Open-Source Security Comes Under Fire

eWeek ^ | November 22, 2002 | Dennis Fisher

[Bush2000]

Thanks to several high-profile vulnerabilities and an overall increase in the number of flaws, open-source software has taken over Microsoft Corp.'s position at the bottom of the security heap. A recent research note from two analysts at the Aberdeen Group calls open-source software and Linux distributions the "2002 poster children for security problems." Of the 29 advisories issued through October by the CERT Coordination Center at Carnegie Mellon University in Pittsburgh, 16 of them addressed vulnerabilities in open-source or Linux products.

[Bush2000]

ABMers, your emperor is wearing no clothes. Enjoy.

[isthisnickcool]

I knew this was our post before I clicked on it. I can't seem to find anything in this post related to the purpose of this site: "We're working to roll back decades of governmental largesse, to root out political fraud and corruption, and to champion causes which further conservatism in America. And we always have fun doing it. Hoo-yah!"

But, none of you posts ever seem to have anything to do with the purpose of this site.

The only reason you post these types of articles is to start conflicts here. You "troll" here on FreeRepublic, as you told me in one Freepmail recently.

NOTE: B2K only posts items like these to bring out other Freepers that he can argue with over his oddball and rather strange fixation on most anything non-Microsoft. Usually Linux. As in this case.

[Lorenb420]

ABMers, your emperor is wearing no clothes. Enjoy.

I'm hardly ABM, but who was the company that just had a problem with 'Data Access Components', where part of the 'solution' to the problem is to:

What steps could I follow to prevent the control from being silently re-introduced onto my system?

"The simplest way is to make sure you have no trusted publishers, including Microsoft"

See the MS02-065 security bulletin.

What happened to 'Trusted Computing'?

People; glass houses; just saying.

[TomServo]

Tee hee.....

[babygene]

A possible reason for this is that virtualy all of the routers and other front end products that bare the brunt of an atack, all run linux. None of them run microsoft. Most of these devices are shipped with an embeded OS and are never updated.

From my experience, if you put a windows box directly on the internet through a dial up connection or a cable connection, it will not only be infected within an hour but it will be participating in the atack of other machines within an hour.

[The Duke]

Now, if Bill Gates could just stop boring us to death
with an endless parade of buttons and boxes , maybe he'd
have something!

[HamiltonJay]

Of the 29 advisories issued through October by the CERT Coordination Center at Carnegie Mellon University in Pittsburgh, 16 of them addressed vulnerabilities in open-source or Linux products.

While this is true of CERT alerts, MS itself has issued itself I believe 35 Security alerts this year alone on its products, let alone the CERT alerts. While no software is invulnerable, I think this article is a little misleading.

[Bush2000]

I think this article is my comments are a little misleading.

Fixed it for you.

[HamiltonJay]

Keep up the good fight Bush... I know dancing Steve appreciates it.

[taxcontrol]

Ok guys - what is up with this article? You see, I actually WENT to the CERT site (www.cert.org/advisories/) to check on the vulnerabilities listed.

Looking at the 2002 list, I found:

Company/program (# of vulnerabilities)
Microsoft (5)

The next most common were:
CDE (3)
OpenSSL / OpenSSH (4)

How many did I find for Linux? NONE!
Also, if you actually READ into the Microsoft vulnerabilities, there are 16!!! not 5. You see, some of the vulnerabilities are so bad, they are simply listed as "mulitple vulnerabilites in ...."

I wonder of the author actually did any research? From the looks of it - no. But please, don't take my word for it. Go to the site and check it out for yourself.

[hchutch]

Gee, putting my source code out for all to see...

That is just about as smart as playing catch with nitroglycerine.

[ShadowAce]

Gee, putting my source code out for all to see...

That is just about as smart as playing catch with nitroglycerine.

Why? Is your code that bad?

[hchutch]

It doesn't matter how good or bad my code is - if it's out there, someone will find a way to mess it up.

The honest folks will advise me of that - but the nasty ones - the cybercriminals who make viruses, won't. Instead, they'll write stuff that will cause a royal mess.

[Bush2000]

I wonder of the author actually did any research? From the looks of it - no. But please, don't take my word for it. Go to the site and check it out for yourself.

The article is referring to components which ship with common Linux distributions. Look, every time Linux advocates want to sell your OS, you point to the components (Apache, etc) and talk about the value proposition. But when bugs are found in those components, you disclaim them as "not part of Linux". Sorry, but you can't have it both ways. The article is dead-on.

[taxcontrol]

You know what, OpenSSL/OpenSSH can be installed for Windows as well. Should we count their vulnerabilities towards Windows as well?

[babygene]

"Should we count their vulnerabilities towards Windows as well?"

Good point...

[TechJunkYard]

I think this article is a little misleading.

A little misleading? The "report" only cites the CERT advisories and doesn't even mention Bugtraq. The authors are a former "senior product marketing manager with a major systems supplier" and a former business/marketing consultant... neither with any systems security experience outside of Aberdeen.

This "report" is about worth the paper it's printed on.

[Bush2000]

You know what, OpenSSL/OpenSSH can be installed for Windows as well. Should we count their vulnerabilities towards Windows as well?

OpenSSL/OpenSSH don't ship with Windows. But they DO ship with Red Hat Linux. Any more softballs? I've got a bat ready.

[Bush2000]

A little misleading? The "report" only cites the CERT advisories...

So what. The CERT advisories are a metric. And by that standard, it's readily provable that open source isn't any more secure than closed source.

This "report" is about worth the paper it's printed on.

Neither is your post.