How open source found me

No readers like this yet.
My open source story

Opensource.com. CC BY-SA 4.0.

This isn't a story about me finding open source—this is about how open source chose me.

What I knew about open source back then was Linux and everything GNU. Many of the tools in security were released as free, but not as open source software. Not anything, actually. They were tools people needed, and so they posted them on their website with the source code for others to use too—both as a contribution and as a way to show off something cool they built. It was a type of flag you waved for geek cred.

For me, open source started as a legal hoop I had to jump through. I had just left a job and the country. Before I could start the next chapter, I began to work on a methodology. Since it was another country, I had to get working papers and deal with red tape. Waiting in long lines left me a lot of time to think. At that time, I wanted to develop an optimal security testing methodology that was as thorough as it was correct. I wanted to make it based on scientific fact and not some best practices someone made up. Then I wanted to use it to bring efficiency, accuracy, and quality to penetration testing, and I spent all my time thinking about it.

On a train ride back from yet another consulate visit, it all came together. I figured it out. I mapped it out. It made sense. It worked.

I posted it online for comment. And people did. The methodology improved. And that's when I noticed something about science had shifted. Something big.

Maybe Isaac Newton saw farther because he stood on the shoulders of giants. But with open source solutions, we no longer needed giants. Open source software means we can see just as far with regular people, like me. We don't always need great academics and scientists to do great things. We just need many sincere people who want great things and are willing to help make it happen.

You see, it turns out that in science fact doesn't come from the grand leaps of discovery, but rather from the small, careful steps of verification. That made it ideal for open source because we didn't need a giant to make a great leap, we just needed many people to help verify our methodology one small step at a time.

Figuring this out early made my venture into open source software a really satisfying one. This meant that open source wasn't a means for having a community help write a methodology. It was about writing a methodology and building a community to help me make it the one that we all needed to use.

So open source chose me. It was the right fit for science and discovery, and so it just happened. I can't take credit for any of that. But it's not the reason why I decided to work in open source.

Now when you work in information security, it's hard to be out of work for very long. You have to actively try to remain unemployed. Therefore the moment I had my working papers, I began working. The big corporation that hired me even assisted in making my papers come through faster so I could start sooner.

After a few weeks of work, a project came up to test security. We had to create a method for the team to do the tests. "Perfect," I thought, "I have just the thing." There was one problem though, the company didn't know if we could use a random methodology off the Internet. I told them I wrote it. They said they needed to talk to the lawyers as it might be that if I bring it into work I am giving them ownership. And that was something I never once considered.

You see, collaboration is a part of life. Licensing isn't, and I was skeptical about making it open source. As I said, at the time there was little known about using it for a document. There was a version of the GPL for documentation but again that was more for technical writings that supported software. It didn't fit a methodology. There was an open source cookbook released as GPL but it just collected different people's recipes from a community not build a tool.

I needed something that let companies like mine use it, but not change it or in any way diminish the quality of the work. As a method it needed to standardize how security was tested, which couldn't happen with hundreds of versions floating around.

So I figured I just needed to call it open source and then it was, like magic. I don't know why I thought that, and please excuse me for being young and dumb, but I'm sure you've all got your own share of stupid moves too from your youth. So I named it the Open Source Security Testing Methodology Manual, the OSSTMM. It's a damn ugly name for a beautiful piece of science, and I regret naming it that every day instead of something more marketable. But I only did it to make it open and free as quickly as possible so I, and everyone else, could use it at work.

Except, as the lawyers pointed out, there was no license. Not even a copyright.

In the meantime, the OSSTMM had grown a small community of people from around the world. After talking to them about it, somebody suggested I copyright it and leave the copyright with a nonprofit organization to promote it. So we did that with ISECOM.

Later we learned that a methodology couldn't be copyrighted as it was legally considered a trade secret. All I was doing was copyrighting the written words, but not protecting the method. What we needed was an open trade secret, which didn't exist. So I talked to lawyers.

I spent a weekend creating the Open Methodology License (OML), which originally borrowed heavily from the GPL with the only purpose of labeling something as a Trade Secret with the owner being everyone. An open trade secret. Go figure. That let us keep the methodology open and free while restricting forks and rewrites of the document as a standard that industries could uphold for regulatory requirements.

In the end, my company's lawyers accepted the OML and my team could use and further improve it by verifying each little step.

And that's my happy, triumphant, open source story.

My Open Source Story


This article is part of a series called My Open Source Story. To participate and share your open source story, contact us at: open@opensource.com.

User profile image.
I am an avid Maker, Hacker, and Researcher. I teach my kids to hack, pick locks, look things up, and question authority. I'm also the co-founder of ISECOM (www.isecom.org) and as Managing Director am directly involved in all ISECOM projects.

11 Comments

Wow. Great story. I'm following on Facebook now and getting your book to read too.

Thanks Don! I was really worried about writing this. I'm in the business of keeping secrets so opening up with secret histories is hard for me. Let's see how the backlash goes and maybe I'll write more histories that show how we got to the state of things today. Again, thanks!

In reply to by Don Watkins

I think lots of us are interested in opening up things that have secrecy built into them. Some secrets are necessary, I know. But generally – particularly in the business world – secrecy is just preconditioned. Seems a bit sad that we aren't allowed to tell our own personal stories or share intellectual "property" that we thought up b/c the standard is that organizations "own" our ideas. Let us know how you navigate any backlash!

In reply to by pete (not verified)

It's a shame that this whole process, involving lawyers, and based on an economic fallacy, is even necessary. See here:
https://mises.org/sites/default/files/Against%20Intellectual%20Property_2.pdf

Hi, yes, it is a shame. I can only hope that new directions in open source chip away at these fallacies little by little. But I have little hope for the world, I mean look how many people still hold onto the no swimming for 30 min after eating fallacy. :(

In reply to by Herbert Siesel (not verified)

Nice job but I notice there's a large movement in the open source community to work with Microsoft software and is using Microsoft Open Source tools. Doesn't this change everything?

I don't understand why it would. If MS dos opensource then that's good for all. It doesn't change how a methodology needs to freed or how one does security testing or analysis.

In reply to by Robert Miller (not verified)

I love the sentiment of seeing collaboration is a part of life. Nice article!

There's no denying it! Everything from playing as kids to choosing a partner to build your life with, it's all collaboration. Many companies deny it but they wouldn't exist if they didn't have the collaboration of all those workers!

In reply to by mbuckner

Creative Commons LicenseThis work is licensed under a Creative Commons Attribution-Share Alike 4.0 International License.