Re: Sourcefire Acquired by Check Point Software

[Renaud Deraison <deraison () nessus org>]

On Oct 8, 2005, at 17:04, Frank Knobbe wrote:
> >  A number of companies are _using_ the source code against us, by
> >  selling or renting appliances, thus exploiting a loophole in the  
> > GPL.
>
> I wonder what "loophole" he's talking. The license seems pretty clear.
> Anyway...

There are several loopholes on many levels :

(a) You can take any GPL software, put it as-is on an appliance, call  
your appliance the "FOOBAR 3000" and sell FOOBAR 3000 Scanners all  
over the place. You therefore hide any credit to the original program  
you took and nobody knows that your FOOBAR 3000 is using (Nessus| 
Snort|.*)

(b) You take any GPL software, make substantial changes to it, and  
"rent" the appliance to your customers. You're not obligated to give  
the source code to your customer.

(c) You take any GPL software which produces content, and wrap a web- 
based management GUI which does not  link to it per se, but uses the  
results. Now the GPL is very fuzzy about the output of the program.  
It actually says the following :

<< The act of running the Program is not restricted, and the output  
from the Program is covered only if its contents constitute a work  
based on the Program (independent of having been made by running the  
Program). Whether that is true depends on what the Program does. >>

So it's up to the owner of the copyright to decide what kind of  
licensing the output is. For instance, in the case of Nmap Fyodor  
decided that you're not allowed to process the results from a scan  
launched by your proprietary web GUI (cf nmap-3.XX/COPYING) -- in  
that way he cleared the ambiguity. We find that kind of restriction  
to be very extreme (especially if you're talking about "free"  
software) and decided to not go with it, but at the same time there  
should be some middle ground between considering the output as public  
domain or restricting its use drastically.

[...]
> The reason is that Snort is free, and will remain free. SF makes money
> on products they built on it, like their RNA stuff.

Great example. RNA is a sniffer. Snort is a sniffer. RNA tunes Snort  
so that its alerts are better qualified.

Don't you honnestly think that there's a lot of redundant technology  
here ? From an architectural point of view, don't you think it would  
have been cleaner, more effective and more robust to patch snort so  
that it performs both passive VA analysis and intrusion detection ?  
It would probably have been more real-time, but also quicker and more  
powerful to have the same process perform these two tasks (even if  
you stick one process per CPU -- have some shared memory so that the  
RNA part can tune the IDS part). If Snort and RNA had been merged in  
one single product, Snort would be a much better IDS.

Don't you think the fact that Snort was there for anyone to pick up  
and put on an appliance drove the decision to choose what is, in the  
end, a more complex solution ?



                                -- Renaud