Stay Ahead With Linux Security News

code reviewsecurity projectopen source auditing

DARPA Sardonix Project Faces Challenges In Attracting Auditors

Two years after its hopeful launch, a U.S.-backed research project aimed at drawing skilled eyeballs to the thankless task of open-source security auditing is prepared to throw in the towel. Initially funded by a research grant from the Pentagon's Defense Advanced Research Projects Agency (DARPA), the Sardonix project aspired to replace the loosely-structured Linux security review process with a public website that meticulously tracks which code has been audited for security holes, and by whom. . . .. Two years after its hopeful launch, a U.S.-backed research project aimed at drawing skilled eyeballs to the thankless task of open-source security auditing is prepared to throw in the towel. Initially funded by a research grant from the Pentagon's Defense Advanced Research Projects Agency (DARPA), the Sardonix project aspired to replace the loosely-structured Linux security review process with a public website that meticulously tracks which code has been audited for security holes, and by whom. As conceived by Oregon-based computer scientist Crispin Cowan, Sardonix was to attract volunteer auditors by automatically ranking them according to the amount of code they've examined, and the number of security holes they've found. Auditors would lose points if a subsequent audit by someone else turned up bugs they missed. Cowen hoped that the system would produce the same cocktail of goodwill and computer-judged competition that fuels other successful geeky endeavors, from the distributed computing effort that recognizes top producers in the search for new prime numbers, to the "karma" points awarded highly-rated posters on the news-for-nerds site Slashdot. In the end, though, nobody showed up. "I got a great deal of participation from people who had opinions on how the studliness ranking should work, and then squat from anybody actually reviewing code," says Cowan, chief research scientist at WireX Communications. . Two years after its hopeful launch, a U.S.-backed research project aimed at drawing skilled eyeballs.years, hopeful, launch, -backed, research, project, aimed, drawing, skilled, eyeballs. . LinuxSecurity.com Team

Feb 02, 2004 • LinuxSecurity.com Team Security Projects