Open Source Code Contains Security Holes
[Quote:]
Open source code, much like its commercial counterpart, tends to contain one security exposure for every 1,000 lines of code, according to a program launched by the Department of Homeland Security to review and tighten up open source code’s security.
Popular open source projects, such as Samba, the PHP, Perl, and Tcl dynamic languages used to bind together elements of Web sites, and Amanda, the popular open source backup and recovery software running on half a million servers, were all found to have dozens or hundreds of security exposures and quality defects.
A total of 7,826 open source project defects have been fixed through the Homeland Security review, or one every two hours since it was launched in 2006, according to David Maxwell, open source strategist for Coverity, maker of the source code checking system, the Prevent Software Quality System, that’s being used in the review.
At the same time, projects like Samba have been adept at correcting the vulnerabilities, once they were identified. Samba was found to have a total of 236 defects, a far lower rate than average for 450,000 lines of code. Of the 236 defects, 228 have been corrected, said Maxwell in an interview.
And as a result everyone’s security improves.
Except Windows users. Will somebody please think of the Windows users?
No? Okay.
February 9th, 2008 at 23:02
You mean, that non-OS related softwares are listed up there and you try to connect it to the OS?
Hmm.. Then please, will someone think of the Ferrari users? It’s not listed up there.
Apples and oranges.
And yes, I think that Windows is not totally secure, and not the best OS out there.
Unfortunately the same goes for the rest.
But please, don’t mix things.
February 9th, 2008 at 23:17
I’m not mixing things. There’s a huge subsidy to find bugs in software, and not all software is tested equally. I think the same amount of external effort should be taken to make windows better.
February 9th, 2008 at 23:33
Ah, then I agree. Then I should write “Except users of commercial softwares. Will somebody please think of the users of commercrial softwares?”
And that include AS400, Mac OSX, Photoshop, Adobe Acrobat, etc., softwares we buy and use daily.
Now, I just have to find a way to convince my boss that the software we sell should be opened up to people so everyone can see how we solved the business problems and fix our bugs :))
You have to decide between selling softwares or having a ton of people working on your code around the world. People, who usually make their living with writing softwares that are not bugfixed by thousands all around the world.