There are no phone numbers. Who do you go to ask for information? It's kind of hard to tell who these people are." > Pay them for support and get their numbers? Which closed source software company offered you support through phone when you didn't pay for support?
|
Does Verizon's Voyager stack up to the iPhone? |
|
|
5 IT skills that won't boost your salary 
[1,407]
Women 4 times more likely than men to cough up personal info [589]
Japan's 10 funniest tech-related commercials [Videos] [407]
Throwing away a promo CD is "unauthorized distribution"? [1,265]
Adults too quick to dismiss educational video games [682]
Attack of the iPhone clones [Slideshow] [578]
10 things IT needs to know about AJAX [1,258]
This Year's 25 Geekiest 25th Anniversaries [Slideshow] [409]
|
|
Open source software
Well, I have fix about 15 Window machines this weekend and 0 machines with open source.
That is why I love windows, it gives me work to do.
best security practices...
Now it all depends how Fortify defines "best security practices"
Each and every open source software carries a file often the name of the file is "LEAGAL" states ...
"All source code, binaries, documentation, information, and other files contained in this distribution are provided AS IS with NO WARRANTY OF ANY KIND, INCLUDING THE WARRANTY OF DESIGN, MERCHANTABILITY, AND FITNESS FOR A PARTICULAR PURPOSE."
Now isn't it a "best/better/excellent" security practice to WARN a user?
FUD, Stupidity
Well, certainly Fortify (whatever) has all interest in disseminating FUD, so they can make some money.
Now, there is also the possibility that the "study" has been paid for by - who else? - Microsoft. Remember those fake benchmarks pitching Windows x Linux, that Microsoft sponsored? Yeah...
And, of course, Windows & company do have a record for security, right? A *negative* record, but still a record...
Open source, open sore
Nothing is free. The idea of free software being worth something was cultivated by geeks. Geek knowledge is like currency. They trade on it to garner more power and money. As for the real value of open source, it's about equal to doing nothing.
FUD? no... sorry
Honestly I don't think this is FUD, or Fortify selling anything (they sell the tools that eval security in code). I think this is reality - but a reality some companies choose willingly.
There is a tradeoff when you purchase tools versus download and use open-source. Open source is typically free but comes with a price tag of a different sort - support. There isn't as much of a development effort, adherence to standards, or technical support in free software... but then there also isn't the massive price tag.
As a business, you choose.
Bad Conclusions
I sense a hidden agenda here. First of all, you can't evaluate such a narrow range of software (clearly the study focused on a small number of prominent open-source application servers and content management systems) and then turn around and say 'open source software is a security risk'. That's sensationalism at its worst. Even assuming the results of the study are unbiased and accurate, the most that should be claimed is that current open-source offerings in application server/content management have shortcomings in security and customer support. I have my doubts about even those conclusions.
Second, the implication is that closed-source products fair better, but there is no control group here. Perhaps there is a general security concern in the application server category? We'll never know, of course, because the study and article are too busy furthering their agenda that open-source represents an enterprise risk.
So, should we just trust closed source?
After the NSA-key hidden in Windows, and some reports of Vista "calling home" every now and then, I don't think closed-source is any more secure than open-source.
With open-source you can at least see what is happening. And, if the "community" doesn't react as quickly as you'd want, you can many times patch it yourself. Not so with closed-source.
That's a pathetic situation. Whoever is behind that report - and similar ones - has money, not security, in their mind.
Big numbers. Too big, actually.
"Fortify identified a total of 22,826 cross-site scripting and 15,612 SQL injection issues associated with multiple versions of the 11 open source software packages examined."
Wow! That's a lot!
I smell something fishy here.
Anyway, somebody said that "statistics are the art of lying with numbers".
It is just that some lies are better told than others.
I agree about surveys, but this is a study...
I am the first one to point out that surveys are trash; the numbers can be skewed to whatever the intended agenda is. With that said, this was a study, not a survey. Conducted over three months with people actually interacting with the "support sites" for the open source software they were studying. I agree Fortify Software has something to gain with the release of this article, but I think they have a very valid point. The cost is going to come in at some point, with open source software it is with the maintenance part of the software development life cycle. It will likely be a hefty cost for a corporation using open source software as they need to adhere to standards, both internal and government regulations. This is just my two cents worth.
Survey, study, who cares? It's based on false assumptions.
It doesn't matter whether you call it a "study" or a
"survey", if it's depending on being able to speak to people on the phone it's worthless, because that is not the most efficient way to communicate with developers *whether at an open source project or not*. I'll bet that they never spoke to the developers at the projects that did have a corporate structure, either... well, you know, the developers are all you get.
As for costs, the costs of dealing with software problems (whether security related or not) are orders of magnitude less with open source projects. A lot of the time you can include a patch to fix the problem with the problem report, and you don't have to spend expensive "phone tag time" communicating with them: that "talking to someone on the phone" part is a COST, not a BENEFIT. AND you can actually fix them, if the project doesn't. I've got open problems with Microsoft that are over 10 years old, that they STILL haven't fixed, that they will NEVER fix.
Post new comment