While Open Source has many benefits, I believe the most over-sold yet empirically unproven one is improved security. Given the sheer amount of eyes inspecting current code, vulnerabilities should be getting zapped as quickly as they appear, yet many go undetected for a while. The reason they go undetected is for the very reason outlined in article: the geometric growth in interface combinations is the contributing factor. The likelihood of Open Source 'reviewers' independently evaluating separate feature combinations and associated security consequences is a lot less than envisioning a few aggressively analyzing the code, following similar evaluation methodologies, with the silent majority trailing along.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/80/3298#3298