> Mac scribbled:
> Salient quote from a commentator:
>> While Microsoft can argue theoretical advantages, in terms of real
>> world experience, Windows has a consistently terrible record on the
>> security front. Even if you compensate for Windows' popularity,
>> Windows is disproprortionately insecure. For example, when looking
>> at the statistics for web servers, about 1/2 are Windows and 1/2 are
>> Linux or UNIX, but Windows-based systems are responsible for 3/4ths
>> of the compromised web sites. In the corporate market, Exchange and
>> Notes have about the same market share, but Exchange is a security
>> sieve, while Notes is almost untouched by viruses.
>>
>> What it comes down to is that Microsoft's engineering decisions have
>> reprecussions. And if they spend a decade ignoring security, and
>> making fundamental decisions that reduce security (ActiveX, DCOM,
>> inter-applicatiopn scripting, enabling all services by default, all
>> with no real security model), a little debugging isn't going to
>> fundamentally address the issue. Microsoft will only be able to ship
>> a secure, stable OS when they decide that security and stability are
>> MORE IMPORTANT than the things that have made them very, very rich.
>> And I suspect that they may not be able to make that decision.
>>
>> This isn't a proprietary vs. open source issue, either. MS has a much
>> worse security record than ANY other operating system vendor. Of
>> course, they also have tons of money, so perhaps security and
>> stability ISN'T as important to most people as flashy demo's.
OTOH (and to provide a 'balanced' lets ALL bash a computer operating
system....)
A Critical Perspective: Eyes That Look Do Not Always See
An article entitled The Myth of Open Source Security by John Viega, the
original author of GNU Mailman, challenges the popular premise that Open
Source and secure software go hand in hand. In the article, John Viega
acknowledges the fact that with lots of people scrutinizing a program's
source code, bugs and security problems are more likely to be found. He then
raises the point that the availability of source code does not automatically
guarantee that the code has been reviewed by competent parties for a variety
of reasons. Secondly, people who are looking at the source code with the
intent of modifying it are not necessarily in the state of mind to perform a
comprehensive security audit of the code.
One deterrent to the mass review of certain Open Source projects is a high
level of complexity in the code, which can be compounded by a lack of
documentation. In such a scenario, it is unlikely that the average user of
the software will be able to perform a good review of the code. Another
reason that prevents good review of Open Source code is that most of the
people only look at the parts of the code that they want to modify which may
only be a small section of the code. This behavior leads to various
"hotspots" in the code that are intensely reviewed because they are the most
open to modification while many other sections of the code that are less
likely to be useful during modifications are barely looked at. Finally he
dwelled on the fact that a majority of software developers are ignorant of
security practices beyond rudimentary knowledge of good practices (e.g.
avoid strcpy, gets, and strcat functions in C or using encryption is good).
Unfortunately security issues are more complex than most developers are
aware of leading those with the best intentions to miss subtle security bugs
or unknowingly introduce them into a system after a modification. Finally,
the fact that some security bugs are unobvious unless one is completely
familiar with several parts of the source tree and even then certain bugs
may only occur when a particular sequuence of operations occurs is a reason
to be wary of the claims that source availability guarantees the security of
an application.
The article then goes on to use security flaws in GNU Mailman, the Open
Source implementation of Kerberos and wu-ftpd as examples of how security
bugs in Open Source software can be undiscovered for significant amounts of
time even though the source code is available and supposedly has been peer
reviewed by many eyeballs. The fact that Open Source software is beginning
to be packaged as finished products more and more it is likely that the
complacency of users of Open Source software will increase since people may
begin to assume that the code has been peer reviewed by their vendor of
choice and will thus fail to audit the code.
http://www.developer.com/open/article.php/983621
http://www.linuxsecurity.com/advisories/index.html
http://lists.debian.org/debian-secur...3/threads.html
http://www.opennet.ru/base/linux/
....Because the truth is that open source doesn't cure cancer, doesn't lead
to a global gift economy, and doesn't produce perfect software on the first,
second, or even fifty-seventh try. Hell, I could put together a laundry list
right now of glaring flaws and shortcomings in Linux that I blame squarely
on open source development and developers. Jason Compton.
http://www.linux-mag.com/online/compton_c01_01.html
--
mlvburke@#%&*.net.nz
Replace the obvious with paradise to email me.
See Found Images at:
http://homepages.paradise.net.nz/~mlvburke/