Microsoft Releases Source Code For Web Sandbox 188
nandemoari writes "After flirting with open source development for some time, Microsoft has made another step towards real commitment with the release of source code for Web Sandbox, a program used to test and secure web site content.
The Sandbox source code will be released under the Apache 2.0 license, an open source license agreement allowing the content creator to maintain copyright while permitting others to develop the product for their own use. Microsoft has gradually been increasing their involvement with the Apache Software Foundation (ASF) since 2008 when they agreed to fund development of certain ASF initiatives."
Excellent. (Score:5, Funny)
The deep end (Score:5, Funny)
An interesting section of code:
if (sandbox.isDeepEnd()) {
Message message = sandbox.getLeprechaun().getMessage();
if (MessageInterpreter::isBurnCommand(message)) {
environment.burnItAll();
}
}
self.citeRalphism();
Rule of Acquisition #76 (Score:5, Insightful)
Re: (Score:2, Funny)
You know, cats love sandboxes too. How do you like them cookies?
Don't Forget Rule of Acquisition #48 (Score:5, Insightful)
The bigger the smile, the sharper the knife.
Re: (Score:2)
Every once in a while, declare peace. It confuses the hell out of your enemies.
The obvious answer to me is that Microsoft has determined that they can not squeeze any money out of this code.
Re: (Score:2)
"If you're up against someone more intelligent than you are, do something insane and let him think himself to death." --- Pyanfar Chanur
Re: (Score:2)
Actually I don't. If I had to take a wild stab, I'd say Caesar, but I don't know. Please enlighten me!
Profit!!! (Score:5, Insightful)
Microsoft has gradually been increasing their involvement with the Apache Software Foundation (ASF) since 2008 when they agreed to fund development of certain ASF initiatives.
The whole "Embrace, Extend and Extinguish" thing is sure taking a lot longer these days...
Re: (Score:2)
The whole "Embrace, Extend and Extinguish" thing is sure taking a lot longer these days...
Shh.... We don't want them finding out that the "extend" bit only works when you can keep all your code secret.
Apache? (Score:5, Insightful)
Re:Apache? (Score:5, Insightful)
Plus, let's flip this on its head: do you REALLY want to have to publish your changes so that Microsoft can take advantage of your hard work?
Re:Apache? (Score:5, Insightful)
I want to publish my changes so that EVERYONE can take advantage of my hard work.
Re: (Score:2, Informative)
Re:Apache? (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
You can go public domain, but:
Say you give someone your hard work, and they forward it to someone else, those people might not be able to take advantage of your hard work. It might be sold to them, limited in usage, etc.
So limiting the rights to change the rights of your hard work might be what you want to ensure freedom of the software. GPL (especially v3), Apache, EUPL, even BSD-style licenses try to ensure this.
Btw.: Did anyone use the EUPL yet or has an opinion about it? Sure, it's not in common use yet
Re: (Score:2)
Re: (Score:2)
I dont know off the top of my head if Apache allows re-licensing, though I believe it does. Assuming so ....
The GPL licensed software that you forked has GPL license.
The Apache licensed software that was already there still has the same license it had before.
They're now two different pieces of software.
Re:Apache? (Score:5, Insightful)
The GPL protects the "commons", the other open licenses do not. With another license like the Apache one microsoft or anyone else is free to take the code close it up and sell a product that makes the open version obsolete or at best less featured.
The freedom for end users to have and be able to modify the source is the only one that really means anything.
Re: (Score:2)
The freedom for end users to have and be able to modify the source is the only one that really means anything.
I don't agree that it's the only thing that really matters. But I do agree that its a pretty major point that seems to be lost by the "more free than the GPL" arguments you see from time to time.
Re:Apache? (Score:4, Insightful)
The end-use has just as much access to the original project under Apache (or BSD) as they do under the GPL...but they may not necessarily have access to the changes that a developer makes to the original. I don't see this as a giant hurdle since the only people who would give a flying fuck about source are developers and they are perfectly capable (maybe) of adding whatever changes they want to the original.
</dragged_into_troll_debate>
Re: (Score:2)
Then they have to use an inferior version, which would not be an issue if the end user had the freedom to see and and modify the source.
Non-developers do care too, they hire developers.
All this means that Microsoft or whoever can take from the commons and not give back. Thus the tragedy of the commons occurs. If there is no need to give back(give source to the end user as it was given to them), then the software might as well have started closed source. At least that way the people closing it would have pai
Re: (Score:2)
They call that step Extinguish.
Re: (Score:2)
<dragged_into_troll_debate>
I would note that you helped define the troll debate. At least you didn't play the "viral" card.
I don't see this as a giant hurdle since the only people who would give a flying fuck about source are developers and they are perfectly capable (maybe) of adding whatever changes they want to the original.
I'm an end user the majority of the time. There is very little chance I'll contribute code to even a sliver of the Open Source software that I use. Yet the license is important to me. Everything that makes OSS interesting / worth investing in is further enforced by a license that ensures modifications / improvements are returned to the project.
Re: (Score:2)
"Microsoft or anyone else is free to take the code close it up and sell a product that makes the open version obsolete or at best less featured."
That the "Extinguish" part of MS' EEE strategy.
Re:Apache? (Score:5, Insightful)
the Apache license is MUCH more free than the GPL
I find the debates about which OSS license is "most free" to be rather silly, because:
1. All the "major" OSS licenses (GPL, BSD, Apache, etc.) are awesome, in my opinion. They all do great things and greatly help free software. So debating about which one is "the best" seems counter-productive because it obscures the fact that they are all good.
2. The debates usually have an implicit assumption that "freedom" is a one-dimensional axis, and we are trying to maximize the amount of "freedom." Occasionally someone will insightfully explain how freedom is more complex: one person's freedom may come at the expense of another; you need to distinguish between user freedom, developer freedom, distributor freedom; etc. Overall I prefer to think of "freedom" as being multi-dimensional.* A particular license may maximize along one freedom-axis, while not being maximal along another freedom-axis. And there may not be any license which simultaneously maximizes along every axis. Hence no such thing as the "most free" license. (But there may still be ways to rank things; e.g. most proprietary licenses are less free along every axis.) In other words (and you would think this would be obvious): the "best" license depends very much on the particular situation and one's particular priorities.
(* I believe this multi-dimensionality applies to many "wavy-gravy" human concepts/principles/emotions. Too frequently we argue about things as if they were binary or 1-dimensional, when even a cursory analysis shows them to be more complex than that.)
Stop it! (Score:5, Funny)
Stop it! You're being overly rational in a perfectly emotional debate.
Re: (Score:2)
I am not anti-GPL so much as I am anti this rabid sensationalism that software is made to be free. Software takes time, money, and s
Re:Apache? (Score:5, Insightful)
Yeah, just like America was a much freer place in 1750 because you were free to own slaves or to sell yourself into indentured servitude.
Re: (Score:2, Interesting)
Do you honestly believe that all software companies should just shut their doors, or give their products away by licensing it in such a way that everyone else can also release it(which is the same as shutting their doors)? I suppose you think that all artists (authors, musicians, etc...) should give their
Re: (Score:3, Insightful)
Settle down, tiger, and give that straw man a rest. I was responding to a post that made the absurd claim that a license that allowed covered code to be made less free ("closed" was, I think, the word used) was actually a more "free" license than one which required the code to remain free/open. This was so close to a restatement of Orwell's paradigmatic slogan of linguistic nihilism -- "Freedom is Slavery" -- that I thought it bore comment. The "freedom" to discard your own freedom -- or that of others -- i
Re: (Score:2)
This is the simple-minded response to freedom everywhere. It sounds good, shuts people up who dont have time to sit around and think about it, but is generally quite silly.
Everything starts with an axiom, so lets start with a couple:
1. Every human individual is equally valuable.
2. Freedom applied to self trumps freedom applied to others.
(yes, I know there are deeper axioms, but I only have limited time here, and dont want to have to list all the turtles)
Thats all you need to completely invalidate your ar
Re: (Score:2)
Plus, let's flip this on its head: do you REALLY want to have to publish your changes so that Microsoft can take advantage of your hard work?
Yes. That's how Free Software is supposed to work.
Re: (Score:2)
Unless you are new here to slashdot, the key is the definition of "Free" which seems to vary wildly.
Re: (Score:3, Insightful)
Since you got moderated to "insightful" and I don't have moderation points in this article, I'll have to take the bait:
They're both just as Free Software. Claiming one is "more free" than the other, is a proof that you're confusing issues and still have something to learn about Free Software licensing, because for instance...
No, you can't. You can't claim you're the author, for instance. Actually, it's very hard to
Re: (Score:2)
Re:Apache? (Score:5, Insightful)
Nice propaganda (Score:2)
You forgot the bit about that compatibility being one direction. You can't take GPL code and use it in any codebase under the Apache License without GPL'ing the whole damn thing.
Nice you got modded up though, even when you forgot that very, very important bit. GPL is more then happy to take other code, but it isn't so happy to give back...
Re: (Score:2)
Re: (Score:2)
But that's another issue : too many licenses
Re: (Score:2)
Re: (Score:2)
Maybe an FU to GPL fans but definitely NOT to free software.
Only one direction my anonymous friend (Score:2)
Almost all OSS licenses are "compatible" with GPL, but only in one direction. You can take BSD code, Apache License code and integrate it into GPL code, but you can't take any changes you made in the GPL code back into the BSD/Apache code*.
* Unless you own the copyright to the entire body of work under GPL, in which case you can do whatever you want with it.
Re: (Score:2)
From gnu.org...
"Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it."
How can a GPL programmer take code from Apache license and assert copyright on the software? The Apache license does not confer copyright, merely a copyright license. They are not the same thing.
For example, you take Microsoft's Web Sandbox and put it under GPL. Someone else comes along
Ray Ozzie (Score:4, Interesting)
Given Wired's article on Ray Ozzie, this doesn't surprise me. Ray seems to really believe the future of Microsoft lies firmly in the cloud, and the Microsoft is behind the curve in that arena.
Trusting your business to the cloud, and Microsoft's cloud means you must trust them for security.
Microsoft, internet and security haven't exactly gone together over the years.
Maybe this is an honest effort to improve how IT professionals view Microsoft's commitment to web security.
Re: (Score:2)
I will only trust the cloud when I can step out of an airplane and walk.
Any business that relies on one outside company exclusively is stupid.
Update the Microsoft icon? (Score:5, Insightful)
Maybe a screaming Steve Ballmer in a Darth Vader helmet instead?
Re: (Score:2)
Don't hold your breath.
Take a look at Slashdot's FAQ [slashdot.org]. Most of the entries haven't been updated in 8 years. For some of them it doesn't matter. For others, the answers don't make much sense. (Most written before things like article tagging and the firehose existed.)
In short, Slashdot evolves at a positively glacial speed. (Which has its advantages: it would be worse to try and implement every whizz-bang fad.) This is somewhat ironic for a site where articles are posted dozens of times a day, and comments are
Re: (Score:2)
Get off my lawn!
Re: (Score:2)
Two minutes between comments? I've gotten messages telling me to slow down because it's been four or five minutes between my comments. I guess my typing speed it just too quick. The Slashdot effect is well known for turning servers into piles of goo. If Slashdot were to allow posters to make multiple comments without any delay, would Slashdot's servers turn to goo?
By the way, is this irony? As I try to post this message, I get: "Slashdot requires you to wait between each successful posting of a commen
Re: (Score:2)
Re: (Score:2)
He may also be doing other things, but he's still Chairman of the Board of Directors of Microsoft Corp.
Re:Update the Microsoft icon? (Score:5, Interesting)
He is the most meaningfully philanthropic billionaire. As of a year or two ago he'd given 56% of his total accumulated wealth to charity over his lifetime. That's pretty cool, and the B&M Gates Foundation does a lot of great stuff, like pay for my local NPR and PBS stations. Compare to, oh, the Walmart heirs, who have given less than 0.01% of their wealth to philanthropic causes.
Re: (Score:2)
Why you bring up the bible, I can't being to fathom, but I do know this:
It doesn't say to receive in secret.
Re:Wal-Mart Donations (Score:4, Informative)
Parent is not a troll, and GP did pull the 0.01% figure out of the air. The Walton family, are in fact major-league philanthropists. Who do you think is behind the Walton Arts Center [waltonartscenter.org]? And that's just a drop in the bucket.
The Walton Family Foundation gives away around $250 million per year, much of it to support K-12 education programs, while the Wal-Mart Foundation gives away another $200 million or so.
I'm no fan of Wal-Mart, just as I'm no fan of Mr. Gates. But credit where it's due. At least the Waltons don't seek publicity and adulation for giving away money they could never hope to spend.
Re: (Score:2)
The founders and heirs of Wal-Mart have made donations, just not as vocal about them. The bible teaches to give in secret. Can you verify to me your source for the .01% or did you just pull that out of the air.
I got it from a documentary on Walmart. It was called something like "The High Cost of Low Prices."
Talking of x86 sandboxes (Score:2)
http://en.wikipedia.org/wiki/VX32 [wikipedia.org]
which enables the User Mode Plan 9 - http://swtch.com/9vx/ [swtch.com]
Coming around finally? (Score:3, Insightful)
Re-licensing (Score:5, Interesting)
Can we re-license it (or fork it) under GPL?
It would break my heart if someone improved the software just to see the improvements turn into proprietary ugliness.
Re: (Score:2)
In essence, Microsoft can take their ball and go home whenever they want, but if you take a copy of their ball and make it better, they can't take yours.
Re:Re-licensing (Score:5, Insightful)
Thank you for being another example of why I really, really don't like the GPL or its users.
"How do we lock this up so the original developers can't use this?"
I'd say you ought to be ashamed, but your sense of shame has likely atrophied away a long time ago. (And you lot do the same to BSD developers on occasion, who are at least nominally "your own." Pathetic.)
Re:Re-licensing (Score:5, Insightful)
Why should I be ashamed? Microsoft can use whatever they wrote. The question is why would anyone else help them build their next release of anything for free? Why would anyone with half a brain help a convicted monopolist to screw its users even further for no reward beyond, perhaps, a poorly paying job on a company regarded as "second rate" by any programmer that could contribute to the project?
What re-licensing as GPL does is that it keeps the downstream users "honest" by forcing them to be as nice to their downstream users as their predecessors were for them. It would say "Dear Microsoft, I give you my contributions on the condition that you never subvert my will and turn them into proprietary software I can no longer study or modify". Is that too much to ask?
The license difference between BSD and Linux is probably the most influential factor in the development of the healthy community that surrounds Linux and that does not surround BSD. Why would IBM contribute to BSD if HP could take their contributions and implement them in HP-UX without giving anything in return? IBM gives code to Linux because they know that HP, SGI, Intel, Red Hat, Novell and just about everyone else will do the same. Everybody is kept nice by the force of the license, which is the "law" of the community around it.
So, again, what is the advantage this license gives the community that, for some incomprehensible reason, decides to give their time and dedication to this initiative?
You have a really twisted sense of morality (Score:2)
What if somebody came up with the MEGA-GPL lisence that was one-way compatible with the GPL? This MEGA-GPL license could suck up GPL code, but could not give back to the GPL project without the original project becoming MEGA-GPL. If this sounds far-fetched, the same scenario already exists with GPLv2 vs GPLv3.
So I take your project, MEGA-GPL it and make all kinds of changes to your project. Sadly, you'll never see any of my changes unless you adopt my MEGA-GPL license.
Sound like a plan?
Re: (Score:2)
Re: (Score:2)
OK... "convicted monopoly abuser". I stand corrected.
Re: (Score:2)
And since when re-licensing mandates the removal of previous authorship or copyright notices?
Re: (Score:2, Insightful)
More like "How do we free this up so the original developers can still use this and everyone else too?".
If someone forks a project like th
You didn't free it up for the original developer (Score:2)
Unless he wants to GPL his codebase. You basically forced him to either GPL his code or not accept any of your patches. Keep in mind dual licensing is only practicle when a single person or organization owns the copyright to an entire project. Many people, including myself, take issue with projects that want to own the entire copyright on an open source project. It limits our ability to use our work else ware.
The short of it is you guys are like little high-minded leeches. At least people who take "les
Ashamed of what? (Score:2)
People and companies release their work any way they see fit.
Once it has been released it is a perfectly legitimate question to check if other licensing schemes can be used with derivative work.
You may not like the GPL or its proponents, what it is clear to me is that you understand neither.
Re: (Score:2)
Except that you're exploiting their generosity by using *their* code with *your* additions in a way that ensures that they do not receive the use of them.
In other words, you're leeching from them. You're exploiting them. Which is legally permissible under the Apache license, but it makes it no less cretinous.
Re: (Score:2)
Never before Anonymous Coward was such an appropriate nickname...
What about the facts? (Score:2)
Re: (Score:2)
This is the funniest variation of these meme that I've seen. Great visual. Laughed my ass off.
Re: (Score:3, Insightful)
Historical evidence suggests otherwise.
They would first need to get rid of their bad reputation for people to treat them fairly.
Re: (Score:2)
They would first need to get rid of their bad reputation for people to treat them fairly.
What would that take, then? It doesn't appear that, with some people, they can ever do that, since every good thing they do is dismissed in some form of a conspiracy theory, basically.
It's not like Microsoft, as a business, is trying to hide that it is trying to make money. Most businesses try to do that. So yeah, they probably want to make money somehow with this open source software thing. Maybe supporting it, and thus encouraging people to use Windows, and thus encourages people to buy Windows, is a
Re: (Score:2)
As long as it takes most habitual offenders.
Re:A step in the right direction (Score:4, Insightful)
Why not just run Windows then? You're bitching about wanting free software all over the comments here, and then you're going to claim that you want to run closed-source windows software on your Free OS? What's the point?
If freedom is of paramount concern, why would you care to run software that will interoperate with non-free systems at all? Why not pressure them to accept a better (standard) way of doing things? You know, by using the robust & stable FLOSS software that does the same job as Exchange, Sharepoint, etc., but does so while conforming to GPL & open standards? And then when you've achieved a market leadership position with your superior products, you can simply freeze out Microsoft products if they don't conform to your standards.
Or is all this really about forcing Microsoft to commit some bizarre form of hara-kiri ritual to atone for the grievous sins they've committed against you?
Re: (Score:3, Insightful)
If they're open source, then just port them to run on the free OS. Why do you need to make your free OS look like & behave like a non-free OS? Think about it for a second. The point you're making about allowing WINE to work fully makes NO sense - either you want to run closed source applications on Linux under WINE (which would only be enabled by the WINE project having full specs to make WINE 100% interoperable, as you demand), or you have t
Re: (Score:3, Insightful)
If they want to regain peoples trust let them release all the docs the Wine project would need to be 100% interoperable.
Now this is just you being disingenuous. There is no 'document' that describes how to perfectly implement win32, user32 etc. Windows is filled with 15 years of shims, edge-cases, special-cases, back-compat-hacks, and just plain bad code, like every other commercial software of size and complexity.
Such a thing doesnt exist, other than in the source code itself, plus the build process, plus the compat testing, plus the testing scripts, etc etc.
And you know that, so asking for it is just being silly.
Then release real interoperability docs for exchange, sharepoint, etc.
Yeah, th
Re: (Score:3, Insightful)
And "Past performance is no guarantee of future results." Shit changes, man. At some point, you have to either allow them the chance to regain some level of trust, or you have to admit that you just have a weird personal issue with MSFT that so totally dominates your view of them that you can't behave or think rationally about anything they do.
How does one get rid of a bad re
Re: (Score:2)
Microsoft have lost several court cases due to their illegal behaviour. They have a lot of mistrust to overcome, much like human habitual offenders. The whole OOXML fiasco hardly helps their case for rehabilitation.
Re: (Score:2)
There comes a point where you have to concede that a step is a positive development. A single step doesn't mean they're making a pattern of it, but it's a starting point. Maybe tomorrow they abuse the Apache license and get dragged into 15 different courts because of it. Or maybe tom
Re: (Score:2)
You must be new here...
Re:So what? (Score:5, Insightful)
That's cutting your nose off to spite your face. Free Software is only useful on Linux, then? That seems absurd. There's no reason that free software can't exist within the framework of a proprietary platform. As always, if you don't like it, you don't have to use it. Your attempt to somehow paint this as a bad thing doesn't really hold water.
Re: (Score:2, Interesting)
There's a lot of software that only runs on Linux or BSD and is useless to me on Windows, but I don't think less of it because of that.
More importantly, I'm more interested on what I can do with my applications and less about the OS they happen to be running on. This is called "the right tool for the job", and for me at least, completely trumps philosophical arguments about degrees of freedom.
Re: (Score:2)
You can install those OSes for no cost and with no loss of freedom. You could even put them in a virtual environment on your OS for no cost and no loss of freedom.
This software does not offer that.
Re: (Score:2, Insightful)
I don't care about cost, and I don't care about "freedom". I care about getting the job done, delivering what I was asked to deliver and getting paid for it.
If I write an application with ASP.NET/Server 2008 that cost $500K to build and maintain over five years, which then ends up generating $50 million in revenue, my costs are effectively zero. Besides, the bulk of the cost is usually people, not software licenses. For all practical purposes the cost ends up being the same if I do it in Python, except that
Re: (Score:2)
You will when you can't fix a bug in some closed app you're using that causes your app to perform badly.
Re:So what? (Score:4, Insightful)
Considering I've been happily using "closed" products for more than a decade to make a living, you're a little late on the warning front.
For all practical purposes I would be just as screwed if I found a bug in the .NET CLR as I would if it were in the Python VM, because I'm not in the business of developing or fixing languages or runtime libraries, but corporate applications.
That's why I choose tools that are established and have solid backing behind them. I trust the Apache Foundation as much as I trust Microsoft. I trust Guido van Rossum and his troupe of geniuses. I trust Zend and I trust Debian. Not so much the SuperDuperPHPCMSOfTheWeek Team, so I might use their product to run my personal blog about kittens, but I wouldn't trust my livelihood to them.
Understand that money has nothing to do with this.
Re: (Score:2)
This is well-put. Trust and Openness need not be linked. Although they can influence one another, there are many items we trust with our lives (car brakes) every day that are not necessarily open systems. Software can be closed and yet trusted. The servers we all transact with on the web need not be open, but we certainly trust them, regardless of how we juggle the client OS/browser.
Re: (Score:2)
Would you prefer that I closed the source to my .NET-based OSS project?
Re: (Score:2)
It seems your definition of "open source" is different than mine. You see, last I checked, GPL'ed source code qualifies as "open source". I - and most of the OSS world - would consider the ability to get the source code and modify it to your heart's desire - and distribute those changes - a pretty good indication of the "free-ness" of the software.
Also, I fail to see how writing an open source .NET runtime makes the Mono team Microsoft's lapdogs... or do you call Apache's developers Microsoft's lapdogs no
Re: (Score:2)
Most people avoid Linux because it doesn't run their software, doesn't have drivers for all their devices and is more difficult to use than Windows or OS X. Any rabid frothing at the mouth behaviour is a small factor in comparison.
Re: (Score:3, Interesting)
Ubuntu will run on any relatively mainstream system. Dell's machines, in particular, are quite Ubuntu-friendly. Drivers were an issue three years ago, but not so much now.
As for "run their software", that's why it's valid to make OSS for Windows. Some people are locked into Windows for one reason or another - "We have to use Joe's Address Mangler 3.0 for Windows" - so the solution is to provide OSS programs to fill as many needs as possible.
The sooner we can make OSS "their software", the sooner they'll
Re: (Score:2)
Re: (Score:2)
Not at all. I have even in the past used windows. The reality is why bother opensourcing something that cannot really ever be open?
Re: (Score:2)
Re: (Score:2)
What good is "Free Software" when it only runs on a proprietary platform? It's like saying "free food" but neglecting to mention the cover charge.
Well, if I say free food from 5-6 pm at this GPS address and you want any of it, you'll have to get off your butt and spend your effort/resources getting to that GPS address. If the address were one house down from yours, you'd like walk and try it out. If it were across town, which would mean 15-30 minutes travel out of your way to get there, you might only show
Re: (Score:2)
It's like using free software in Cuba.