>You can not compare them. Apache is a webserver. IIS is a

>webserver with a whole crapload of other junk around.

Actually, I think that this observation merely reinforces the validity of the contention that open source software is generally inherently more secure. Why is there a whole bunch of crap force-bundled with IIS? Because the market mechanisms that sustain closed source programming also favour the tying and integration of unrelated components against the dictates of good engineering sense. This makes it harder for others to interoperate with you, reverse engineer you, and replace you, even in the partial extent that a new entrant could hope to achieve.

>Apache is minimal on purpose.

That's right. There are no such market pressures exerted by the legal constructions around open source; the GPL, etc. are specifically built to avoid these distortions. Because of this, open source software is most useful to other programmers, that is, is most used in final open source software, when the code is decoupled into well-engineered components whose intent is easy to understand and verify. Therefore, open source software has fewer security holes, and they are easy to spot and fix for the brief time that they exist.

Cheers,

David Ballantyne

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/19/1430#1430