Score:3, Informative)
Nice. It even points the user to ANOTHER non-.mil site to download a PKI certificate. That settles it for me. This is NOT the military.
The homepage of the site they are pointing to https://www.dodpke.com/ [dodpke.com] Says the site has moved to: another url [army.mil]
Which refers you to: this document [army.mil]
Which states the following:
Alternate method of retrieving DoD Root Certificate
If you have trouble accessing the page listed above you can also visit the following page to download the DoD Root Certificates: https://www [dodpke.com]
Re:forgemil.com? - of course it's military (Score:1)
Registered in the wrong TLD? Untrusted PKI source? Tells you you don't have permission to access the site? Screwed up beyond belief? How can you doubt for a minute it's military?
unfortunately no smiley, if the military had gotten a process patent on disfunctional bureaucracy we could have a balanced budget collecting royalties from the banks and investment firms.
Re: (Score:3)
Probably because the servers are located in a commercial and not a government facility. They probably don't want to go through the hassle and cost of getting a NIPRNET circuit, which is somewhat ironic because this is a DISA effort (the same people who run NIPRNET).
Re: (Score:1)
Re:forgemil.com? (Score:5, Informative)
You know it's the right site, because its certificate is signed by the DoD CA.
Except that CA isn't installed in any browser.
And the site to download that cert is signed by the cert itself. Security by circular reasoning.
Re: (Score:2)
This site just screams scam.
Re:forgemil.com? (Score:5, Informative)
The reason for that is, you have to be in the DoD and you receive the cert by CaC (DoD ID cards which double as a smart card with your PKI certs and authentication information). This forces you to obtain the certs physically and in person at a DoD site (ie ID Center on a military base, etc.).
Re: (Score:1)
So is https://www.dodpke.com/InstallRoot [dodpke.com] the real location to download CaC's public key, or is that another scam (since it claims to be the defense department's CA, but their website is on a .com domain and has a self-signed key)
Re: (Score:3, Informative)
Re: (Score:2, Insightful)
Re: (Score:2)
Re:forgemil.com? (Score:4, Informative)
forgemil.com is for public access to information about what the project/service is. It explaines, quite clearly, that to access forge.mil, you will need either a DoD-issued pki cert (CAC for you DoD folks), or a cert from a DoD-trusted source. All .mil infrastructure stuff is pki protected by policy. It also explains in the FAQ why you get the ssl warnings about untrusted certs. It also tells you how you can download the DoD root certs (they only provide installs for Windows; you'll either have to dig around to get the certs for other platforms or just create an exception in your browser).
Re: (Score:2)
forgemil.com resolves fine in my browser, forge.mil requires that a dod root certificate be entered, and also seems to be slashdotted at times. The official forge.mil site requires DOD credentials so the projects can be edited, forgemil.com seems to be read only.
Re: (Score:1)
Re: (Score:2)
1) Big name contractors are very close-hold with their code for business reasons
This boggles my mind. Isn't most everything developed under government contract property of the government? This is to say, "Doesn't the government own pretty much all of the source code that its contractors produce for it?"
It's not "SourceForge" anymore... (Score:1, Informative)
It's based on SourceForge Enterprise Edition, a product that VA Software (Now SourceForge, Inc) sold off to CollabNet about two years ago. It's not even close to the code that runs sourceforge.net (sf.net's code was a php/python/perl based site, SFEE is J2EE).
Re: (Score:2, Funny)
They won't have a "news for (military) nerds" site called Dot.mil, would they?
Re: (Score:2)
Legacy Applications (Score:3, Interesting)
I would like to see open source applications that would replace all of the legacy, proprietary applications. DoD is loaded with very badly written applications that usually can only be changed by giving the same companies that produced them more money. Notice I said "changed" and not "improved".
Huh? (Score:4, Insightful)
If it's 'limited to DoD personnel for security reasons' in what sense is it 'Open'?
Re: (Score:2)
Indeed, I just tried to look at some projects and you can't. Pointless.
Re: (Score:3, Insightful)
Sure, it's not open to 6 billion people, but it might be open to several million, and that's a heck of a lot better than closed in someone's desk drawer.
How exactly is that different than something like this:
3. RESERVATION OF RIGHTS AND OWNERSHIP. Microsoft reserves all rights not expressly granted to you in this EULA. The Software is protected by copyright and other intellectual property laws and treaties. Microsoft or its suppliers own the title, copyright, and other intellectual property rights in the Software. The Software is licensed, not sold.
4. LIMITATIONS ON REVERSE ENGINEERING, DECOMPILATION, AND DISASSEMBLY. You may not reverse engineer, decompile, or disassemble the Software, except and only to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation.
5. NO RENTAL/COMMERCIAL HOSTING. You may not rent, lease, lend or provide commercial hosting services with the Software.
It is ours not yours. You may do only what we let you. You can't give it away.
Million drawers or just one - same thing if there is only one key to all the drawers.
Open within a community that is guaranteed to be all "U.S. Persons" for export control purposes, perhaps.
Apple's and MS' products are open within their own community too - is that also Open Source?
Re: (Score:3, Informative)
Also... How can something military be open source at all?
Military, unless we are talking para-military guerrilla troops somewhere in the jungle/desert, represents a particular government.
Say... government of Canada. Or Peru.
Now... that government is responsible and accountable to IT'S people. Not to the people of say... Singapore. Or Italy.
People and nations that are on a good day economic competition and on a bad day vile evildoers.
So, giving access to state secrets to potential enemies (and open source do
Re: (Score:3, Insightful)
The software is open... not every strategic decision or case use in which the software will be used.
Re: (Score:2)
Did you even bother to read the Forge.mil User Agreement?
Re:Huh? (Score:4, Informative)
Yes, which claims a standard United States Government agreement which claims they own the computer, the data, your soul and anything else that may come in contact with it... but it also states "Forge.mil is currently in beta with limited operational availability. General availability for unclassified use is scheduled for Spring 2009." So, one could safely assume (at this point) that with the PKI Certification that's needed and the agreement they expect only DoD computers to be accessing it at the moment. However, at some point everything stated will be changed (or they'll change their mission from being 'open').
Re: (Score:2)
Also... How can something military be open source at all?
Lot's of software written by the military is not secret. For example, I believe the Army ran some sort of engineering competition for kids, where the participants had to "design and test" a bridge using a computer bridge simulator. The software was freely available (Windows only), and there were calls for them to release it as open source. They actually said they were considering it. I can't see how that could compromise our national security. Al
Re: (Score:2)
If it's 'limited to DoD personnel for security reasons' in what sense is it 'Open'?
Many DoD contractors write software for various projects. Allowing them a secure means to share code with each other would be immensely helpful. You can have several developers within a single contract, but in different companies and different locations around the world contributing to the software. For instance somebody from Harris corp. could submit patches to software written by Raytheon. Up until now there was no way to accomplish this. The best you could hope for, was to submit a request, and hope
Big brother is watching... (Score:3, Informative)
STANDARD MANDATORY NOTICE AND CONSENT BANNER
YOU ARE ACCESSING A U.S. GOVERNMENT (USG) INFORMATION SYSTEM (IS) THAT IS PROVIDED FOR USG-AUTHORIZED USE ONLY. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.
Use of this system constitutes consent to monitoring for all lawful purposes.
Re: (Score:2)
And you think that a little bitty notice on an obvious DOD site is scary?
Re: (Score:2)
Did you miss the "devices connected" part? And what happens when you access the site... connection wise?
Re: (Score:2)
I don't need Russels commentary. I'm well aware of the spying and know that we do not yet have the processing power to analyze such data stream in such amount for terrorist identification. Especially when you realize that terrorist communication can be so well hidden as to be common conversation where the communicating parties know a different meaning to what is said. Words, abstractions are only of value when used with agreed upon meaning, where the meaning can be established to be something quite differen
Re: (Score:2)
Duh.
[sarcasm]I would feel a whole lot better if all the people of the world could access our government systems and do whatever the hell they could possibly want to with those systems[/sarcasm].
Yes, indeed, big brother is watching over who uses their systems, how they use it, and for what purpose and intent. Just like if someone were to come over to your house and use YOUR system, you'd feel better knowing the purpose of the use. "No, sir, that was certainly not MY kiddie porn on MY computer..."
Re: (Score:2)
Everything in that statement is in reference to the "forge.mil" server. Communications to and from that server can (will) be monitored. You should accept that possibility with any system on the Internet, if you're smart. "device attached" refers to anything attached to the server, like a USB HD or other media. You can be paranoid and think your computer is "attached" to the server when you make an HTTP(S) connection, but you know that's not what they mean.
This is a standard warning that says you're connecti
Re: (Score:1)
We needed this years ago (Score:5, Funny)
When I was first hired as a budding DoD programmer a long time ago, one of the first things I asked is "where is our library of stuff that has been developed locally?"
I might as well have asked "where is my +3 mace?" because we didn't have that either.
I'm glad this is finally happening.
Re: (Score:1)
I might as well have asked "where is my +3 mace?" because we didn't have that either.
I think perhaps you're confusing "DoD" with "DnD". Unless you have need-to-know access to a program I'm unfamiliar with...
Re: (Score:2)
Why settle for a +3 mace when you can sit next to a +5 WMD? Really, you were thinking small. To conquer, one must think larger. Bwaahaahaahaa, bwaahaahaa, bwa...
Open the flood gates (Score:5, Interesting)
Re: (Score:2, Informative)
In the Intelligence Community (IC), the term "open" refers to overt, publicly available sources (as opposed to covert or classified sources); it is not related to open-source software.
Studies? (Score:4, Funny)
Since when did risible falsehood and fallacy filled rants written by swivel-eyed ideologues count as 'studies'?
http://www.sourcewatch.org/index.php?title=Ken_Brown [sourcewatch.org]
Kindof open anyway (Score:2)
[JoinCommunity]*
*DOD CAC or ECA Certificate Required
How easy is it to get one of these certificates?
Re: (Score:1, Funny)
Plenty easy. I know some recruiters that would be more than happy to give you a PKI enabled CaC...all it would take is a few signatures on your part, and raise your hand for one little oath...
Hopefully all the GOTS software will be there too. (Score:4, Informative)
In most cases, if software was developed under a government contract, then the government has full rights to the source code. It would be a great starting place for updating a number of existing applications. Version control and vetting of results could be problematic in some cases, but not impossible to overcome.
For those of you trying to connect...read the FAQ (Score:4, Informative)
"Though it currently only holds three projects and is limited to DoD personnel for security reasons, all code is publicly viewable"
No, it's not. Code posted to .mil is only available to those with sufficient authorisation. The .com site is publicly available for those seeking more information.
So, code will be NOT be 'publicly' available - only to those on secure. Kinda as you'd expect, but rather a long way away from real FOSS.
One project already works and is in use. (Score:4, Funny)
The Forge.mil effort started development in October 2009 and the first capability, SoftwareForge, is now available for limited, unclassified use.
Not new or even news .... (Score:1, Insightful)
Re: (Score:1)
Re: (Score:2)
You must be referring to Open Source desktop apps installed on your computer. To get something installed on a locked-down box does require putting in a request - although I've never had one turned down (I have Eclipse, Subversion, Python, Firefox and more installed).
As for custom applications - DoD has been using Open Source software in development of custom apps for years - myself for 7+ years, personally. I've never encountered resistence to developing and deploying apps that utilize Open Source software
Re: (Score:1)
HUH (Score:2, Funny)
" Though it currently only holds three projects and is limited to DoD personnel for security reasons, all code is publicly viewable and...."
ok how do you limit the site and make it public at same time, good journalism guys.
and
"Slashdot only allows a user with your karma to post 2 times per day (more or less, depending on moderation). You've already shared your thoughts with us that many times. Take a breather, and come back and see us in 24 hours or so. If you think this is unfair, please email posting@slas
I hope this is a fishing site (Score:5, Insightful)
Clicked through the site a little to the 'PKI Online Training' section, and I'm informed that I must :
1. enable flash
2. enable cookies
3. enable javascript
4. disable pop-up blocking
I desperately hope this is a scam, since the alternative possibility is just frightening
Re: (Score:2, Informative)
Re: (Score:1)
ahh, wonderful,
critical SECURITY holes MUST be enabled to use the "secure" site.
make perfect sense... if you are a government drone.
awesome! (Score:1)
slashdotted (Score:2, Funny)
Re: (Score:2)
Yes, time to report to Guantanamo Bay... Oh wait they closed that place didnt they?
https://www.forge.mil (Score:1)
Re: (Score:1)
Douglas Adams on Reason (Score:2)
"Well," he said, "it's to do with the project which first made the software incarnation of the company profitable. It was called Reason, and in its own way it was sensational."
"What was it?"
"Well, it was a kind of back-to-front program. It's funny how many of the best ideas are just an old idea back-to-front. You see there have already been several programs written that help you to arrive at decisions by properly ordering and analysing all the relevant facts so that they then point naturally towards the rig
DIY (Score:1)