Water and Stone

It’s amazing how fast kids grow up these days, isn’t it? They seem to go from whining mewling infants, to toddlers, to precocious teens in such a short time. Before you know it, they are out on their own and making their way in the world. Seems like the Open Source movement is going through a similar growth spurt right now.

With age and maturity comes responsibility. Open Source is shedding its wild years for a more respectable, more reliable image. The time has arrived to get down to business. Several recent developments signal this shift away from youthful foolishness.

While there have been a number of small changes which collectively point in this new direction, perhaps the most far reaching was announced last week by the man widely regarded as the father of the Linux movement: Linus Torvalds.

In a statement released early in June Torvalds announced a new policy for development of the Linux kernel. The new policy is called a Developer’s Certificate of Origin (DCO) and is intended to add a paper trail of documentation to the Linux kernel, that is, the fundamental building block of the Linux Operating System.

The DCO will require developers who contribute to the operating system to identify themselves and certify the origin of their contribution. This new requirement is, from what I can see, the sole positive outcome of the entire SCO lawsuit mess. For those of you who have wisely avoid that whole legal quagmire, in brief, the SCO lawsuit was premised on the idea that Linux developers had stolen copyrighted code for the creation of portions of the Linux Operating System. While the lawsuit has been deemed frivolous, even malicious, by some it did hold up to the light the lack of accountability in the Linux development path.

Traditionally, developers were free to contribute code anonymously and without documentation showing the origins of the code. While it is probably accurate to say that most o the hardcore developers involved in the Linux project are dedicated professionals, the fact is, when push came to shove the Linux crew has been unable to prove clearly to everyone’s satisfaction where all the code came from. (This inability to prove things one way or the other is, ironically, also the weakness of the premise of the whole SCO lawsuit.)

The DCO will change things for the better. Developers will have to step forward, attach their names to their contributions and provide adequate documentation of the source of the code. This not only adds protection for intellectual property, but also makes development and documentation more accurate and more professional. By producing a more thoroughly documented, accountable operating system, the DCO policy also helps remove another objection to Linux from corporate IT. Linux, in short, is growing up.

The DCO is not the only sign that things are changing in the Open Source world. Responsibility for security seems to be on the upswing as well. Take as one example the Mambopot project.

Those of you who read this column have probably heard of Mambo -- an Open Source Content Management System. Since I last wrote about Mambo it has continued to grow and prosper picking up additional developers, new components, and recently, several awards.

Security issues have always been an issue at the forefront of Mambo discussions. Like another other complex piece of software, a content management system creates a lot of opportunities for hackers. The Mambo community has always been quick to fix security holes as they appear, but now they have taken steps to move from a reactive to a proactive stance.

The Mambopot Project is a community based “early warning system” for detecting new intrusion techniques and developing responses to them. It works like this: Decoy Mambo sites are deployed around the Internet. (This is based on the “honeypot” method of luring attackers to decoy sites, hence the name.) They are designed to monitor activity and to report intrusion attempts to a main server where the logs are monitored and analyzed. When new intrusion techniques are detected, the community focuses resources on work-arounds, patches, or other preventive techniques.

The system is community initiated, community monitored, and uses donated server space, in other words, community resources. While the project is new and the effectiveness has yet to be judged, I love the idea. The community stands up and takes responsibility for the security of a community-produced software package. Hmmmmm….maybe there’s a lesson to be learned in here somewhere.