Mandrake Secures French Ministry of Defense Deal

Sfing_ter writes "According to this press release, Mandrake Linux has won a contract to provide a secure linux solution for the French Ministry of Defense. Would this make the FMOD more secure than the USDOD?"

Please Move Along

[captnitro]

To answer the posts that will inevitably ensue: yes, they do [defense.gouv.fr], and we knew you were gonna make the joke way before you thought it was funny.

Insecure Linux

[thefatz]

Heh, French use mandrake linux. Teh oh so quicker to surrender....Horay! Gotta love Linux and the word Secure, kinda like Microsoft and Secure...its all a joke.

What makes Mandrake (that last distro I would use) able to be considered "Secure" and "Military Hardened"....

Interesting. Maybe they should consider OpenBSD instead.

Re:Insecure Linux

[AhBeeDoi]

Raise the dead!

Re:Insecure Linux

[dn15]

Mandrake may not be the perfect distro/OS but at the very least it has security by obscurity as most exploits are aimed at Windows. Obviously that's not the best kind of security but it's better than the alternative!

Re:Insecure Linux

[spuzzzzzzz]

Mandrake may not be the perfect distro/OS but at the very least it has security by obscurity

You don't seem to know what "security by obscurity" actually means. This page would be a useful read: http://omniknow.com/scripts/wiki.php?term=Security _by_obscurity [omniknow.com]

Security by obscurity relates a lot more closely to closed source software like windows than it does to Mandrake.

Re:Insecure Linux

[dn15]

You're right, I misused the term. But the point is that it'd be safer even if it were no more secure inherently. Worms and virus-makers are not targeting it, as it is not a common mainstream desktop system. Not the best type of security but it helps.

Re:Insecure Linux

[Too Much Noise]

I know you were just rethorical about it, but RTFA and at least you might be able to sound interesting.

Here's a bunch of clues, anyway:

1. No sane Dept. of Defense would rely on foreign software - so the contractors are French.
   
2. Mandrake is not the sole contractor.
   
3. The contract is for 3 years and aims at a CC-EAL5 certification; not exactly a typical Mandrake setup.
   
4. Linux and Security can mix - although not everyone uses that mix. Witness SELinux and it's offsprings.
   

Anyway, if they manage a EAL5 certification for this, they'll be able to laugh their asses out at Defense Dept.s that use (or even more, mandate the use) of Windows on their computers. Seeing that w2k only made it (dubiously) to EAL4.

EAL4 Methodically Designed, Tested and Reviewed. Analysis is supported by the low-level design of the modules of the TOE, and a subset of the implementation. Testing is supported by an independent search for obvious vulnerabilities. Development controls are supported by a life-cycle model, identification of tools, and automated configuration management.

EAL5 Semiformally Designed and Tested. Analysis includes all of the implementation. Assurance is supplemented by a formal model and a semiformal presentation of the functional specification and high level design, and a semiformal demonstration of correspondence. The search for vulnerabilities must ensure relative resistance to penetration attack. Covert channel analysis and modular design are also required.

(See here [cesg.gov.uk])

Vee avv leenoox Man'Drak.

[chris_mahan]

Weee Moon-seer!
Vee avv leenoox Man'Drak.
Fir houR lit skeels

(by the way I am french so beware, our Ministry of Defence is full of haxors (not much else, granted... but, c'est la vie!))

As far as I am concerned (living in Los Angeles) this is great news. Less money for the Evil Redmond Empire (ERE).

OpenBSD or Linux

[Goyuix]

Well, in an effort to feed several of the trolls in this topic, think about this:

Linux is having a very painful time being "desktop ready". BSD, particularly OpenBSD is a farther stretch to land on the desktops of the ministry of defense.

Seriously, if they want it for servers, firewalls, etc. Great. But Mandrake is a French company as well as linux is better suited to the desktop. Besides, Mandrake would interface flawlessly with a BSD box using NFS or your protocol/app of choice.

More secure?

[MrResistor]

I don't think the point is necessarily for the FMOD to be more secure than the USDOD, but rather to be more secure from the USDOD.

That is, after all, one of the primary reasons so many foreign government entities are getting interested in FOSS. Microsoft's response, Shared Source, is weak, since while they get to look at the source, they have no way to guarantee that it's the actual source for what they're installing (assuming that they even get to see all of the source. IIRC, they don't)

That Much?

[DAldredge]

It takes that much money to develope a system to hid illegal arm sales and surrender at the first sign of trouble? ;->