Alan Cox, one of the most respected figures in the UK open source community, has warned of complacency over the security of open source projects. Speaking to delegates at London's LinuxWorld conference on Wednesday, he emphasised that considerable sums of money were being spent to try and hack into open source systems. And he cautioned that many open source projects were far from secure. "Things appear in the media like open source software is more secure, more reliable and there are less bugs. Those are very dangerous statements," Cox said. My take: Agree wholeheartedly. Security complacency, often seen in OSNews' comments sections, is very, very dangerous.
To read all comments associated with this story, please click here.
Member since:2006-01-04
It is my opinion that any open source software has the potential to be exponentially more secure than any closed source code.
There are certainly very secure proprietary systems, such as many mission (and life) critical systems. So I donīt think that any open source project can be exponentially more secure than proprietary ones - but on average they have the potential to be more secure.
There's a commitment to quality, but I'll tell you from a manufacturing background that when push gets to shove quality will take a backseat more often than not.
Well, if security & quality is important enough to customers, proprietary software can be very secure too. But I admit, that this is to seldom not the case.
As for open source projects, the critical factor, is that the project can attract the necessary community to be able to realize the effect of "many eyes" (many of the popular high-interest OSS projects, has certainly attracted the right crowd of security-conscious people).
I donīt disagree, that OSS can be very secure (and often it is). But the most secure proprietary systems can compete with the most secure OSS projects.
Rather than seeing OSS as the only way to develop very secure software, I see the advantage in OSS, that it increases the likelihood of the product being developed in a secure fashion.
That alone is a very good reason to push OSS. But there is no deterministic relationship between development model and security level.
Member since:2006-10-10
I agree with you and see your point on secure proprietary systems having the potential of being as secure as OSS. Maybe using the term "exponentially" wasn't quite right. But I saw it as OSS isn't looking to turn a buck, therefore the community surrounding it should be more open to produce the best product they can since it is really their names and reputations on the line when developing for the product. I also agree with another poster in one of the above posts that "secure" software is only one piece of the security spectrum.
I suppose I really see OSS as the ultimate push for development of ideas and innovation. Like Mozilla Firefox forced MS to release a better product in IE (regardless of which brand you wave the flag for). And like the emergence/dominance of foreign cars in America that forced the domestic companies to produce a better product. As long as you have OSS on equal footing with pay services, or software; the product should only get better. It's competiton that drives innovation, because innovation is usually expensive. Innovation is typically better for the consumer.
I do think OSS still has the ability of being more adept at incorporating new ideas and change, either for security sake or any other part of the overall system. And it's that speed and ability to change quickly that would make it much more of a viable alternative to any propretary system.
"The first killer app was VisiCalc. This early spreadsheet turned the Apple II from a hobbyist toy to a business computer. VisiCalc came with room for improvement, though. In addition, a new architecture and operating system, the Intel-based IBM PC and MS-DOS, also needed a spreadsheet to be taken seriously. That spreadsheet, released in early 1983, would be Lotus 1-2-3, and it would change the world. It became the PC's killer app, and the world would never be the same. On May 14, IBM quietly announced the end of the road for 1-2-3, along with Lotus Organizer and the Lotus SmartSuite office suite. Lotus 1-2-3's day is done." Impressive 30 year run.
"There's a disconnect between how Apple CEO Tim Cook sees his company's tax strategies and how some members of the US Senate view it. That became clearer than ever today after Cook and two other Apple executives testified before Congress, explaining why they're holding most of their international income in Irish subsidiaries like Apple Operations International, which declare no tax residency anywhere in the world. AOI hasn't filed a tax return anywhere in the world for the last five years, yet it earned $30 billion in income from 2009 to 2012, according to a Senate report released yesterday." Just because something is legal, doesn't mean it's just. Apple, Google, Microsoft, and many more - these companies might not be breaking any laws, but it's obvious to anyone that what they are doing is scummy.
The new WebKit Opera for Android has been released. "Opera 14 for Android is built on top of Chromium 26, with a total overhaul of the UI in native code, making it fit well with the latest Android design guidelines. Go get the build from Google Play or point your browser to m.opera.com, and give it a spin!"
The Verge pointed me to a blog post by Leap Motion - which reveals how their Kinect-like motion control works with Windows 8. "From the second you plug in your Leap Motion Controller, you'll be able to browse the web and interact with your computer just by moving your hands and fingers in the air. With Leap Motion technology and Windows, you can do everything that's possible with multi-touch inputs - without actually touching anything. This also means that existing applications in Windows 7 and 8 will respond to your natural hand and finger movements. Soon, we'll show you how Leap Motion will work with Mac OS X." Quite cool.
PocketNow interviews Marc Dillon, and there's an interesting note about why Jolla is keeping the display properties under wraps: "We're leaving some of those details out because we do understand that there are a lot of really big players in the market and they tend to take certain components in the market and dominate them. We created the ability to actually be able to run Sailfish on multiple hardware displays and be able to swap components, so this is part of the demand and supply planning phase. We are committed to this industrial design which is a 4.5-inch display, an 8 megapixel camera on the back and a front-facing camera at the front, and the exact specs of the display we'll provide when we're close to delivery." Something you rarely hear anything about.
"This is my NeXTstation Turbo Color booting the Mac System 7.1 Operating System using a hardware add-on called 'Daydream'. The Daydream has a Mac ROM and a few custom ICs in it and hooked up to the NeXTs DSP port. Turns your NeXT into a full fledged 68k powered Mac." So cool.
"The NetBSD Project is pleased to announce NetBSD 6.1, the first feature update of the NetBSD 6 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements. Please note that all fixes in the prior security/bugfix updates (NetBSD 6.0.1 and 6.0.2) are also in 6.1."
"At the end of a week in which Electronic Arts confirmed it wasn't developing a thing for the Wii U, one of the software engineers in EA Sports' Canada studio, in a series of since-deleted tweets, disparaged the console as 'crap' and suggested Nintendo should give up on hardware altogether. 'The Wii U is crap. Less powerful than an Xbox 360. Poor online/store. Weird tablet', tweeted Bob Summerwill, listed as a senior software engineer at EA Canada, in a reply to a tweet posting a link about EA's no-Wii U news. 'Nintendo are walking dead at this point'." The Wii U is turning into the 21st century's Virtual Boy.
"In NixOS, the entire operating system - the kernel, applications, system packages, configuration files, and so on - is built by the Nix package manager from a description in a purely functional build language. The fact that it's purely functional essentially means that building a new configuration cannot overwrite previous configurations. Most of the other features follow from this." Interesting approach. A Linux distribution, sure, but with some very refreshing ideas about system configuration.
Appfour added, among other features, C/C++ support to its new version of AIDE. From Android-IDE, "Now you can write parts of your app or your whole app in C/C++ on your device. AIDE supports the Standard Android NDK toolchain (GCC 4.6 + Bionic, STL, ...). No changes are necessary if you want to build an app developed on a PC with Eclipse. C/C++ development is fully integrated: Build errors appear in the error list and files can easily be navigated to with Go to file. The editor supports C/C++ syntax highlighting."
Member since:
2006-10-10
And I'm sure you all will correct me if I'm wrong, but this is the thing.
It is my opinion that any open source software has the potential to be exponentially more secure than any closed source code. I think of it in terms of numbers...there will be far more developers looking to create/debug/fix code than people looking to hack it. Also, open source code isn't looking to attract sales dollars. So there's no push to make aggressive deadlines because of the commitment to the bottom line. When that happens, I believe that's when the buggy code gets released.
When you have closed source code, there's a finite number of individuals involved in the programming and they are being pushed by upper management to create so they can sell. There's a commitment to quality, but I'll tell you from a manufacturing background that when push gets to shove quality will take a backseat more often than not. Comparing to the open source community, closed source code only has users who have paid for the software and are expecting it to perform a certain way. There's no community trying to make things better, and when the code gets released to the public the parent company disbands the majority of the original group of developers to have them work on other projects.
So that's the schpeel. Long story short, the benefits of open source should outweigh the liability of allowing everyone access to the raw code.