• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Six Open Source Security Myths Debunked

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
ZDNet sat down with a security expert and discussed popular open source security myths. Good info to share with people that may not be up to speed on open source software.

Detractors of open source software often point to its broad developer base and open source code as a potential security risk. But that's not a fair assessment, according to Dr Ian Levy, technical director with the CESG, a department of the UK's GCHQ intelligence agency that advises UK government on IT security. Open source is no worse or better than proprietary software when it comes to security, according to Levy, who busted myths about open source security — and detailed its genuine security challenges.
Click to expand...
 
It handled many of the big questions well.

I liked the link to the Munich Linux migration better. It's gotta be going on 10 years now for planning, and 9 years of "migration". lol It's been going on so long that they're STILL migrating from Windows NT 4 and Office 97.
 
Many eyes makes for secure code
Click to expand...

well, it depends. for cryptography it sure makes a difference and an open source alorithm is certainly more likely to be secure. it doesn't matter if *i* am able to have a look at it even though I have no expertise on the subject. the more people look at it, the more likely it is that flaws are discovered if a couple thousand PhDs of mathematics and computer science have a look at the AES encryption algorithm. the case may be entirely different for something like the linux kernel that is mentioned in the article, i agree.
 
I have found security issues in proprietary code just by looking at it, and it was not my goal; I just wanted to find something else. It would have been hard to exploit without knowing the software, but it was there.
So I highly disagree on the "many eyes" part. It does matter.

Stats speak for themselves too; open source products usually have less issues than their competitors, and more importantly, the issues are less severe.
 
temujin987 said:
well, it depends. for cryptography it sure makes a difference and an open source alorithm is certainly more likely to be secure. it doesn't matter if *i* am able to have a look at it even though I have no expertise on the subject. the more people look at it, the more likely it is that flaws are discovered if a couple thousand PhDs of mathematics and computer science have a look at the AES encryption algorithm. the case may be entirely different for something like the linux kernel that is mentioned in the article, i agree.
Click to expand...

Except those people tend to not look at the code with a fine toothed comb frequently because of fear of breaking something or thought that it's fine because it's been around so long. Look at the various flaws that's been found in various pieces of encryption and things like DNS and HTTPS that have recently been found that's been around for years or decades that one one else found. Just like the article said, most of those people weren't looking at the code, they just noticed an unintended behavior and figured out the rest.
 
You must log in or register to reply here.
Back
Top