Study: Open source poses security risks

A conservative US think tank suggests in an upcoming report that open-source software is inherently less secure than proprietary software.

The white paper, Opening the Open Source Debate, from the Alexis de Tocqueville Institution (ADTI) will suggest that open source opens the gates to hackers and terrorists.

"Terrorists trying to hack or disrupt US computer networks might find it easier if the federal government attempts to switch to 'open source' as some groups propose," ADTI said in a statement released ahead of the report.

Open-source software is freely available for distribution and modification, as long as the modified software is itself available under open-source terms. The Linux operating system is the best-known example of open source, having become popular in the Web server market because of its stability and low cost.

Many researchers have also suggested that since a large community contributes to and scrutinises open-source code, security holes are less likely to occur than in proprietary software, and can be caught and fixed more quickly.

The ADTI white paper, to be released next week, will take the opposite line, outlining "how open source might facilitate efforts to disrupt or sabotage electronic commerce, air traffic control or even sensitive surveillance systems," the institute said.

"Computer systems are the backbone to U.S. national security," said ADTI Chairman Gregory Fossedal. "Before the Pentagon and other federal agencies make uninformed decisions to alter the very foundation of computer security, they should study the potential consequences carefully."

Like this article? Click below to send it to your mobile for free!

Talkback 2 comments

  1. The Alexis de Tocqueville Institution has a reputation for their knowledge of computer security issues? Well, no, they actually appear to be a shill for large corporates and for Microsoft in particular - witness a whole page of PR about MCSE training. Anonymous -- 04/06/02

    The Alexis de Tocqueville Institution has a reputation for their knowledge of computer security issues? Well, no, they actually appear to be a shill for large corporates and for Microsoft in particular - witness a whole page of PR about MCSE training.

    Frankly, I don't see why ZDnet bothers reporting this kind of junk.

  2. They're absolutely right Anonymous -- 28/08/08

    At the BlackHat 2008 conference, a presenter
    showed how a perusal of Xen's source demonstrated a simple buffer overflow in, of all places, the security code. A user in a non-privileged domain was shown to have the power to corrupt Xen's heap and gain control over the system. If the developer had not been able to see the source code, the problem would not have been obvious or apparent.

Add your opinion


Latest Videos

Sponsored content

Power Centre - Content from our premier sponsors

Blogs

  • Renai LeMay Australian Govt funds IT start-ups
    This week Australia's Federal Government announced it had allocated $3.6 million in funding to 57 local research projects so that they could be commercialised, with many of them being web or IT-related start-ups.
  • Array Google should come clean on datacentres
    It's nice that Google says it has put an effort into making its datacentres more energy efficient, but the search giant's pledges won't mean much until it discloses just how many of the beasties it's actually running.
  • Array US shows what OPEL could have been
    Sprint's WiMAX roll-out in Baltimore will prove the Australian government's decision to worm its way out of the Opel WiMAX contract was a short-sighted, and ultimately damaging, political stunt that has benefited nobody.
  • More blogs »

Tags

Back to top

Featured