I think this is going to be a very interesting email. :)
So...I contacted the ICSA group today asking about
the certification process. It is expensive: $25k for non-FWPD
consortium members and $15k for members. That's per product
and per platform. I haven't read thru all the docs yet, so
I don't know if anything open-source is expressly excluded
from participation (I can think of good marketing reasons why
other FWPD-members would want it to be).
This leaves me wondering...is it worth it? To reach
a specific target user for LEAF, I think it is required. Is
reaching that user worth it? Well...I also think so: I think
that most people who are authorized to approve the use and
purchase of a firewall platform are also the same sort of people
who would rely on a silly consortium to approve one for them in
the first place. Which is to say, the largest target user-base
doesn't *want* to know the details of a firewall or its
certification, then just want to know that *someone* certified it.
Okay, sure, some of the ICSA guidelines are good ones...though
I can't imagine using anything that didn't meet them at the
very least.
Anyhow. As a few of you know, I started a company ~2.5
years ago to write some networking software to make these
'home-networking' things easy to setup and to use. My wife
and I have bootstrapped its funding from day-1 and we're
actually to a point now where we've some demo'able software
that might actually be productizable. For everything you've
heard about Venture-Capital here in Silicon Valley, the
reality is that VC's fund businesses, not ideas. And until
you actually have someone willing to *buy* a product from
you, you're not a business. So, technically, my startup isn't
exactly 'in business' yet. :)
What's my point. What I think is doable is that, under
the auspices of my company (a really normal Class-C California
corporation), I could start moving the certification process
forward with ICSA. My understanding is that the ICSA would want
it that way: a representative company with a specific product,
rather than a team of distro developers. I'd want to do this
*IF AND ONLY IF*
the LEAF developer team agrees it's a worthwhile thing to do. Here's
the biggest problem: I will be, to some degree, presenting a LEAF
distro to the ICSA guys under the premise that it's a product of my
company. Which, let me be the first to say, it's NOT: it's the work
of all of YOU guys, of Dave Cinege, of the dozens of real developers
out there. I'm just coding a pretty face on it. So it could be very,
very easy for me to quickly look like someone that's trying to
outright steal this open-source work and misrepresent it as my own.
And I've got more trouble with *that* image than anyone.
So before I move this one more micron forward, I wanted
to solicit for some candid feedback about your collective feelings
about doing it. My intention is *not* to prop-up my startup
(though a successful certification, admittedly, will), but rather
to explore opening a 'new market' for things LEAF'y. I'm sure
such things have happened before to other open-source projects
(was there discuss like this when Cayote appeared? Or when tripwire
went commercial?), but I've never been on a mailing list when
someone first brought it up (hey, a first).
Please let me know your thoughts, feel free to flame if
needed. :) I've got too much respect for you people to consider
this without asking about it WAY up front.
cheers,
Scott
_______________________________________________
Leaf-devel mailing list
[EMAIL PROTECTED]
http://lists.sourceforge.net/lists/listinfo/leaf-devel
