<nettime> DARPA to fund OpenBSD

["nettime's_avid_reader" <nettime@bbs.thing.net>]

     [via <felix@openflows.org>]

Sunday, April 6
U.S. military helps fund Calgary hacker
By  DAVID AKIN
>From Monday's Globe and Mail

http://www.globetechnology.com/servlet/story/RTGAM.20030406.whack46/GTStory

The U.S. military believes the work of a Calgary hacker may be its best bet 
to protect its computer networks from so-called cyber-terrorist attacks. And 
although Theo de Raadt is happy to have more than $2-million (U.S.) in 
research support from the U.S. military's research and development office, 
the source of that funding has made him more than a little uneasy.

"I actually am fairly uncomfortable about it, even if our firm stipulation 
was that they cannot tell us what to do. We are simply doing what we do 
anyways -- securing software -- and they have no say in the matter," Mr. de 
Raadt said in a recent e-mail exchange. "I try to convince myself that our 
grant means a half of a cruise missile doesn't get built."

The grant comes from the U.S. Defense Advanced Research Projects Agency 
(DARPA), the R&D arm of the U.S. military, whose most widely known invention 
would be the Internet. For this grant, DARPA is interested in testing the 
security of commercial software systems against the security of open source 
software projects.

Mr. de Raadt leads development of an open source project called OpenBSD. It 
is a computer operating system, used most often to power the large server 
computers that run corporate networks or Web sites. OpenBSD, a derivative of 
the Unix operating system, is widely considered by computer experts to be the 
most resistant to unauthorized use.

"We were convinced OpenBSD was the best platform to use as a basis for 
further securing open source," said Jonathan Smith, a professor of computer 
and information science at the University of Pennsylvania.

Because DARPA does not directly fund projects outside the United States, it 
is Mr. Smith's computer science department that received the grant, although 
most of the money -- $2.3-million -- flows through to Mr. de Raadt's project.

Although Microsoft Corp., whose Windows products are the world's dominant 
operating system products, and many other commercial software vendors are 
paying new attention to the security of their products, that renewed interest 
has done little to improve their products so far, Mr. de Raadt said.

"Low code quality keeps haunting our entire industry. That, and sloppy 
programmers who don't understand the frameworks they work within. They're 
like plumbers high on glue," Mr. de Raadt said.

Microsoft, for example, has issued 68 security bulletins or alerts for its 
products in the past year, better than one a week. OpenBSD, which does not 
develop as many products as Microsoft, says only one vulnerability or hole 
has been found in its software in the past seven years. OpenBSD has been 
created largely through the work of volunteers over its seven-year existence.

The DARPA grant enabled Mr. de Raadt to add the equivalent of four full-time 
developers to supplement the work of about 80 volunteers. And although he's 
happy about the extra support for the project, he's nervous that critics may 
get the idea he's working for the U.S. military.

"We're not doing anything for them. They just fund us to do what we do," said 
Mr. de Raadt, a 35-year-old graduate of the University of Calgary's computer 
science program. Mr. de Raadt is no fan of the U.S. military at the moment. 
He calls the war in Iraq an oil grab. "It just sickens me."

He also notes that the software his group develops is made available free of 
charge via Internet download or for a nominal fee on CD. The next major 
upgrade to the software, version 3.3., will be released on May 1. Because 
OpenBSD is often used in computing environments where security is a top 
concern, OpenBSD users are often reluctant to identify themselves. But Mr. de 
Raadt's group said that in addition to running the servers for several 
branches of the U.S. military, including the Pentagon, OpenBSD is also 
installed on the servers the U.S. Department of Justice uses to track and 
catch hackers and so-called cyber-terrorists.

OpenBSD is also used by the University of Alberta, the University of 
Minnesota, Adobe Systems Inc. and FSC Internet Corp. of Toronto. More than 
50,000 copies of OpenBSD have been downloaded from the project's servers in 
the past six months.

Corrections Canada, Health Canada, Parliament and the Canada Customs and 
Revenue Agency are among the federal users that have downloaded the software, 
although it's not clear if it is being used by them.

OpenBSD is one of several open source operating systems, the most famous of 
which is Linux. The source code for the software is open or uncompiled, which 
means any software programmer can examine the code and can make changes 
before it is formatted to run on a computer. OpenBSD is a variant of a kind 
of Unix-based operating system known as BSDs, short for Berkeley Software 
Distribution.

The software traces its roots to projects that began in the 1970s at the 
University of California at Berkeley. Mr. de Raadt, who's been working 
full-time on the OpenBSD project for seven years, pays his own bills with the 
money from the sale of the CDs -- he sells about 8,000 a year -- as well as 
from selling OpenBSD T-shirts and other paraphernalia. 

#  distributed via <nettime>: no commercial use without permission
#  <nettime> is a moderated mailing list for net criticism,
#  collaborative text filtering and cultural politics of the nets
#  more info: majordomo@bbs.thing.net and "info nettime-l" in the msg body
#  archive: http://www.nettime.org contact: nettime@bbs.thing.net