Open source does not me more secure and I wish that the Linux/Unix apologists would stop saying that. Patches go out for Unix and Linux systems all the time. The key here is the vigilence and expertise of the engineer installing and supporting the system, not necessarily the OS itself.

What about the Sun OS that resets configurations to defaults when patches are applied...something I fight with the Unix folks where I work all the time.

In Open Source, while there is peer review, no company or organization can certify code unless they have their own cadre of programmers. Even if the code is proven faulty, what recourse do we have? Sue some 17-year old in California? The solution is then ONLY get code from a reputable vendor...then you commit yourself into paying for special services, which you are trying to avoid in the first place with Open Source and freely available software. At least with the commercial software angle, when there is bad code, there is someone to go after

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/82/12582#12582