Suramya's Blog : Welcome to my crazy life…

Software should not be classified when used in government agencies except in some very rare exceptional cases. For example, software used to launch nuclear missiles and ensure they hit their targets might be an exception however, these should be an exception rather than the rule in my opinion. The reason I say that is because when a software is classified it means that a limited no of people are using it and that means only a limited no of developers are working on it as any given time. Plus, when something is classified it can not be security tested by external entities without having to sign multiple Non-Disclosure Agreements (NDA’s) and other similar hoops whereas regular software is used and tested by lots of people like corporate’s who test the solution before they implement it in their environment. This gives us multiple groups of people testing the software in various ways making it easier to identify security issues making it more secure.

Secondly, making classified versions of existing software doesn’t seem like a good use of resources to me. Why spend extra money creating a classified ‘Word’ when the commercial version (with some modification) would work perfectly well?

Coming to open source, I don’t think government should be prohibited from using Open Source. There are two ways government’s can be blocked from using opensource software. Firstly, the software license might prohibit government use. If this is the case, then the license no longer meets the requirement to be called open source since the Open Source Definition specifies that Open Source licenses may not discriminate against persons or groups. In-fact there was an attempt back in 2006 by GPU which is a Gnutella client to create a license that disallowed the use of their software by the military. It didn’t go anywhere because of strong opposition by the Open Source Initiative (OSI) to calling the license open source. Second, The government might not allow its use due to internal policy: This is primarily because they are worried about one or all of the following: Security, Cost, or licensing.

There is a misconception that opensource software is less secure than commercial software and even though majority of the servers worldwide run on opensource software (Linux, Apache etc) the detractors still persist. In every large company I have worked with so far, whenever I try promoting opensource software this point invariably comes up and I have to spend time explaining why this is not the case.

Another reason why companies might not allow OSS is because of the license the software might be under. If the software is licensed under the GPL they need to be extra careful when using it within their setup because the GPL is what is known as a viral license. It requires the source code of the entire “derived work” – i.e. the combination of GPL code and proprietary code – to be made available under the terms of the GPL publicly. Due to this most companies do not allow software licensed under the GPL to be used inside them. (Libraries licensed under GPL are fine because they don’t trigger the ‘viral’ clause). However, there are other licenses that do not have this clause and can be safely used.

Ultimately, I feel it is better if they use opensource software rather than pay ridiculous amounts of money as software licensing fees.

I don’t agree with statement, though there are many proponents to abolishing privacy online. Unfortunately, over the years we have been trained to give personal information in order to use services online and this is based on the principle that our data has no value and if we have nothing to hide we should be ok to share data online. This is a fallacy.

Having privacy is essential to us as humans because it gives us a judgment free space where we can be ourselves without worrying about what others might think. This allows us to explore unpopular ideas without worry or fear. Plus it is not just people who have unpopular ideas that need privacy. There is a lot of stuff that I wouldn’t want to share with everyone even if it’s nothing illegal or unpopular such as details about my health or personal finances. Privacy doesn’t mean that we don’t want to share information, it just means that I get to choose who has access to data about me.

In certain scenarios privacy helps protect us physically from stalkers or people who mean us harm, think fanatic fans or people fleeing an abusive relationship. Such people would not want their physical location broadcast to the world. There was a case a few months ago where a fan used a photo published by a star to locate her apartment and assaulted her at her apartment. This was a breach of privacy of the star and caused major distress to her. Now imagine if we could immediately find where anyone in the world is located at a given time, this will allow us to determine so much other data about that person such as their health information (if they are visiting a cardiac doctor every week, there is a high probability they are suffering from a hear problem). A few years ago Uber analyzed data from the rides people were taking using it’s service and used that to figure out who was having an affair with whom based on the rides they took and the location they were dropped. It was quite a scandal when it came out and now imagine someone taking this information and blackmailing people.

With the amount of information that we are giving to websites and companies both voluntarily and involuntarily privacy is becoming harder to maintain but that doesn’t mean that we give up and let companies do whatever they want with our data. If we do that then be prepared to have every aspect of your life dissected and analyzed for profit.

Too many people state that they have nothing to hide and have no problems with having their information public. I challenge them to stay in a house completely made of glass (including the bathrooms) and have a bot that publishes all emails/messages/transcripts from their calls publicly. I can bet there won’t be any takers. as everyone has something they wouldn’t want to be public knowledge.

– Suramya