You wrote:

When the security company Trusted Information Systems (TIS) began making the source code of their Gauntlet firewall available to their customers many years ago, they believed that their clients would check for themselves how secure the product was. What they found instead was that very few people outside of TIS ever sent in feedback, bug reports

or vulnerabilities. Nobody, it seems, is reading the source.

So what ?

Why should someone read their source ? E.g. in Linux well documented and tested firewalls come free with the kernel.

You wrote:

But how many users of open source software compile all of their applications from source?

Enough. When a problem arises, usually a fix is posted by somebody to the relevant email lists or news services within days or even hours.

Sure there is no guaranty that Open Source has a higher level of security. But the statistical probability is significantly higher, especially for important projects. Like ESR said: Given enough eyeballs, all bugs are shallow.

OK, SecureShell may have seventy-one thousand lines of code. But there is no need that everybody understands or reads everything. Somebody checks lines 1-4000, somebody else 7700-8000, and so on. You get the idea.

And folks like Linus Torvalds or Allan Cox see from 40,000 feet above when something "does not look right".

Keep :-)

Joerg

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/19/1379#1379