Author Topic: Department of Defense launches open source site Forge.mil (Read 22,426 times)

40hz · « **on:** February 04, 2009, 09:19 PM »

From our friends over at ArsTechnica:

http://arstechnica.com/open-source/news/2009/02/department-of-defense-launches-open-source-site-forgemil.ars

Quote

Department of Defense launches open source site Forge.mil

The Department of Defense has launched a new site to host its open source software projects. This move demonstrates the military's growing commitment to open development.
By Ryan Paul | Last updated February 3, 2009 12:04
-----------------------------------------------------------

The Department of Defense (DoD) has launched Forge.mil, a software project management site that will host the military's public open source software projects. Inspired by SourceForge, the new site was created to accelerate development by facilitating broader collaboration between government agencies.

But it gets better (my emphasis added

)

Quote

Defense Information Systems Agency CTO David Mihelcic announced the new site last week at a meeting of the Armed Forces Communications and Electronics Association. Development on the site began in October and the process of bringing it online began last month. The site is currently down due to an unanticipated traffic overload that has followed the launch announcement. The open source software community is clearly a lot more interested in the Web site than the DoD initially expected.

Well duh!

-----------

OMG! Imagine. Tux in the Army!

(Will Mouser be next?)

[attach]

bgd77 · « **Reply #1 on:** February 05, 2009, 10:22 AM »

Do you think that it is a good idea for the government/military to use open-source software? Isn't it a serious security risk?

Anyhow, I can hardly wait to see what projects they have.

zridling · « **Reply #2 on:** February 05, 2009, 11:05 AM »

Quote from: bgd77 on February 05, 2009, 10:22 AM

Do you think that it is a good idea for the government/military to use open-source software? Isn't it a serious security risk?

Quite the contrary. Collaboration, openness, and open standards sniff out weaknesses; look no further than browsers as an example. Well-formed data, universal, standards-based transforms, ubiquitous communications protocols will prevent costly, insecure code from being written over time. And specific code for weapons wouldn't be shared with the public, of course, but you can bet Great Britain is at the table, as may be other allies.

Much of the US Military uses Red Hat Linux right now in places like the Army’s Blue Force Tracking systems. And outside the DoD, but closely related, the NSA has been a part of the development of SE Linux. (Intellipedia offers more stories.)

*Also, check out Matthew Burton's essay, Why I Help “The Man”, and Why You Should Too.

bgd77 · « **Reply #3 on:** February 05, 2009, 12:34 PM »

Yes, you are right, in general. Thanks for the the links, I'll do some research.

But one scenario that keeps coming to my mind is that, being open source, some enemy of the US could try, and succeed, to find a vulnerability in the application, before it is discovered by the community or by the developers, by allocating some huge resources into analyzing the code (or just by chance). They would be afterwards be able to use the bug for their own purpose, for a certain amount of time.

Anyway, I'm sure somebody has thought about this.

40hz · « **Reply #4 on:** February 05, 2009, 01:07 PM »

It's true...

They do that already.

But so do we.

f0dder · « **Reply #5 on:** February 05, 2009, 01:19 PM »

I wouldn't go open-source for all kinds of systems, exactly because of the "prying eyes" argument... it makes sense for a whole bunch of systems, but the really closed stuff like weapons systems, fighter jet control systems etc. are probably best kept proprietary and locked down.

bgd77 · « **Reply #6 on:** February 05, 2009, 02:08 PM »

Of, course they shouldn't do that. I only hope they will not make a mistake

In my country, a policeman shared some confidential work-related files on a StrongDC hub (probably he did not know exactly what he was doing). A local journalist found them, downloaded them, read them and wrote in the newspaper about them (from what I remember he did not tell what the documents actually contained). Guess which one was investigated by the prosecutors.

I'm sure that the US Military are more professional than my country's policemen.

f0dder · « **Reply #7 on:** February 05, 2009, 04:08 PM »

Quote from: bgd77 on February 05, 2009, 02:08 PM

I'm sure that the US Military are more professional than my country's policemen.

* f0dder laughs uncontrollably.

40hz · « **Reply #8 on:** February 05, 2009, 04:54 PM »

How do you keep something secret when it isn't a secret?

The problem with computer technology is that there are very few 'secrets' in the true sense of the word.

Computer architecture is well documented; and the underlying mathematical and logical concepts are widely taught and understood. So barring some brilliant and unintuitive new algorithm, virtually any computer code could be reversed engineered after observing it's working function. Because once you know what a program does, it's just a matter of coding to duplicate it.

The same thing applies to most military technologies.

Look at atomic weapons. Once the physics of fission is understood, the big breakthrough has already been made. After that it's just engineering - as has been so neatly demonstrated by the recent proliferation of countries possessing or actively developing nuclear weapons.

If the US wanted to keep the atomic bomb secret longer, they should have never called it an "atom bomb." Because once they did, they hung out a great big arrow pointing down a very specific technical path for anyone else to follow. And follow they did.

Unfortunately, there's also another "inconvenient truth" surrounding military technology.

The US (like many major powers) also sells it's military technologies to what it considers friendly powers. America's so-called 'defense contractors' are also businesses that compete in the international weapons marketplace.

You don't need to hack into an aircraft manufacturer's database to get details on their latest jetfighter. All you need to do is go to an 'air show' and grab one of their brochures. Or call them up and have one mailed to you. And if you still need more information, one of their sales reps will be happy to take you to lunch and answer any questions you may have if you're interested in buying one.

Furthermore, whatever the manufacturer won't tell you can still often be found in Jane's Guide, which is available at many public libraries.

Sad truth is that most secret weapons aren't really 'secret weapons.' They're just products that come with sales and export restrictions attached.

-----

FWIW: I doubt you'll ever see any "weapons grade" code up on the Pentagon's website.

Waging war is only part of what the US Military does. Much of the time, it just operates like a very large and inefficient business. And like any big business, it spends a great deal of thought, time, and money on: logistics, training, purchasing, equipment maintenance, paperwork reduction, payroll, and medical benefits.

Plenty of code (and room for improvement) just addressing those areas.

CWuestefeld · « **Reply #9 on:** February 05, 2009, 05:22 PM »

After some thought, I'm inclined to view this in a positive light.

For too long, society has viewed things that can be used for evil purposes as evil in themselves. Guns are the obvious example, but recently GPS and Google Earth have been criticized. The thing is, these same tools can also be used in our own defense, making us each stronger (should we choose to avail ourselves of them) and thus stronger as a society.

I much prefer a framework in which I am empowered to defend myself, as opposed to one in which I am stripped of power and must hide behind some other authority.

Of course, this is all rather abstract thinking for something that's just a software project repository.

40hz · « **Reply #10 on:** February 05, 2009, 06:33 PM »

Quote from: CWuestefeld on February 05, 2009, 05:22 PM

Of course, this is all rather abstract thinking...

But that's also one reason why I always enjoy reading your posts!

f0dder · « **Reply #11 on:** February 06, 2009, 03:54 PM »

40hz: there's a big difference between making a dirty bomb (any monkey with enough cash and the right connections can do that) and achieving critical mass and nuclear fission. Of course the terrorist impact of a dirtybomb is bad enough, but it's destructive power is no near that of a properly done bomb. Even with complete schematics available (and ones that aren't purposefully slightly tainted, as the available ones are afaik) you need a lot of work, lot of money, and a lot of very skilled engineers.

As for reverse engineering, there's a big difference between RE'ing a piece of PC software and trying to get firmware out of sealed hardware. Stuff like missile targetting, fighter jet operating systems et cetera should imho be kept closed. And even if you got access to the hardware, you'd have a really hard time getting to the software. Sure, you can get a lot of details from the Janes catalogs or (if you have the cash and the connections) getting a sales pitch, and you might even be able to get your greasy hands on schematics. But even if you manage to build a JSF jet, you're not going to be able to use it for anything without the software...

CWuestefeld · « **Reply #12 on:** February 06, 2009, 04:45 PM »

Quote from: f0dder on February 06, 2009, 03:54 PM

you need a lot of work, lot of money, and a lot of very skilled engineers

If you can't handle this yourself, I know of someone who freelances this kind of work.

http://www.imdb.com/title/tt0088763/

40hz · « **Reply #13 on:** February 06, 2009, 06:08 PM »

Quote from: f0dder on February 06, 2009, 03:54 PM

you need a lot of work, lot of money, and a lot of very skilled engineers.

I agree with you. But the simple fact is that there are a lot of skilled engineers (and money!) available for this sort of thing.

Just look at who has 'real' nuclear weapons these days. North Korea? They can't even keep their population fed and housed, but somehow they've managed to gather the necessary resources to build a nuclear warhead - or three.

The point I was trying to make is that the technology for weapons development is a lot more attainable as time goes on. Credit it to the overall growth in technical sophistication throughout the world. It comes as a massive hit of culture shock to a lot of my friends (in the USA) when they see people in so-called "Third World" countries developing sophisticated technologies - or re-purposing existing ones for uses never imagined by their original creators. And I'm sure many people in other "industrialized nations" are guilty of the same hubris.

I've found it's good to remember two things about technical development and deployment:

1. Most of the people we don't like (who don't like us much either) are nowhere nears as dumb as we'd like them to be.

2. When it comes to technology: "The Street finds it's own uses for things." as William Gibson so nicely put it.

But that's all kind of moot. If you talk to professionals in the weapons industry or military, the general consensus seems to be that there is nothing you can do to stop the spread of technology. All you can do is slow it down. So most of the secrecy in the defense world is geared towards protecting the 'engineering specifics' such that it becomes too expensive and time consuming for most countries to reinvent "our" wheels.

Or at least it does until somebody like Kim Jong-Il comes along.

----

To your point about dirty weapons. I agree completely. You're just as dead from one of those as you are from a state-of-the-art military weapon. And bio-terrorism would be even simpler and more cost effective.

[attach]

f0dder · « **Reply #14 on:** February 06, 2009, 06:47 PM »

Quote from: 40hz on February 06, 2009, 06:08 PM

Just look at who has 'real' nuclear weapons these days. North Korea? They can't even keep their population fed and housed, but somehow they've managed to gather the necessary resources to build a nuclear warhead - or three.

It's a lot easier to keep your population in check if they aren't well-fed... if their everyday is a struggle to survive, they aren't going to have much energy to launch a rebellion.

Ehtyar · « **Reply #15 on:** February 06, 2009, 07:42 PM »

Is this thing actually going to be online anytime soon? How long does it take to setup some load balanced Apaches?

**Ehtyar ducks objects thrown by Joshua.

Ehtyar.

40hz · « **Reply #16 on:** February 06, 2009, 08:58 PM »

Quote from: Ehtyar on February 06, 2009, 07:42 PM

Is this thing actually going to be online anytime soon? How long does it take to setup some load balanced Apaches?

**Ehtyar ducks objects thrown by Joshua.

Ehtyar.

A couple of hours for complete setup, and a full day to adequately test. But that's assuming they're using Apache.

Here's examples of how in to do it in Debian or Ubuntu in case you're wondering:

http://www.howtoforge.com/high_availability_loadbalanced_apache_cluster

http://www.howtoforge.com/set-up-a-loadbalanced-ha-apache-cluster-ubuntu8.04

( I'd recommend they go with OpenBSD for the backend, however.)

40hz · « **Reply #17 on:** February 06, 2009, 09:01 PM »

Quote from: f0dder on February 06, 2009, 06:47 PM

Quote from: 40hz on February 06, 2009, 06:08 PM
Just look at who has 'real' nuclear weapons these days. North Korea? They can't even keep their population fed and housed, but somehow they've managed to gather the necessary resources to build a nuclear warhead - or three.
It's a lot easier to keep your population in check if they aren't well-fed... if their everyday is a struggle to survive, they aren't going to have much energy to launch a rebellion.

I dunno. I'm from a place where the population is pretty well-fed, and mostly doesn't face an everyday struggle to survive.

And oddly enough, this population doesn't seem to have much energy to launch a rebellion either.

cranioscopical · « **Reply #18 on:** February 07, 2009, 03:35 AM »

Quote from: Ehtyar on February 06, 2009, 07:42 PM

How long does it take to setup some load balanced Apaches

Depends on the degree of Custermization!

Ehtyar · « **Reply #19 on:** February 07, 2009, 08:23 AM »

Oh ffs I wasn't being serious...

Ehtyar.

Shades · « **Reply #20 on:** February 07, 2009, 01:28 PM »

Silly me, I associated "Apaches" in this context with the battle choppers.

Hey, at least their (heavily modded) cases have a big "fan" on top...
Besides that, they have some nice tricks up their sleeve when someone tries to "hack" the box through physical access...
Since these boxes "fly" by wire they are considered to be much safer than their wireless predecessors...

Ehtyar · « **Reply #21 on:** February 12, 2009, 09:16 AM »

Thank Christ the US military work faster than this IRL, they'd still be attempting to overthrow Saddam otherwise

Ehtyar.

40hz · « **Reply #22 on:** February 12, 2009, 05:41 PM »

Quote from: Ehtyar on February 12, 2009, 09:16 AM

Thank Christ the US military work faster than this IRL, they'd still be attempting to overthrow Saddam otherwise

Ehtyar.

Be it in politics, or be it in technology, Rudy's Rutabaga Rule always holds true:

"Once you eliminate your number one problem, number two gets a promotion"

(With thanks to Gerry Weinberg for articulating Rudy's rule.

)