KEN SAYS:
1) Our paper has almost a three-page section on the government and GPL, which discussed security issues, such as classified source code and the risk of breaches in peer review groups. You didn't respond to any of them. Not that you are obliged to, but if you are responding to the paper you should read the paper.

RICK SAYS: I didn't need to do a paragraph-by-paragraph comparison of your document, others on the Net already did that. And, yes, I did read the entire document (both versions).

KEN SAYS:
2) Our paper was not clever marketing, but reality. The government budgets billions of dollars annually just for IT security. We are discussing the risks of moving from a proprietary to os. We have had significant government response to the paper. You should respond to the arguments...I think you are well qualified to discuss security risk.

RICK SAYS:
The reality is that the average government IT buyer is a lemming that goes with whoever has the most marketing bucks or makes the most cost-effective pitch. This is backed by clueless managers that can't see anything beyond where they currently are (eg, Windows-based.) The 'risks' of moving to OSS you described are much more economic than 'security' related. Again, I don't need to respond to your statement, it's been done elsewhere in the community.

KEN SAYS:
3) A sharp guy like you knows that the government has thousands of vendors that sell it proprietary software. The MSFT bogeyman stuff is beneath you. Make your arguments, I would like to respond."

RICK SAYS:
No, the MSFT claims are at the heart of the matter. Thanks to their shoddy programming standards, we're plagued with any number of bugs, exploits, trojans, etc. resulting from easily-exploited 'features' of their products.

The goal of my column was not to say OSS is always better than proprietary - some proprietary stuff is damn good - but rather challenges the legitimacy of your report that was completely biased, poorly-written (IMO), and was released in what many believe was an underhanded, sleazy manner - that latter point alone raises questions about its legitimay.

Why not come clean to the Net community and say whether or not Microsoft funded this report? End the speculation about whether this was marketing fluff or not. Or are you under a NDA that prohibits such a claim if indeed true?

(Respectfully, you have to agree that your report, coming from a 'think tank' that has no staff biographies, corporate info, etc. does appear to be a bit suspect. For all we know, you are not a techie and should not be dispensing techical advice or conducting assessments of technical products!)

That being said, I do commend you - and thank you - for publicly responding to my comments, and those of others in the community.

rick



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/89/13127#13127