, SecurityFocus 2000-04-17
Is Open Source really more secure than closed? Elias Levy says there's a little security in obscurity.
Expand all |
Post comment
Netscape developers are weenies!
2000-04-17
Anonymous (2 replies)
Anonymous (2 replies)
Bug *fixes*...?
2000-04-17
Anonymous (2 replies)
Anonymous (2 replies)
Examine the record...
2000-04-17
Anonymous (1 replies)
Anonymous (1 replies)
Comparing Apache and IIS is wrong
2000-04-17
Anonymous (2 replies)
Anonymous (2 replies)
You've made several critical mistakes in your comment.
2000-04-17
Bruce Perens <bruce (at) perens (dot) com [email concealed]> (3 replies)
Bruce Perens <bruce (at) perens (dot) com [email concealed]> (3 replies)
Sorry about the bad formatting.
2000-04-17
Bruce Perens <bruce (at) perens (dot) com [email concealed]>
Bruce Perens <bruce (at) perens (dot) com [email concealed]>
Re: Bruce Parens' Defense of Open Source
2000-04-17
David Terrell <dbt (at) meat (dot) net [email concealed]> (2 replies)
David Terrell <dbt (at) meat (dot) net [email concealed]> (2 replies)
How to respond to past reports of vulnerability
2000-04-17
Bruce Perens <bruce (at) perens (dot) com [email concealed]> (1 replies)
Bruce Perens <bruce (at) perens (dot) com [email concealed]> (1 replies)
Re: How to respond to past reports of vulnerability
2000-04-18
David Terrell <dbt (at) meat (dot) net [email concealed]> (1 replies)
David Terrell <dbt (at) meat (dot) net [email concealed]> (1 replies)
I don't think you get what he's talking about, Dave...
2000-04-19
Barry Fitzgerald <reaperx1 (at) netscape (dot) net [email concealed]> (1 replies)
Barry Fitzgerald <reaperx1 (at) netscape (dot) net [email concealed]> (1 replies)
Thanks for the additional info but...
2000-04-17
Anonymous (1 replies)
Anonymous (1 replies)
Trust-worthyness and ability to spot bugs
2000-04-17
Bruce Perens <bruce (at) perens (dot) com [email concealed]>
Bruce Perens <bruce (at) perens (dot) com [email concealed]>
Skill is always at a premium
2000-04-17
Christopher Petrilli <petrilli (at) amber (dot) org [email concealed]> (1 replies)
Christopher Petrilli <petrilli (at) amber (dot) org [email concealed]> (1 replies)
Who found the sendmail bug?
2000-04-17
Brett <disfunct (at) radiusnet (dot) net [email concealed]> (1 replies)
Brett <disfunct (at) radiusnet (dot) net [email concealed]> (1 replies)
Morris didn't find the Sendmail bug
2000-04-20
Rick Smith <rick_smith (at) securecomputing (dot) com [email concealed]>
Rick Smith <rick_smith (at) securecomputing (dot) com [email concealed]>
to expand on what i said earlier.
2000-04-17
Brett <disfunct (at) radiusnet (dot) net [email concealed]>
Brett <disfunct (at) radiusnet (dot) net [email concealed]>
So what you're saying is that open source software is often as insecure as closed-source software is most of the time.
2000-04-18
Anonymous
Anonymous
Correct the facts and the conclusions stand strong
2000-04-21
Rick Smith <rick_smith (at) securecomputing (dot) com [email concealed]>
Rick Smith <rick_smith (at) securecomputing (dot) com [email concealed]>
Original Bugtraq mailing list description?
2000-04-21
Robert Quinn <rquinn (at) pobox (dot) com [email concealed]>
Robert Quinn <rquinn (at) pobox (dot) com [email concealed]>
No, but using the update utilities will help...and people who require security quickly *CAN* get the fixes...
"Do you think RedHat releases security advisories as fast as patches are posted to bugtraq?"
Of course not...that would be like driving south and hitting florida before you hit virginia (when driving from New York)...it would be physically impossible...
in any case, the average user probably wouldn't need the fix until it's posted, in any case Red Hat is usually pretty quick with posting a fix...
"And this ignores the number of people who don't even know that security problems with Linux exist, because they've been brainwashed by Linux bigots into not thinking it's a problem."
I don't know anyone who says that Linux has no security holes...Open Source helps with fixing security holes which produces fewer security holes, it doesn't make it completely devoid of bugs and holes...
Again, I don't know anyone who says that Linux is completely invulnerable, are you sure you aren't making these people up?
"_And_ those bugs are only fixed AFTER the problem has become commonly known. You wouldn't believe how long attacks like the NFS mountd remote root overflow circulated in underground circles before it was publicly acknowledged (on bugtraq) and fixed."
Not always...back a few years ago, I can remember working with HPACV groups to fix holes in their own servers (which were Linux, slackware IIRC)...when those holes were fixed, they were released...
the fact is I don't think you know who is supplying the fix, all that matters is that the good guys are reviewing them (and they are)...
"This isn't to say that "Open Source" doesn't work. Go read the OpenBSD errata pages and look for the last remote root overflow.
Without strong, proactive security auditing, users are at risk ever day."
Well, DUH!
this is true with every single system and every single instance...
The fact is that closed source inhibits strong proactive security auditing and Open Source enables it...
[ reply ]
Link to this comment: http://www.securityfocus.com/comments/articles/19/1443#1443