Re: Fwd: I don't beleive open source is always the answer

["David M. Wilson" <dw-securecoding.org () botanicus net>]

On Wed, Dec 10, 2003 at 09:21:18PM -0600, Joe Teff wrote:

> The argument that bugs are researched and fixed quicker for open source 
> is not completely true. They definitely are if one of the contributors is
> interested in that specific area. However, there is nothing compelling 
> anyone to fix a specific issue. If it is fixed, the fix occurs in one of 
> the builds. There is no back patching of supported versions.

That's a rather drastic generalisation, and one I would disagree with.
With open source software, who is actually responsible for fixing bugs
is not clear like it tends to be with commercial software. Take a look
at your favourite 'free' license, and notice the bit where it disclaims
any warranty.

The issue of who is responsible for securing the software should be
resolved before you start to use it. Many open source software projects
have a well defined policy for implementing security fixes in older
versions of their software, almost all Linux distributions have policy
to the same effect, or an internal team within your company might do the
patching.

The fact that software comes without a warranty is a given of the open
source movement.


> In order to get a fix as soon as possible, you also have to take many
> other changes that may or may not be complete, safe or tested. Waiting
> for a milestone build that is fairly stable and has sufficient use to
> shake out most of the bugs does not occur any more often than
> commercial releases from a vendor.

When I need a security fix, I type "apt-get upgrade". Debian is one of
the many Linux distributions that proactively backport security fixes. I
know "open source" != "Linux", but the point is that when I chose to use
open source software, I made provisions for getting at security fixes by
using Debian.


> The idea of taking the source and making your own change is also
> unrealistic. Since this list is all about security, I know everyone
> here would agree that any such change would require a great deal of
> testing. You've then just made the solution your own product to
> support.

Or you could submit it as a patch to the upstream project where peers
will review and integrate it into the mainstream project. The mere fact
that you suggest making any kind of change to the software yourself
implies you have to maintain it for life suggests to me that you don't
have a proper grasp on how most free software development actually
happens.

I'm already approaching "Linux whore" status with this reply, so I'm
going to stop short of recommending you a certain book which would
explain it all. I'm not a Linux whore, honest. :)


David.