Brazilian government to ditch Microsoft in favour of bespoke email system

I agree, but what they should do about it is attack the policies, not swap out the stack for another stack. Motion is not necessarily progress.

To the best of my knowledge, no one has alleged that the NSA had Microsoft's help in intercepting Petrobras-related email. This is more about the possibility of such a threat than anything else.

Disclaimer: I work at Microsoft, so eh.

It's more of a practical concern.

Migrating the government to Linux and using a free mail infrastructure would be cheaper (saving money in the long term, instead of costing), easier, and way more effective than using a non-standard internal email protocol and keep using Windows everywhere. Why bother when Microsoft still has access to all your data?

About using that proprietary protocol AND migrating to a free software environment, that could be better than just migrating, or worse, depends of the actual quality* of the protocol. But while the government frames it as a XOR option, migrating to an open stack is the only sane option.

* The fact that the protocol isn't public isn't good, the fact that it's Serpro creating it makes this worse - they've already done quite a few bad decisions about security.

It sounds a lot like a Brazilian version of the secure intranet (GSI) that the UK has rolled out for lower level stuff.

And from a security perspective (sorry linux fanbois and microsft haters) the choice of MTA/MUA isn't as important as the rest of the security.

Would be interesting if due to this that OSI and X.400 makes a comeback for more secure email - though presumably with all the security enhancement proposed for the later standards - hmm I wonder if you could use quantum networking with x.400/500

If they opted for an entirely open source system (possibly open-sourcing the one in question) that several governments with the same concern could collaborate on, then they would probably be much safer. Going with a bespoke system that will be deployed widely is a recipe for problems. It's likely to have limited documentation and lots of setup edge-cases that are easy to compromise.

Well, one problem is when the client is a government. Healthcare.gov can not exactly be described as rocket science either (even less so I'd imagine), but ended up costing a nice little sum of money, while also not even working.

You'd think so. But we're still in an age of software wizardry. It's easy to write great software if you exist within an organization where software dev. is already a core competency. But if that's not the case and you need to procure high quality software without already having the expertise in house then things get hairy really fast. Not that it's the best example, but look at healthcare.gov, it's a buggy mess at a cost of tens of millions of dollars.

I suspect that Brazil's home grown mail system is also going to be a buggy, low-quality mess at a cost of tens of millions of dollars.

Calendaring is actually a pretty difficult problem to solve. It sounds trivial, but the devil is in the details.

> How hard is it to write an email client?

> With some calendar?

> Is it complete rocket surgery or something in the realms of feasibly possible?

Oh dearie. Thus began every single failed multi-million-dollar software project in the history of software.

> Wasn't gmail some 20%-er time by a couple of guys at Google? I don't think it took years or billions to get up and running.

A: The feature-set of GMail as is released in 2004 is unlikely to impress someone used to Outlook/Exchange

B: What a correctly motivated Google-quality engineer can cook up in a few years (which is apparently how long GMail was in development before release) has little to no correlation to what a government can procure from a systems integrator. Also, I don't recall the calendar being worth much back them. Maybe, maybe, maybe if they hired Google-grade engineers, paid them Google salaries and gave them Google-freedom to work on this, they might be able to pull it off. But that's a lot harder than it sounds.

EDIT:

> do something on its own about securing government communications

It's not hard to secure an email installation - its interface to the internet at large is super small and well understood (SMTP). Most likely NSA grabs the mail they want from outside the installation by sniffing unencrypted network traffic.

A worthwhile effort, and one quite suitable for a government even, is to get people to encrypt their emails.

> If a country is big enough to have an air force then it is big enough to do something on its own about securing government communications.

If that was really the case then the U.S. government (which has effectively 2 separate air forces which are each 10x bigger than any other nation's) should be kicking ass at delivering IT projects of all sorts.

Quite hard to reinvent an entire infrastructure (which I doubt is what they are doing)

If they are writing a brand new clean room new mail standard (plus all the ancillary bits directory non repudiation key handling the whole nine yards) - it will be amusing to watch the CF that results.

> How hard is it to write an email client?

Not much, but unnecessary. There are open-source solutions that can be security audited, fortified and improved.

> With some calendar?

Devilishly hard.

> And this being SERPRO, they'll likely use cutting edge technologies such as MD5 and DES.

Hey, PBKDF1 uses md5. That only puts them a handful of years behind.

As we've already seen, US companies have very little leverage against the US government in such "national security" matters. (Same for Chinese companies, etc.)

I don't know about your healthcare.gov, but it is very difficult to predict the success or failure of a government project around here (i am brazilian).

At one side we have incredibly well done and well managed examples, as our elections voting system. I get embarassed for US everytime I see the news about your elections, with cards and weird stuff.

On the other hand, we have lots of examples of how the government can mess things up, most notably these days are the stadiums and overall infrastructure for World Cup. It is even worse than any pessimist would have predicted.

So... all we can do is wait. The initiative, I think is good, but the outcome.. who knows?

I use the expresso daily, it's not a good platform, lot of limitations! But at least, is a response for the spying. Better than doing nothing! Hope this investment change expresso in a better way!

It is based in a german project (http://www.egroupware.org/)

You think?

It literally says that in the first paragraph.