Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

Study: Open source poses security risks
ZDNet ^ | May 31, 2002, 9:30 AM PT | Matthew Broersma

Posted on 05/31/2002 3:15:28 PM PDT by Bush2000

A conservative U.S. think tank suggests in an upcoming report that open-source software is inherently less secure than proprietary software, and warns governments against relying on it for national security.

The white paper, Opening the Open Source Debate, from the Alexis de Tocqueville Institution (ADTI) will suggest that open source opens the gates to hackers and terrorists.

"Terrorists trying to hack or disrupt U.S. computer networks might find it easier if the federal government attempts to switch to 'open source' as some groups propose," ADTI said in a statement released ahead of the report.

Open-source software is freely available for distribution and modification, as long as the modified software is itself available under open-source terms. The Linux operating system is the best-known example of open source, having become popular in the Web server market because of its stability and low cost.

Many researchers have also suggested that since a large community contributes to and scrutinizes open-source code, security holes are less likely to occur than in proprietary software, and can be caught and fixed more quickly.

The ADTI white paper, to be released next week, will take the opposite line, outlining "how open source might facilitate efforts to disrupt or sabotage electronic commerce, air traffic control or even sensitive surveillance systems," the institute said.

"Computer systems are the backbone to U.S. national security," said ADTI Chairman Gregory Fossedal. "Before the Pentagon and other federal agencies make uninformed decisions to alter the very foundation of computer security, they should study the potential consequences carefully."


TOPICS: Business/Economy; Technical
KEYWORDS: opensource
Navigation: use the links below to view more comments.
first 1-2021-4041-6061-80 ... 161-178 next last
This should be fun...

but before you post "this study was bought and paid for by Microsoft", try providing some references ...

or be prepared to be labelled an idiot.
1 posted on 05/31/2002 3:15:28 PM PDT by Bush2000
[ Post Reply | Private Reply | View Replies]

To: Bush2000
Bush2000..... Reports and decides! LOL!

You Go Girlfriend!
2 posted on 05/31/2002 3:21:36 PM PDT by cmsgop
[ Post Reply | Private Reply | To 1 | View Replies]

To: Bush2000
but before you post "this study was bought and paid for by Microsoft", try providing some references ... or be prepared to be labelled an idiot.

Um, shouldn't one be labelled an "idiot" for assuming it was not bought and paid for or otherwise influenced? That's what these think tanks mostly exist for. So your statement about references is not well taken.

BTW, plug in the name of the "Institution" and "Microsoft" into a web search engine. Hundreds of hits - many of which deal with some paper the "Institution" created "proving" how Microsoft's training programs and degrees are better than others. A favorite topic of Alexis D.T., no doubt. < /sarcasm>

3 posted on 05/31/2002 3:30:26 PM PDT by Shermy
[ Post Reply | Private Reply | To 1 | View Replies]

To: Bush2000
Propriatary software can be disassembled.

Security by obscurity has not worked. But nothing else has yet.

Solaris, HPUX, FreeBSD, Linux, NT, XP etc all have exploitable flaws. All non-trivial code will.

When the feature set settles down it might be possible to reach a state of reasonable security by using time/hacker tested OSs. For now all you can do is keep up your patches and run a heterogenius network (so one flaw will not take the whole thing down).

I quote:

Diversity:

Replacing a position because some guy back in '83 decided to use the odd-ball programming language : $120k

Maintaining 17 different operating system at once : $225k

Answering calls from 200 end users with slightly different desktops : $57k

Having your entire network, the networks of all your end users, and your entire array of backup systems turned into incomprehensible mush overnight due to an advanced virus that could easily target and replicate in your undiversified computer systems : Priceless

And yes this study was paid for by the propriatary OS vendors.

4 posted on 05/31/2002 3:31:02 PM PDT by Dinsdale
[ Post Reply | Private Reply | To 1 | View Replies]

To: Bush2000
Terrorists trying to hack or disrupt U.S. computer networks might find it easier if the federal government attempts to switch to 'open source' as some groups propose

wow, it might? so it follows that it might not.

after they release the white paper, there might be enough details to discuss. then again, maybe not.

5 posted on 05/31/2002 3:31:14 PM PDT by danelectro
[ Post Reply | Private Reply | To 1 | View Replies]

To: Shermy
Um, shouldn't one be labelled an "idiot" for assuming it was not bought and paid for or otherwise influenced?

Do yourself and others a favor: Don't attempt to work in any job that requires logical reasoning.
6 posted on 05/31/2002 3:39:50 PM PDT by Bush2000
[ Post Reply | Private Reply | To 3 | View Replies]

To: Dinsdale
And yes this study was paid for by the propriatary OS vendors.

Prove it ... idiot. /sarcasm
7 posted on 05/31/2002 3:41:18 PM PDT by Bush2000
[ Post Reply | Private Reply | To 4 | View Replies]

To: Bush2000
Do yourself and others a favor: Don't attempt to work in any job that requires logical reasoning.

Touchy, aren't you? Did you try out the web search yet, or are you just a paid poster spamming disinfo and testing the waters?

8 posted on 05/31/2002 3:46:53 PM PDT by Shermy
[ Post Reply | Private Reply | To 6 | View Replies]

To: danelectro
Terrorists trying to hack or disrupt U.S. computer networks might find it easier if the federal government attempts to switch to 'open source' as some groups propose

wow, it might? so it follows that it might not.

after they release the white paper, there might be enough details to discuss. then again, maybe not.

It's intuitively obvious. Open source for a hacker / terrorist is analogous to having the blueprints for Fort Knox, the US attack plan for Iraq, or the schematics on how our missile targeting systems work. Yes, as someone posted above, it can be decompiled and deduced. But that's a pretty tedious and difficult process. You can also deduce our missile targeting systems with adequate access and time.

9 posted on 05/31/2002 3:47:12 PM PDT by gitmo
[ Post Reply | Private Reply | To 5 | View Replies]

To: Bush2000
Hmmm ... this has very much the feel to me of the liberal vs. conservative discussions I see.

My initial reaction to Clinton-supporting liberals who deny any liberal bias in the main stream media is a bit of angry frustration and then wondering how and why any otherwise apparently mentally competent person would continue to so delude themselves so greviously. And my initial reaction to defensive Microsoft apologizers, among whom I include the otherwise good Mr. Bush2000, is almost identical.

But then my reactions diverge. In the case of Liberals, I see that they have been a major scourge for at least the last couple of centuries, and I feel compelled to continue trying to make sense of this failing of the human condition.

In the case of Microsoft ... oh well ... their time will come ... the wheels of justice may grind slowly, but they grind exceedingly fine.

That's a nice boat you've got (on your FR homepage), Mr Bush2000. Is that Seattle in the background? I take it that Microsoft has been good to you. Congratulations on your good fortune.

10 posted on 05/31/2002 3:58:11 PM PDT by ThePythonicCow
[ Post Reply | Private Reply | To 1 | View Replies]

To: Shermy
Touchy, aren't you? Did you try out the web search yet, or are you just a paid poster spamming disinfo and testing the waters?

Sorry, bub. Debate doesn't work that way. You make an assertion, you prove it. I don't do your research for you.
11 posted on 05/31/2002 4:01:22 PM PDT by Bush2000
[ Post Reply | Private Reply | To 8 | View Replies]

To: ThePythonicCow
That's a nice boat you've got (on your FR homepage), Mr Bush2000. Is that Seattle in the background? I take it that Microsoft has been good to you. Congratulations on your good fortune

A. It's not my boat. I rented it for a day.
B. It's Miami Beach, not Seattle.
C. Stuff your congratulations.
12 posted on 05/31/2002 4:03:12 PM PDT by Bush2000
[ Post Reply | Private Reply | To 10 | View Replies]

To: gitmo
You also don't the get programmer comments when you decompile/ deduce. Assuming the programmer actually commented his code (sometimes a big assumption) you get that in open source. Having done bug fixes on code by long gone programmers I know how much comments can help, easily a 50% reduction in "figure out how it doesn't work" (remember I was fixing bugs) time.
13 posted on 05/31/2002 4:04:50 PM PDT by discostu
[ Post Reply | Private Reply | To 9 | View Replies]

To: cmsgop
Bush2000..... Reports and decides! LOL! You Go Girlfriend!

:-p
14 posted on 05/31/2002 4:04:53 PM PDT by Bush2000
[ Post Reply | Private Reply | To 2 | View Replies]

To: discostu
You also don't the get programmer comments when you decompile/ deduce...

Yep, and knowing the size of buffers and how they're parsed makes it that much easier to launch a buffer overrun attack on open source code...
15 posted on 05/31/2002 4:07:07 PM PDT by Bush2000
[ Post Reply | Private Reply | To 13 | View Replies]

To: Bush2000
I'm glad somebody is doing a paper on this. It's always made sense to me. I remember Mitnik's big obsession was always getting the source, now why in the world would a hacker want to get the source code? Maybe to figure out how the security is written?! Nah couldn't be.
16 posted on 05/31/2002 4:09:54 PM PDT by discostu
[ Post Reply | Private Reply | To 15 | View Replies]

To: discostu
You also don't the get programmer comments when you decompile/ deduce. Assuming the programmer actually commented his code (sometimes a big assumption) you get that in open source.

Having done bug fixes on code by long gone programmers I know how much comments can help, easily a 50% reduction in "figure out how it doesn't work" (remember I was fixing bugs) time.

Good point. You also don't get the technical documentation that is available for Unix.

I was in a meeting today discussing the Pros & Cons of NT/Win2000 vs. Unix. A techie stated the Microsoft platforms were more vulnerable to intrusion attempts. I had to think of all the Abbie Hoffman's hacker newsletters. These early hackers were all Unix people. They knew Unix inside and out and had the source and documentation to fully exploit it. Of course, their biggest targets at the time were IBM and AT&T.

17 posted on 05/31/2002 4:11:58 PM PDT by gitmo
[ Post Reply | Private Reply | To 13 | View Replies]

To: Bush2000; ThePythonicCow
Let me get this, you think your logical? Ad hominem and other defections seem to be your forte.
Touchy, aren't you? Did you try out the web search yet, or are you just a paid poster spamming disinfo and testing the waters?

Sorry, bub. Debate doesn't work that way. You make an assertion, you prove it. I don't do your research for you.

"Debate doesn't work that way... Hmmm, where you learn this? And why is this a debate? Aren't you curious to find out if your premises are correct? I understand that "debate" generally is not intended to promote understanding or discussion and examination, but dualities, often false, for advocating a position, the face of specific interests.

You intiated this thread with a demonstrative assertion. Yes, I do understand that in "debate" deflection and lying are acceptable, but some here don't want to sink to that level. We're here to learn.

Though I do enjoy your web page, it's fair game, you posted it. You have my vote for most narcissitic FR profile! A masterpiece in simplicity.

18 posted on 05/31/2002 4:16:43 PM PDT by Shermy
[ Post Reply | Private Reply | To 11 | View Replies]

To: gitmo
Now in open source's defense (just to show I play fair, there are people that think I'm an MS apologist and my answer is they aren't complaining about the right parts of MS) because it's open source it's a lot easier for the administrator to change his security and put his own stuff in there; and all the Unix dogs I know do just that. But out of the box I'd have to think that even though on a technical level Unix security is better than WinX security (it is, no way to dodge that) the fact that any geek in the world (including hackers) can DL the code that wrote that out of the box security (and install it and run it through a debugger... all without breaking a single law) has to be considered a big check in the minus column.
19 posted on 05/31/2002 4:17:33 PM PDT by discostu
[ Post Reply | Private Reply | To 17 | View Replies]

To: Bush2000
Just when it was getting boring around here. You had to go and post this. ;-)
20 posted on 05/31/2002 4:17:44 PM PDT by TomServo
[ Post Reply | Private Reply | To 1 | View Replies]


Navigation: use the links below to view more comments.
first 1-2021-4041-6061-80 ... 161-178 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson