Is Open Source Software really better?
There are a lot of internet articles and computer geeks advocating the use of open source software as being the best way for everyone to go for their software needs. Source code that is open to everyone allows a lot of eyes to find the problems and fix them – but is this really true? or just hype?
I think it is mostly hype. I agree that open source software allows more eyes to see the code, but I think the eyes that are fervently looking for the exploits (for free – since they aren’t getting paid) aren’t doing so to patch the problems, but are doing so to find the problems so they can exploit them just like the hackers do for paid software. The one big difference so far is that free software doesn’t have the mass market penetration yet that would allow the hacker to make the most out of the effort they expend. In other words, if you were going to spend time to find a problem in software that you could then exploits for cash, you’re going to be investing this time in the software that is on 90% of the machines out there. Not the ones that are on 5% like linux. This is why we haven’t seen a lot of news articles about free software vulnerabilities that are found – but they are out there... Here is an article from TechWeb talking about a major flaw with Firefox (interesting why this wasn’t front page news?) Even more interesting is that the flaw is in all browsers except Microsoft’s IE: http://www.techweb.com/wire/security/59301618
As a matter of fact, Computer Weekly reported just a few weeks ago that there have been more security flaws found with Firefox this year than have been found with IE. The report in the UK-based IT trade publication states: "There have now been more flaws in the Firefox browser this year than in Microsoft's Internet Explorer." The 2005 Secunia vulnerability report for Firefox 1.x states that there have been seventeen security flaws in Firefox this year, while the 2005 Secunia vulnerability report for Internet Explorer 6.x includes only nine advisories.
I think it is mostly hype. I agree that open source software allows more eyes to see the code, but I think the eyes that are fervently looking for the exploits (for free – since they aren’t getting paid) aren’t doing so to patch the problems, but are doing so to find the problems so they can exploit them just like the hackers do for paid software. The one big difference so far is that free software doesn’t have the mass market penetration yet that would allow the hacker to make the most out of the effort they expend. In other words, if you were going to spend time to find a problem in software that you could then exploits for cash, you’re going to be investing this time in the software that is on 90% of the machines out there. Not the ones that are on 5% like linux. This is why we haven’t seen a lot of news articles about free software vulnerabilities that are found – but they are out there... Here is an article from TechWeb talking about a major flaw with Firefox (interesting why this wasn’t front page news?) Even more interesting is that the flaw is in all browsers except Microsoft’s IE: http://www.techweb.com/wire/security/59301618
As a matter of fact, Computer Weekly reported just a few weeks ago that there have been more security flaws found with Firefox this year than have been found with IE. The report in the UK-based IT trade publication states: "There have now been more flaws in the Firefox browser this year than in Microsoft's Internet Explorer." The 2005 Secunia vulnerability report for Firefox 1.x states that there have been seventeen security flaws in Firefox this year, while the 2005 Secunia vulnerability report for Internet Explorer 6.x includes only nine advisories.
posted by mkelley at
3:45 PM
1 Comments:
I think the open source security issue is an interesting one. IE has had its share of security issues and the government has advised against using it- http://www.internetnews.com/security/article.php/3374931. So, this is a moving target and I think both sides are vulnerable- in different ways.
By
Sandeep Krishnamurthy, at 8:01 PM
Post a Comment
<< Home