Symbian frees security source code

Open kernel on horizon


The Symbian Foundation has started open-sourcing its mobile operating system, announcing the release of the Symbian OS security package source code under the Eclipse Public License.

Last summer, after swallowing the last of the old Symbian Ltd., Nokia told the world it would open source the company's entire mobile platform, creating the Symbian Foundation in tandem with Motorola, Sony Ericsson, NTT DoCoMo, Texas Instruments, Vodafone, Samsung, LG, and AT&T.

The security code is the first package to be moved off the closed Symbian Foundation License (SFL).

The move was announced yesterday on the Symbian Foundation security blog. "We're Off and Running!" the headline reads.

According to the posting, there were two reasons why this package was the first to be set free: a practical one and a symbolic one.

The practical reason has to do with a vagary in the export laws of the UK, where the Symbian Platform source code is hosted. The group trying to export the code ran into rules that prevented the crypto library source code from being exported when it was covered by the Symbian Foundation License.

"Fortunately," the posting goes on to explain, "there is an exemption for software 'in the public domain', meaning that open source software isn't export controlled, so moving it from SFL to EPL was the most straightforward way to make sure that the complete cryptographic functionality would be available to all."

The symbolic reason: Symbian wanted "to demonstrate that we really are serious about providing a platform that is both open and secure."

"We’ve always been open about the design of our platform security mechanisms," the post continues. "Now we’ve started being open about their implementation as well." And, in the true open-source tradition of shared responsibility, it adds: "Cryptographers know to distrust cryptographic algorithm implementations that aren’t open to peer review, so here are ours."

The next release is the Symbian kernel. "While Security is a very relevant package, we need to target something that will trigger discussions, represent Symbian at the heart, fuel development, overload the forums, engage the non-believer and most of all start putting us on equal fighting terms with other available open source platform," reads a post from Symbian chief architect Daniel Rubio.

Rubio indicated this would happen in the fall. "The good news is that we are working hard to make this happen in the short term, which in my mind is a three month horizon," he said. ®

Broader topics


Other stories you might like

  • Google battles bots, puts Workspace admins on alert
    No security alert fatigue here

    Google has added API security tools and Workspace (formerly G-Suite) admin alerts about potentially risky configuration changes such as super admin passwords resets.

    The API capabilities – aptly named "Advanced API Security" – are built on top of Apigee, the API management platform that the web giant bought for $625 million six years ago.

    As API data makes up an increasing amount of internet traffic – Cloudflare says more than 50 percent of all of the traffic it processes is API based, and it's growing twice as fast as traditional web traffic – API security becomes more important to enterprises. Malicious actors can use API calls to bypass network security measures and connect directly to backend systems or launch DDoS attacks.

    Continue reading
  • Zero Trust: What does it actually mean – and why would you want it?
    'Narrow and specific access rights after authentication' wasn't catchy enough

    Systems Approach Since publishing our article and video on APIs, I’ve talked with a few people on the API topic, and one aspect that keeps coming up is the importance of security for APIs.

    In particular, I hear the term “zero trust” increasingly being applied to APIs, which led to the idea for this post. At the same time, I’ve also noticed what might be called a zero trust backlash, as it becomes apparent that you can’t wave a zero trust wand and instantly solve all your security concerns.

    Zero trust has been on my radar for almost a decade, as it was part of the environment that enabled network virtualization to take off. We’ve told that story briefly in our SDN book – the rise of microsegmentation as a widespread use-case was arguably the critical step that took network virtualization from a niche technology to the mainstream.

    Continue reading
  • Open source body quits GitHub, urges you to do the same
    Paid-for Copilot trained on FOSS code final straw for Software Freedom Conservancy

    The Software Freedom Conservancy (SFC), a non-profit focused on free and open source software (FOSS), said it has stopped using Microsoft's GitHub for project hosting – and is urging other software developers to do the same.

    In a blog post on Thursday, Denver Gingerich, SFC FOSS license compliance engineer, and Bradley M. Kuhn, SFC policy fellow, said GitHub has over the past decade come to play a dominant role in FOSS development by building an interface and social features around Git, the widely used open source version control software.

    In so doing, they claim, the company has convinced FOSS developers to contribute to the development of a proprietary service that exploits FOSS.

    Continue reading

Biting the hand that feeds IT © 1998–2022