3 ms·

#1: Keeping certain configuration details a secret (e.g. passwords, which ports are open, versions of software, etc). Good idea. Best practices even. #2: Hid

#1: Keeping certain configuration details a secret (e.g. passwords, which ports are open, versions of software, etc). Good idea. Best practices even. #2: Hide the code/software that performs security-enforcing functions. Um... What? No. This is stupid. This is exactly the kind of thing you want out in the open so people can find flaws and let you know about them before "the bad guys" get ahead of you. It's Wizard of Oz security: Pay no attention to the software behind the curtain. #3: Who cares? Why do they feel the need to justify delaying the release of code? Of course you'll want time to prepare it "for public consumption." As long as it gets opened up in a timely matter.

sarciszewski 12y ago
Agreed, totally.
dalke 12y ago
#3 appears to be a catch-all for "we haven't decided our policy is yet, and publishing the source code early, while we're still considering the options, forces us to make a premature public statement." For example, suppose the government was going to establish a new video codec for its own video releases (ie, suppose that Dirac doesn't exist). There are several options: create a new and unencumbered license, negotiate a license for an existing system, or purchase the patent right from the patent holder. The final choice depends on the cost to develop a new codec, the success of that codec, and the cost of buying or licensing the patent(s). The government can explore all of these at the same time, eg, set up a group to develop a new codec while negotiating with various rights-holders. The new codec might be finished while the negotiating is ongoing. The government knows how well it fits their goals, but the rights-holders do not. This gives a negotiation advantage to the government. On the other hand, if the completed codec were immediately published, that advantage disappears. The rights-holders might decide to raise their prices after seeing just how bad the new codec is, which makes the government goal of more open access to their video archives more expensive. Thus, the government could rightly "judge the public interest not to be served by publishing [their] own software", even if, after the negotiations have completed, the software will be published.
infogulch 12y ago
> Wizard of Oz security: Pay no attention to the software behind the curtain Definitely going to use this.

sarciszewski 12y ago

Agreed, totally.

dalke 12y ago

#3 appears to be a catch-all for "we haven't decided our policy is yet, and publishing the source code early, while we're still considering the options, forces us to make a premature public statement." For example, suppose the government was going to establish a new video codec for its own video releases (ie, suppose that Dirac doesn't exist). There are several options: create a new and unencumbered license, negotiate a license for an existing system, or purchase the patent right from the patent holder. The final choice depends on the cost to develop a new codec, the success of that codec, and the cost of buying or licensing the patent(s). The government can explore all of these at the same time, eg, set up a group to develop a new codec while negotiating with various rights-holders. The new codec might be finished while the negotiating is ongoing. The government knows how well it fits their goals, but the rights-holders do not. This gives a negotiation advantage to the government. On the other hand, if the completed codec were immediately published, that advantage disappears. The rights-holders might decide to raise their prices after seeing just how bad the new codec is, which makes the government goal of more open access to their video archives more expensive. Thus, the government could rightly "judge the public interest not to be served by publishing [their] own software", even if, after the negotiations have completed, the software will be published.

infogulch 12y ago

> Wizard of Oz security: Pay no attention to the software behind the curtain Definitely going to use this.