After the announcement that ModSecurity was purchased by Breach Security I decided to email Ivan and ask him a few questions that many of us are wondering regarding the future of modsecurity.

How will the sale of ModSecurity to breach affect existing users?

"There are going to be many positive changes resulting from this sale. Development is going to accelerate as we will have one developer assigned to working on the code full time, and that's in addition to me having more time to spend on development. The documentation and community support are going improve too, as we are going to have someone dedicated full-time to growing and nurturing the community. The latter is very significant as I have come to the conclusion that the interaction with the community is the main opportunity for further expansion. Web application security is complicated due to the dynamic environment and the web application firewalls protecting those applications must manage a changing environment. Right now ModSecurity is difficult to use for some because there are no wizards and no implicit protection facilities. Users must have a high level of expertise. While this works well for the professionals, I want to make ModSecurity an equally suitable solution for people who are not web application security gurus but have an equally important need to protect themselves, while minimising their time investment in the process.

I also believe the ModSecurity users are going to benefit from the commercial offerings. They will have the option to purchase a commercially supported version of ModSecurity from an organisation with broad reach to places I previously could not support. That, and the range of appliances we will come out with, will ensure the users have a very wide choice of deployment options.

Our first appliance, expected in November, is going to be *very* affordable. Breach Security want to continue to pursue the main goal of the ModSecurity project, and that is to make web application firewalls accessible to everyone. This, of course, makes me personally very happy as it's a goal I've been working on for some years now."

Will future versions of ModSecurity be closed source?

"No. ModSecurity for Apache is going to remain open source. Not only that, but the open source version is where the improvements are going to continue to be added, meaning the community is going to get them straight away.

I know this question – “will product remain open source?” - is what many think about in situations like this . Breach Security are committed to keeping ModSecurity open source, but you don't have to take my (or anyone's) word for it. Just wait and see. Actions are always stronger than words. Also, as many have pointed out before me, open source products do not die unless the community wants them to die."

How will the licensing model be affected?

"The licensing model is not going to be affected. ModSecurity was always available under two licences and that will not change. The open source version uses GPLv2. There is also the commercial licence, which we are going to use for the commercial version of ModSecurity. The commercial version of ModSecurity is going to be based on the same code base with added services and more responsibilities on our part (e.g. support with a service level agreement, support for the ruleset, etc)."

What are the terms of the acquisition?

" Undisclosed."

What are Breach Security's plans for ModSecurity and when will we expect to see those changes?

"The main plan is to give the project the resources it needs to continue to develop. For this we need to find the right people and we have already started to look. The ultimate plan is, as it has always been, to make ModSecurity into the best possible open source web application firewall.

The project is already benefiting because an independent security code review of the ModSecurity 2.0 code base it taking place before the product is released (on October 2nd). Breach Security has also decided to make the ModSecurity Console (limited to supporting 3 sensors) available for free for a limited time. Finally, we are going to release the certified rule set to the community and make it part of the core product. This, the rules, is a feature every member of the community we talked to requested."

Boxers or briefs?

"Briefs. Too much freedom is not necessarily a good thing."

Additional information about the acquisition can be found at this blog at http://www.modsecurity.org/blog/archives/2006/09/modsecurity_has.html