I have to strongly disagree with a couple of statements

made in your article. Your estimation that in the time

someone audits one closed-source product he can audit

10 open-source programs is just a huge exagerration.

Looking for strcpy() or sprintf() or other 'notorious'

library calls is no harder in a compiled program than in

an open-source one. If you take into account that most

standard-library functions such as the ones mentioned above

are either automatically recognized by script-driven

disassemblers or automatically seen as they are imported

from dynamically loadable modules it becomes clear that

the techniques involved with auditing binary programs

are different, the level of difficulty is not much higher.

All in all there is really no difference between a closed-

source program and an open source one when coming to

auditing it, but when _fixing_ it, an open source program

can be easily fixed by even an average programmer temp-

orarily, while a compiled program has to be binary-patched

which is something far fewer people are capable of doing.

With response times of several weeks for many closed-source

vendors, one should think twice which product to choose.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/19/1383#1383