Wide Open Source

Take a look at the same exploits found in packages such as PHP, MySQL, and Perl. With this "crapload" of packages you now have a comparable suite to IIS. IIS still falls short.

May as well be using SSL Apache too...

In either case I think the whole point is "Who are you going to trust?". The software anyone can review and find "bugs" in or the software only a selected few(and not necessarily any more trustworthy, which the account of the NS weenie incident shows) can review and find "bugs" in?

Wonder who found the MS backdoor first? Mr. "Black Hat" Anonymous or MS?

http://news.cnet.com/news/0-1003-200-1696137.html

Black Hat, White who knows. A security advisor aliased Rain Forest Puppy informed MS.

"A security consultant known as "Rain Forest Puppy" notified Microsoft about the problem in an email message yesterday morning at 9:53 a.m. after being contacted by an employee with Nashville,

Tenn.-based ClientLogic. " CNET April 14, 2000. Author: Joe Wilcox

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/19/1417#1417

Comparison of Apache and IIS is Dead On 2000-04-17
Anonymous (1 replies)

Right, no one really wants all those features... 2000-04-21
Anonymous

Path of the weak 2000-04-17
Anonymous

You've made several critical mistakes in your comment. 2000-04-17
Bruce Perens <bruce (at) perens (dot) com [email concealed]> (3 replies)

Sorry about the bad formatting. 2000-04-17
Bruce Perens <bruce (at) perens (dot) com [email concealed]>

Re: Bruce Parens' Defense of Open Source 2000-04-17
David Terrell <dbt (at) meat (dot) net [email concealed]> (2 replies)

How to respond to past reports of vulnerability 2000-04-17
Bruce Perens <bruce (at) perens (dot) com [email concealed]> (1 replies)

Re: How to respond to past reports of vulnerability 2000-04-18
David Terrell <dbt (at) meat (dot) net [email concealed]> (1 replies)

I don't think you get what he's talking about, Dave... 2000-04-19
Barry Fitzgerald <reaperx1 (at) netscape (dot) net [email concealed]> (1 replies)

I don't think you get what he's talking about, Dave... 2000-05-05
Anonymous

Indeed there are a lot of bugs 2000-04-18
Anonymous

Thanks for the additional info but... 2000-04-17
Anonymous (1 replies)

Trust-worthyness and ability to spot bugs 2000-04-17
Bruce Perens <bruce (at) perens (dot) com [email concealed]>

Open source is not written by 1 person. 2000-04-17
Anonymous

Skill is always at a premium 2000-04-17
Christopher Petrilli <petrilli (at) amber (dot) org [email concealed]> (1 replies)

Rigorous methodology 2000-04-17
Anonymous

Blackhat? 2000-04-17
batz <batsy (at) vapour (dot) net [email concealed]> (1 replies)

semantics 2000-04-17
Ryan Russell <ryan (at) securityfocus (dot) com [email concealed]>

Some good points... 2000-04-17
Anonymous

Open source as a democracy 2000-04-17
Anonymous (1 replies)

Politics are irrelevant 2000-04-17
Anonymous

This isn't OSS vs. CSS 2000-04-17
Anonymous

Finding holes in closed source isn't hard... 2000-04-17
Anonymous

bugs? yeah. fixes? right away 2000-04-17
Anonymous

Apples and Oranges 2000-04-17
Anonymous (2 replies)

re: Apples and Oranges 2000-04-17
Anonymous

NSA/Linux 2000-04-20
Anonymous

Blackhat, whitehat, whatever. 2000-04-17
Anonymous

Who found the sendmail bug? 2000-04-17
Brett <disfunct (at) radiusnet (dot) net [email concealed]> (1 replies)

Morris didn't find the Sendmail bug 2000-04-20
Rick Smith <rick_smith (at) securecomputing (dot) com [email concealed]>

to expand on what i said earlier. 2000-04-17
Brett <disfunct (at) radiusnet (dot) net [email concealed]>

Attitudes 2000-04-17
Anonymous

Rates of evolution 2000-04-17
Anonymous

just a few little things... 2000-04-17
Anonymous

a quick Summary and rant 2000-04-17
Anonymous

OSS vs closed 2000-04-17
Anonymous

Banks, The NSA, and US companies. 2000-04-18
Anonymous

Open source is not secure ONLY because it's open 2000-04-18
Anonymous (1 replies)

Open Source has nothing to do with security 2000-04-21
Anonymous

So what you're saying is that open source software is often as insecure as closed-source software is most of the time. 2000-04-18
Anonymous

Open source? Use real examples! 2000-04-18
Anonymous

Come on 2000-04-18
Anonymous

Correct the facts and the conclusions stand strong 2000-04-21
Rick Smith <rick_smith (at) securecomputing (dot) com [email concealed]>

Original Bugtraq mailing list description? 2000-04-21
Robert Quinn <rquinn (at) pobox (dot) com [email concealed]>

There's more to security than fixing bugs... 2000-05-17
Anonymous