   Why do people simply assume that Open Source=Security?    
  Recently The Register, a news website that I have at least some respect for, since despite giving off the initial smell of Slashdot anti-microsoftness they actually have objective reporting (for instance, despite being Mac lovers, they're not afraid to break the golden rule of Steve Jobs by actually saying when something isn't right, like the many UI flaws in OS X), published the following article which covers the recent release of the fixed security bugs in Mozilla (remember, as a beta tester user of Mozilla it is your responsiblity to only tell Mozilla about bugs, otherwise people might realize it was just as bad as IE).Of course these bugs are all patched (otherwise they would still be secret), but they give insight into the many extreme security vulnerabities that where in Mozilla (and there are of course more to come, we haven't even seen what security bugs where in 1.1). At the same time a small group of hippy zealots would have you believe that anything Open Source (not Microsoft) must   be secure. This arrogance has gotten the Open Source movement into trouble before, like when the Apache group denied that there could be any security vulnerability in its Apache Server, even after the white hat hacker group Gobbles provided information on an exploit that would allow root access on a target server. Eventually Apache admited it would work on Microsoft's   operating systems (because they're not open source of course) but that Open Source operating systems like Linux and OpenBSD where unaffected. After a few months of this stupidity Gobbles finally decided to do something risky and damaging to prove their point and get Apache to admit to the problem by publicly releasing an OpenBSD version of the exploit (which meant that even a script kiddie could download the source and gain control of the root account on an OpenBSD system running Apache). Because of this extreme arrogance stupidity on the part of Apache open source hippies there are now thousands of Apache Server installations that are totally vulnerable.My question and the topic of discussion is:When are we going to stop listening to the open source, MS bashing zealots and realize that all software is vulnerable? Or are we going to just let rival corperations like VA control our minds through media fronts like Slashdot? (example: VA using Slashdot to preemtively attack Microsofts upcoming source control software by calling it a cheap clone of VA's Sourceforge, despite the fact that it's too early to tell anything about it, or if it's even like SourceForge at all).EDIT: Guess what just showed up on Slashdot:"Mozilla's 200,000th Bug" ("they're up to 178,325")"51 bugs have been filled today"[edited by - michalson on November 5, 2002 8:55:25 AM]
  Personally, I have never believed that Open Source can ever be truly secure. You have to remember that for every white hacker in the world there are at least a dozen who have turned to the dark side. For every man working to better a system, there a hundred more working to bring it down. This also applies to closed source software, of course, but it is much more simple for someone to see the flaws of an OS program, therefore they can be exploited faster. On the flipside, you can also say that the fault will be repaired faster as well, as there is a larger team of people working on the program. But then comes the problem of analysing each of the solutions to find the best one...At the end of the day, I think the choice to use open source software comes down to a matter of trust really. Do you trust other people enough to use software that a larger community knows inside-out, or would you prefer the added sense of security that comes from using a closed, commercial package. Remember afterall that that is the only difference between the StarOffice and OpenOffice suites. Open is open (well, duh!) and free for the "hardcore" user, while Star is aimed at people who don''t entirely trust OpenSource...    If at first you don''t succeed, call it version 1.0SketchSoft | SketchNews;  Just to make it clear (this has nothing to do with doodle_sketch's post), I'm not suggesting that closed source software is somehow more secure, just questioning the reteric that open source someone makes software perfect/holy (or at least good enough for 10 elitist asshole zealots and a few thousand posers who think that by saying "M$ sucks" they'll somehow be accepted by others).EDIT: Link[edited by - michalson on November 5, 2002 9:15:13 AM];  I don''t think open source is anymore secure than closed source.  Open source just has that "many eyes" theory so they assume everything will be caught.  They praise how patches come out quicker... well no kidding, you got a group of geeks trying to be the first to patch it just for bragging rights.  Half the people who claim "M$ $UCKS" don''t even know what the hell they are saying it for.  They have no theory to back it up.  The rest who do have half a clue are so blinded by open source they refuse to hear about anything else which in itself is pretty closed minded.I will give openbsd some props tho, only one remote hole in the default install in 6 years.  Thats a pretty impressive record, plus their developers actually audit the code for security.  That is one of the reasons I like bsd over linux.I''ve rambled enough, now to leave you a quote:"Open source, closed minds, we''re Slashdot"  ;quote:Original post by Hitchhiker90  I don''t think open source is anymore secure than closed source.  Open source just has that "many eyes" theory so they assume everything will be caught.  They praise how patches come out quicker... well no kidding, you got a group of geeks trying to be the first to patch it just for bragging rights.  Half the people who claim "M$ $UCKS" don''t even know what the hell they are saying it for.  They have no theory to back it up.  The rest who do have half a clue are so blinded by open source they refuse to hear about anything else which in itself is pretty closed minded.I will give openbsd some props tho, only one remote hole in the default install in 6 years.  Thats a pretty impressive record, plus their developers actually audit the code for security.  That is one of the reasons I like bsd over linux.I''ve rambled enough, now to leave you a quote:"Open source, closed minds, we''re Slashdot" Yes, along with "many eyes" there are "many hands" (as described in my second link) which tend to cause most Linux security issues. I would definitely agree with your point about the "M$ $UCKS" crowd. Most are simply young people looking to be accepted, and will say and emulate whatever the "in" crowd is doing.The refusal to hear anything bad about their little baby seems to have spawned from the Cult of Mac (which seems to be banding with the Linux crowd in recent years in order to stay warm). Anyone who actually used a Mac before OS X will know that its crappy Windows 3.1 era "multitasking and "memory mananage" were pathetic, leading to the "sorry, a trivial application has crashed for no good reason bring down your entire system" and "printing, please watch the spinning cursor and do nothing" and of course the famous "sorry, you don''t have enough memory to run netscape, please stop multitasking". Of course it was a crime to talk about any of this, and instead claim that the Mac was stable and easy to use. Today the Cult is so ready to serve their master Steve Jobs (even VA doesn''t control the minds of the open source crowd as well as Apple controls the minds of Mac users) that they are actually signing a petion to raise the already high prices for Macs and their components ($100/year for email that isn''t reliable and used to be offered for free? Sure).  ;  yeah, that 200,000 figure shocked me... but look closer;The vast majority of the "Bugs" are really just usability suggestions; the next most common "Bugs" are fakes, since anyone can submit anything through Bugzilla.There are not nearly as many real bugs as the article implies.As for open source being secure... I think it is slightly more secure than closed source software, since holes are discovered relatively quickly, and patched right away;of course the big caveat is the fact that you need to stay updated; most people don't update their software that often, and end up running software with publicly known holes inadvertently.[edited by - mithrandir on November 5, 2002 9:34:48 AM];quote:Original post by Mithrandir  of course the big caveat is the fact that you need to stay updated; most people don''t update their software that often, and end up running software with publicly known holes inadvertently.  when you download an open-source program off the net you''ll get the latest version - when you buy a program you mostly get the first version which is then up to you to patch. ''ROIDRAGE!!! - I wanna work for the chinese communist regime! ;  The point is not that Open Source projects are "completely secure", but they are, in general, going to be more secure, because of their open source nature. People want to see source for a web browser, so they look at Mozilla''s. Some people just want to find bugs, etc., and bugs and security holes are found and taken care of. If Internet Explorer has bugs, who''s going to know until it''s too late? You''ve got a handful of people at Microsoft who have the ability to look at IE code. Heck, you can probably only look at your module''s code, who knows. I suspect that many bugs are found by just browsing source and having someone point out, "Hey you didn''t initialize this variable" or "You need to use an unsigned long here, not an unsigned char", or whatever.It''s the same principle of security that goes along with cryptography. Obscurity is not security. You shouldn''t rely on the cracker not knowing your algorithm. You should assume he knows the decryption algorithm.I think this is a rather silly thing to get all in a fuss about. If someone claims their software is absolutely bulletproof, they''re lying. No software is. Open source software is going to be, in general, more secure just by its nature. It''s not that hard of a concept to grasp.In practicality results may differ. For example, if you have a group at MS working full time jobs on a project, and you''ve got two teenage kids working on an open source project, results may vary. However, if all other factors are equal (same number of man hours, programming skills, etc.) then open source has an extra advantage over the closed source version. That''s pretty simple to me, and of course it''s not an absolute law of the universe. There are exceptions, but it''s a general concept.Russell  ;quote:Original post by Michalson  When are we going to stop listening to the open source, MS bashing zealots and realize that all software is vulnerable?  IMO, this is a side-effect of a bigger problem: that many people simply will not think. They would rather take the publicly stated opinions of some figure of authority and substitute those as a direct replacement for conscious thought. I believe the criteria used in choosing which of other people''s opinions to adopt as their own involves a "feelgood" factor. As in, they will believe something because they *want to* believe something. In fact, I think it goes deeper than that, and that their ego actually drives each and every one of their actions, actively preventing the enlightenment of thought and intuition. Furthermore, these people seem to have an unconscious convinction that everyone else around them acts from the same motives, to the point they cannot comprehend there might be others who act from unlike motives.This phenomenon is in evidence all around us, in every walk of life. For these people, a challenge to their opinions is indistinguishable from a challenge to their ego. On the surface, these people are difficult to identify - expressing other''s ideas as your own can go a long way in emulating conscious thought. They are often unveiled, however, when involved in intense debate, where their focus shifts from what has been said to how it has been said: eventually they reach complete breakdown where they are left in a gibbering state of reiterating opinions they''ve read elsewhere and wailing about how they have been mistreated. Often, they are also seen coming to the aid of others in the guise of "morality police" and defenders of the battered ego, providing the temptations that lead one another away from the need to think.These people are the zealots you mention, and they encompass the group of people who "assume that Open Source=Security?" They have heard the claim from some source and it gave them a warm and fuzzy feeling to believe it. Once the claim is accepted, it becomes their own precious belief and they will do what they can to prevent others from taking it away from them.  ;quote:Original post by Hitchhiker90  I will give openbsd some props tho, only one remote hole in the default install in 6 years.  Thats a pretty impressive record, plus their developers actually audit the code for security.  That is one of the reasons I like bsd over linux.  so those mindless "m$ sucks" opensource zealot are completely wrong and can go suck on it according to you, the mindless "auditing must make it secure" and "a default install of practically nothing means security" zealot?