On Mon, 14 Nov 2005 11:51 , Simon Morris <mozrat@gmail.com> sent:

>On 14/11/05, Shakthi Kannan cyborg4k@yahoo.com> wrote:
>> > When was the last time you read the source code for
>> > any Linux kernel
>>
>> 5 minutes back?
>>
>> Please. I am a device driver developer ... [1]
>>
>
>Yay for you. Can I assume you haven't read the code for all the
>application you are using?
>
>My point was you can't rubbish software from a vendor just on the
>basis that you don't have the source code.
>
>Having the source code doesn't automatically mean secure applications.

While this is true I have to say that one reason I feel that Open Source software is more secure is for three basic reasons.

1) Multiple people (usually) will be interested in or actively developing the code and this gives several "independent" eyes on the code during and after development.  As such, it is less likely a shoddy piece of code will get through.  I certainly know that before I show my code off to someone else, I go back and do a personal code review.

2) If a program is suspected of having a flaw that has security implications, like a buffer overflow error that allows arbitrary code to be run, anyone (including myself) can go in and look to see exactly what is being done in the code.  Not only look, but fix it if they find it.  This can provide a fix so quickly that it is available even before the vulnerability is exploited in the wild.

3) If a piece of OSS acts maliciously it is possible to go into the code and see what is being done.  This would give the best chance of undoing what was done and recovering from any damage done by the code.  It would also give a good chance of tracking the code back to the original author, at least in the case of a well managed OSS project.

Having your source code exposed to the thousands, nay millions, of developers in the world makes one very conscious of the actual code they are producing.  This is the reason that many companies have code review sessions on a regular basis.  When a programmer knows they are going to be showing off their code to their colleages and peers they will take extra care to have it looking good and working well.

Andy Farnsworth



-- 
Gllug mailing list  -  Gllug@gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug


