Defense Dept. committee has open-source leaning

As Government Computer News reports, the U.S Department of Defense has singled out open source in the National Defense Authorization Act for Fiscal Year 2009 (H.R. 5658). The gist? The Defense Department sees open source as a way to cut costs and boost security, and it wants more of it.

While open source has attained legislative approbation in Latin America and elsewhere, this is first time I can remember seeing it in a Congressional bill.

Currently, the open-source language is focused on aerial vehicles, but it's instructive all the same:

The committee is concerned by the rising costs and decreasing security associated with software development for information technology systems. These rising costs are linked to the increasing complexity of software, which has also resulted in increasing numbers of system vulnerabilities that might be exploited by malicious hackers and potential adversaries. The committee encourages the department to rely more broadly on (open-source software) and establish it as a standard for intra-department software development.

If you're an open-source project lead or commercial vendor, this language is a step in the right direction. If you're a proprietary-software vendor, well, perhaps you side with the Business Software Alliance (funded by Microsoft and others), which has been lobbying hard against the bill.

I don't personally feel that open source needs to be legislated to be adopted. Indeed, I'm aware of widespread adoption of open source within the Department of Defense already, commercial and otherwise. Perhaps this legislative action will accelerate adoption further, but again, I'm not sure that open source needs any assistance here. The cream has a way of rising to the top, and open source keeps rising.

Perhaps someone needs to introduce a bill to handicap open source's rise in order to help out those starving proprietary vendors? :-)

[Miark01]

I'm a huge open source fan, but I agree that Congress should not legislate what to use. Their goal should be to make these departments more _accountable_ for expenditures and computer security. Then, other departments would follow the DoD's lead and move to OSS.

[jtlevin]

Yeah, open source is WAAAYYYYY more secure...

http://secunia.com/advisories/search/?search=red+hat

And that's just red hat. Give me a break. Most software is insecure whether it is open source or proprietary.

[The_Decider]

That is waaaaay better than XP.

All software have flaws. That doesn't make them all equally flawed.

[mbenedict]

Open source security is a huge myth. Just look at how many persistent security flaws we've had (and continue to have) with projects like sendmail, bind or even apache http.

Last year there were less vulnerabilities in Outlook than in Mozilla's mail reader (Thunderbird.) I mean, come on, how can a product be *less* secure than Outlook, right? Just proves Open Source means nothing when it comes to security.

As a security architect I'm sorry to say that most software developers today (whether open or closed source) have no idea about basic application security, and much less about broader security issues.

Ironically today Microsoft is one of the very few companies that "get" security, mandating a Secure SDLC. More companies and open source projects need to adopt processes such as security code reviews, security testing, employee rotation, third-party audits, etc.

[The_Decider]

I seriously doubt that TB had more flaws than Outlook, but even if it did, all flaws are not equal.

The vast majority of OSS flaws get fixed before they are exploited. Most proprietary(notably MS) don't.

[pagan189]

Interesting and to the point i must say i agree with you ... however can i ask you what OS you feel the safest on... with me its Linux ....

[wmyinzer]

"Open Source Software" is an idiom by itself. COME ON MATT, ADMIT IT! YOU SHOULD KNOW BETTER!

Proprietary code is usually more secure, and it doesn't take a computer programmer to know that. I agree with Miark01 on one thing: they shouldn't be worrying about security, but accountability.

> "I don't personally feel that open source needs to be legislated to be adopted"

It does need help, because right now, open source as well as "free" software is prohibited by policy of most Services within the DOD.

However, I don't think they need to make it mandatory as much as just get rid the policies prohibiting it (as well as about 90% of the rest of the DOD's IT policies, which are mostly outdated and asinine.)