Let's look at a couple of apps with roughly the same functionality and see whether this theory holds.

Apache, the open-source web server which has over 60% of the website market according to Netcraft (http://www.netcraft.com/survey) has its last security advisory with a critical upgrade in August, 1998.

Internet Information Server (IIS), the Microsoft counterpart, has had one about every three months which results in a critical upgrade/patch. Furthermore, MS was recently (few days ago) forced to admit the existence of a back door password planted by MS employees which allowed access to configuration files.

The article makes a valid point, that someone must be auditing the code for open source to be more secure. In theory, open-source can give "black hats" access to holes allowing them to compromise systems. But in practice, closed source has at least as many holes which are not hard to find and exploit, and can much more easily hide backdoors. Whom do you trust?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/19/1385#1385