When you read about the security problems of some open source applications and operating systems, some of you have nodded approvingly, and muttered words that sound a lot like "I told you so." Let's face it, all the smugness about the superiority of open source code has been pretty hard to take.
Of course, the open source people claim that such charges simply aren't true. They say open source products are better because more people work on them and then distribute the patches--meaning that security holes get fixed right away. Microsoft, as the leading vendor of proprietary software, claims the same thing.
The fact is, both sides have their share of problems--but neither side has the edge when it comes to fixing security holes. You're just as likely to encounter a security problem with open source code as you are with Microsoft Windows, and the fix is just as likely to appear quickly and be done properly.
Normally, this is the point where Microsoft gets trashed for its seemingly endless list of security patches for Windows. That's not going to happen here. Yes, Microsoft does have a long list of security issues for which it has issued patches. But the fact that those patches exist means somebody in Microsoft is making sure those fixes are made.
According to Steve Lipner, Microsoft's Director of Security Assurance, the company's Security Response Team operates seven days a week and has been known to issue patches toWindows security within hours of finding out about a problem. This sounds pretty responsive to me, certainly as responsive as the open-source solution to fixes--hoping someone steps up to the plate, creates a fix, and makes it available.
The problems with security are not greater or fewer with Microsoft's code versus open source. They're just different. Want another opinion? In the FBI's ongoing list of the top 20 security problems, the number of Windows and open-source problems are about equal. The bottom line is that you should choose your OS or Web server software by how well it meets your needs--because these days, security really isn't the differentiating factor.
Which do you trust most when it comes to open-source security: open source, proprietary, or both equally? Tell me what you think in TalkBack.
Wayne Rash runs a product testing lab near Washington, DC. He's been involved with secure networking for 20 years and is the author of four books on networking topics.
Linux vs Windows 2000 Security Alert Comparison
We've had this discussion before...
I'll just re-iterate something that has been bounced around on previous occasions.
http://www.cyber.com.au/users/conz/linux_vs_windows_security_alert_comparison.html
which states:
There has been much discussion about the security vulnerability rates
between Windows and Linux. Firstly, let me state that this focus on pure
numbers and graph plots of vulnerabilities is pointless. There is no such
thing as a truly secure operating system, there is only the
ongoing
process of keeping a host or network secure. One can never achieve a state
of 'security Nirvana'. Think of it as a treadmill, constantly moving you
(as a system administrator) backwards. You have to 'walk' forward just
to keep still. If you don't move forward with security patches, security
tools, revamped system security processes, you'll be flung off the end
of the treadmill from sheer inactivity, and by the way, the crackers have
access to the treadmill's speed control knob, and keep pushing up the speed.
As an ancillary, all operating systems can be made 'secure', by whatever
reckoning you attribute to this term. It all boils down to time, effort,
money and will. What is security worth to you and your network? Some operating
systems seem to need more of these, some less. They all need some.
The Open Source community has made much of the 'with enough eyeballs,
all bugs are shallow' concept; that by using enough technical users, some
or many security concerns can be overcome. I am a believer of this epithet,
however, think about it for a second: 'with enough eyeballs, all bugs are
shallow'. What this is saying, in effect, that when a bug becomes an issue, many people have the source code, and it can be quickly resolved. To paraphrase,
when we get hit by a bug, we can swat it quickly and without waiting for
a vendor. I believe that for widely used free software projects, this too
is true. There is one important proviso to this train-of-thought to keep
in mind though, which makes exploitable security bugs a slightly different
beastie to general-purpose bugs. A general bug which hits an individual
user or site, gets reported to the maintainers and gets resolved, generally
doesn't have the same possible impact as a security bug, particularly a
remotely exploitable one. A general bug (if catastrophic enough) can cause
loss of data or system un-availability, but a security bug can cause your
system to become 'owned' by a cracker, for you to lose data through deletion,
have data sent to your competitors or leaked to the trade press, have invalid
data inserted into your records, have customer credit cards stolen etc
etc. Further, vulnerabilities become known and spread on back-room IRC
channels like wildfire. While a general bug may be encountered by you and
a few others over the course of a segment of time; a remotely exploitable
vulnerability has the attribute of attracting penetrative tests against
tens of thousands of hosts in a matter of hours of discovery, causing far
more damage and strife than a general bug. Finally, catastrophic general
bugs which affect many are few and far between (unless you include various
Microsoft Service Packs), as most people do not tread the bleeding edge
of operating system releases, and widely used systems and sub-system software
generally doesn't harbour catastrophic general bugs for long. Security vulnerabilities, however, can arise in code or a subsystem which is widespread
and very well entrenched, further accentuating the possible spread of damage.
In summary, the dues-ex-machina of 'with enough eyeballs, all bugs are
shallow' holds, but possibly only after substantial damage has been done
to many hosts on many networks. At least we know that if it's important
for users of the said sub-system, the security problem will be resolved
at the source-level, a surety we don't have wi