Symbian frees security source code
Open kernel on horizon
The Symbian Foundation has started open-sourcing its mobile operating system, announcing the release of the Symbian OS security package source code under the Eclipse Public License.
Last summer, after swallowing the last of the old Symbian Ltd., Nokia told the world it would open source the company's entire mobile platform, creating the Symbian Foundation in tandem with Motorola, Sony Ericsson, NTT DoCoMo, Texas Instruments, Vodafone, Samsung, LG, and AT&T.
The security code is the first package to be moved off the closed Symbian Foundation License (SFL).
The move was announced yesterday on the Symbian Foundation security blog. "We're Off and Running!" the headline reads.
According to the posting, there were two reasons why this package was the first to be set free: a practical one and a symbolic one.
The practical reason has to do with a vagary in the export laws of the UK, where the Symbian Platform source code is hosted. The group trying to export the code ran into rules that prevented the crypto library source code from being exported when it was covered by the Symbian Foundation License.
"Fortunately," the posting goes on to explain, "there is an exemption for software 'in the public domain', meaning that open source software isn't export controlled, so moving it from SFL to EPL was the most straightforward way to make sure that the complete cryptographic functionality would be available to all."
The symbolic reason: Symbian wanted "to demonstrate that we really are serious about providing a platform that is both open and secure."
"We’ve always been open about the design of our platform security mechanisms," the post continues. "Now we’ve started being open about their implementation as well." And, in the true open-source tradition of shared responsibility, it adds: "Cryptographers know to distrust cryptographic algorithm implementations that aren’t open to peer review, so here are ours."
The next release is the Symbian kernel. "While Security is a very relevant package, we need to target something that will trigger discussions, represent Symbian at the heart, fuel development, overload the forums, engage the non-believer and most of all start putting us on equal fighting terms with other available open source platform," reads a post from Symbian chief architect Daniel Rubio.
Rubio indicated this would happen in the fall. "The good news is that we are working hard to make this happen in the short term, which in my mind is a three month horizon," he said. ®
- Black Hat
- Common Vulnerability Scoring System
- Cybersecurity and Infrastructure Security Agency
- Cybersecurity Information Sharing Act
- Data Breach
- Data Protection
- Data Theft
- Digital certificate
- Identity Theft
- Kenna Security
- Palo Alto Networks
- Trusted Platform Module
- Zero trust