Concern Regarding Inclusion of Open-Source Projects in "Shareware and Freeware" Category in Advanced URL Filtering

[josealonso]

Hello Palo Alto Community,

I am writing to raise a concern regarding the categorization of websites under Palo Alto Networks' Advanced URL Filtering. Specifically, I have noticed that sites providing access to open-source projects (such as Github, git-scm.com or sourceforge.net) are included within the "Shareware and Freeware" category. According to the definition provided on the Palo Alto Networks website, this category encompasses:

"Sites that provide access to software, screensavers, icons, wallpapers, utilities, ringtones, themes, or widgets for free or donations. Includes open-source projects."

While I understand the necessity of maintaining robust security measures and categorizing websites to prevent access to potentially harmful content, I am concerned about the implications of including open-source projects in this category. Here are a few key points of concern:

1. Conceptual Difference:

   • There is a clear demarcation and conceptual difference between shareware/freeware and open-source software. According to the Open Source Initiative (OSI), open-source software is defined by several key criteria:
     • Free Redistribution: Software can be freely shared and redistributed.
     • Source Code Availability: Source code must be accessible, allowing users to modify and share modifications.
     • Derived Works: Licenses must permit modifications and derived works.
     • Non-discrimination: Licenses cannot discriminate against any person or group.
     Open-source software is typically characterized by its transparent codebase, community-driven development, and rigorous peer-review processes that enhance its security and reliability.
   • This stands in contrast to shareware and freeware, which often include proprietary software distributed for free, sometimes with limitations or bundled adware
   • Including it under the same category as shareware and freeware, which sometimes includes adware or malware, could lead to misconceptions about the safety and reliability of open-source software.

2. Access Restrictions:

   • Many IT organizations heavily rely on open-source software as a foundational part of their infrastructure and development processes. Blocking access to open-source project sites could significantly hinder these organizations by restricting access to critical tools, libraries, and frameworks necessary for development, operations, and innovation. The reliance on open-source software is so prevalent that many systems, from web servers to development tools, are built and maintained using open-source technologies.

3. Perception and Usage:

   • This categorization might inadvertently associate open-source projects with less secure software categories, potentially discouraging their use within organizations that rely on Palo Alto Networks' security solutions.

I am interested in understanding the rationale behind this categorization and whether there are any plans to re-evaluate or refine the categories to better distinguish between different types of non-commercial software. Specifically, I believe that separating open-source projects from shareware and freeware could help avoid unintended consequences and better reflect the nature of these projects.

I would appreciate any insights or updates from the Palo Alto Networks team on this matter. Additionally, I welcome input from other community members who might have encountered similar issues or have suggestions on how to address this concern.

Thank you for your attention to this matter.