More flaws foul security of open-source repository

TalkBack 29 of 55:

Next »

« Previous

• Thread View
• Flat View

Uh huh

"Flaws found.. fixed quickly..

There's no security by obscurity here!"

One small problem. Despite CVS being open source these vulnerabilities have just now been found. How old is CVS? How many eyeballs have actually looked at the code?

While I do agree looking back through the code (auditing) is valuable, I have a problem with the blithe assumption that such audits are done routinely *in any code base*, open or closed.

The truth is, if code works it's forgotten about. The very natural "if it isn't broke don't fix it" mentality takes over. After all, it seems counter-productive to go back and look at code that's working, right?

Whether CVS, Office, Linux, KDE, Mac OS/X or Windows of whatever flavor, bugs will exist. They will remain undetected until somebody has the will to mount a serious search.

The truth is, few people have the will. Fewer still have the skill. And almost nobody is willing to pay the bill.

I can guarantee the only OS out there that has a remote chance of being free of security flaws is Secure BSD--and that's only because they make a religion of it.

Everybody else tries, of course. But the nature of programming is such that nobody's going to find everything--even everything that should be obvious.

This p****ing match between the open source and proprietary software crowds does nothing productive. There's a *reason* that security specialists exist. Security is *difficult*, coding is hard enough, and all the best practices in the world won't close all the holes.

Live with it.

Posted by: wolf_z   Posted on: 06/10/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Reducing Server Total Cost of Ownership with VMware Virtualization Software VMware VMware virtualization enables customers to reduce their server TCO and ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now
• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now