Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
Security

Put Your Code in the SWAMP: DHS Sponsors Online Open Source Code Testing 67

cold fjord (826450) writes with an excerpt from ZDNet At OSCon, The Department of Homeland Security (DHS) ... quietly announced that they're now offering a service for checking out your open-source code for security holes and bugs: the Software Assurance Marketplace (SWAMP). ... Patrick Beyer, SWAMP's Project Manager at Morgridge Institute for Research, the project's prime contractor, explained, "With open source's popularity, more and more government branches are using open-source code. Some are grabbing code from here, there, and everywhere." Understandably, "there's more and more concern about the safety and quality of this code. We're the one place you can go to check into the code" ... funded by a $23.4 million grant from the Department of Homeland Security Science & Technology Directorate (DHS S&T), SWAMP is designed by researchers from the Morgridge Institute, the University of Illinois-Champaign/Urbana, Indiana University, and the University of Wisconsin-Madison. Each brings broad experience in software assurance, security, open source software development, national distributed facilities and identity management to the project. ... SWAMP opened its services to the community in February of 2014 offering five open-source static analysis tools that analyze source code for possible security defects without having to execute the program. ... In addition, SWAMP hosts almost 400 open source software packages to enable tool developers to add enhancements in both the precision and scope of their tools. On top of that the SWAMP provides developers with software packages from the National Institute for Standards and Technology's (NIST) Juliet Test Suite. I got a chance to talk with Beyer at OSCON, and he emphasized that anyone's code is eligible — and that there's no cost to participants, while the center is covered by a grant.

Comment No, it isn't and they don't (Score 1) 161

The Internet is not powered by experiments on humans. Not even in the DARPA days.

No, websites do NOT experiment on users. Users may experiment on websites, if there's customization, but the rules for good design have not changed either in the past 30 years or the past 3,000. And, to judge from how humans organized carvings and paintings, not the past 30,000 either.

To say that websites experiment on people is tripe. Mouldy tripe. Websites may offer experimental views, surveys on what works, log analysis, etc, but these are statistical experiments on depersonalized aggregate data. Not people.

Experiments on people, especially without consent, is vulgar and wrong. It also doesn't help the website, because knowing what happens doesn't tell you why. Early experiments in AI are littered with extraordinarily bad results for this reason. Assuming you know why, assuming you can casually sketch in the cause merely by knowing one specific effect, is insanity.

Look, I will spell it out to these guys. Stop playing Sherlock Holmes, you only end up looking like Lestrade. Sir Conan Doyle's fictional hero used recursive subdivision, a technique Real Geeks use all the time for everything from decision trees to searching lists. Isolating single factors isn't subdivision because there isn't a single ordered space to subdivide. Scientists mask, yes, but only when dealing with single ordered spaces, and only AFTER producing a hypothesis. And if it involves research on humans, also after filling out a bloody great load of paperwork.

I flat-out refuse to use any website tainted with such puerile nonsense, insofar as I know it to have occurred. No matter how valuable that site may have been, it cannot remain valuable if it is driven by pseudoscience. There's also the matter of respect. If you don't respect me, why should I store any data with you? I can probably do better than most sites out there over a coffee break, so what's in it for me? What's so valuable that I should tolerate being second-class? It had better be damn good.

I'll take a temporary hit on what I can do, if it safeguards my absolute, unconditional control over my virtual persona. And temporary is all it would ever be. There's very little that's truly exclusive and even less that's exclusive and interesting.

The same is true of all users. We don't need any specific website, websites need us. We dictate our own limits, we dictate what safeguards are minimal, we dictate how far a site owner can go. Websites serve their users. They exist only to serve. And unlike with a certain elite class in the Dune series, that's actually true and enforceable.

Comment Re:Bullshit.... (Score 1) 133

When you "calibrate" swap for specific uses, it becomes non-general.

Metric, not swap. I'm talking about compressing memory pages before swapping out, possibly to another memory region, and calibrating the metric to balance between CPU cycles used vs. disk traffick saved, possibly dynamically.

In that situation it is far better to let the application use on-disk storage, because _it_ knows the data profile.

And the OS knows the general state of the system. Also, virtual memory systems are far from trivial to create, and can't really be done via libraries or such since every memory access could potentially require swapping data in first so your algorithms get littered with calls to swap_in and swap_out. On the other hand, the OS can use hardware features to do this transparently.

Sorry, but fail to understand swap.

Yes, you do. And English too.

Comment Re:Who cares? (Score 1) 234

There is no right to a game designed the way you would want to design it. Your right is to vote with your wallets. If the second companies instituted DRM everyone stopped buying their products, then companies would not see DRM as a valid business model.

The question is, do you have an obligation to follow a corrupt law enacted solely to protect corporate interests?

Copyright law, along with the Prohibition and the War on Drugs, are interesting case studies about the limits of law.

Comment Re:So what? (Score 3, Insightful) 234

You know, after the Sony rootkit issue, I do kind of expect vendors to be up front about this.

Because, "hey, here's our software, oh, it might wreck your computer" is kind of a big deal.

These companies feel entitled to install all sorts of crap on your machine. But, this being EA, it's already crap.

They really should be required to tell you the extra crap they're installing, because it has the potential to really fsck up your computer.

Comment Re:Smokers (Score 1) 155

Why are you even debating the point over smoking, when you (and I) have no idea what the other 'few groups' are? Maybe next on his list is all the Red-headed people because they all didn't even die when Batman knocked them all into that vat of chemicals. Until I hear who the other few groups are, I'm going to assume that mindless hatered and lack of understanding of basic medicine are not even among this niblick's top 10 biggest issues. Hell, the other "few groups" probably include Underweight Belgians, Manx Cat Fanciers and Left Handed Whittlers.

Comment Re:Nope (Score 1) 172

true, i took the ** to note hyperbole but perhaps i shouldnt have made that leap

Seem more like emphasis to me. And besides, there is a qualitative rather than just quantitative difference between "many things", "most things" and "all things", so hyperbole is just a fancy term for lying in this case.

Comment Re:A/B Testing (Score 1) 161

A/B testing, as a concept, is fine. The issue here is that A was "truth" and B was "deception", and that's something you shouldn't be A/B testing (at least not without getting ethics waivers signed). Facebook provided feeds that were not representative of what was actually going on and OKCupid flipped bad matches to good matches, both of which compromised their relevant services by misleading users or misrepresenting information. You can't do stuff like that in most (all?) ethical systems, and it may even open them up to legal trouble, since they're knowingly providing something other than the promised service.

At the very least, their doing so runs contrary to the categorical imperative, so for any deontological ethicists out there, it should seem pretty apparent that they were out of line. And if you subscribe to more consequentialist ethical thinking, such as utilitarianism (either the Act or Rule variety), it's trivial to point out that the users were going to obviously be worse off in several of these cases and that happiness was not maximized, nor would it be if everyone was misleading their users like this.

Again, A/B testing is a great tool, but it needs to be used ethically.

Comment Re:Advantages? (Score 1) 146

The fact that someone bothered to make uPnP suggests that there's a need for this capability for average users.

There's also a "need" for antigravity and wish-granting genies. They're just needs that may remain unfulfilled due to impossibility.

I assume since you bring up uPnP without citing it as a viable solution, you're aware that it's disasterous for security. I think at least some of that is due to inherent problems in the concept, not just a poor implementation.

Granted, we seem to have gone down that path already (perhaps driven in no small part by the prevalence of NAT), and these services may have a place, but do we want it to be *all* there is to the internet?

I agree that we want people to not be reliant on centralized servers... however, the way to accomplish that would be to upgrade the "average" technical expertise of users to the point where they'd be competent to configure a firewall. That may be practically impossible, but I think developing a technical solution capable of saving them from themselves would be even harder.

I accidentally left my Windows box connected to the internet without an external firewall for a few months with no ill effects.

...that you know of!

Slashdot Top Deals

Function reject.

Working...