 |
privacy |
||
|
Hangout for experimental confirmation and demonstration of software, computing, and networking. The exercises don't always work out. The professor is a bumbler and the laboratory assistant is a skanky dufus.
Blog Feed Recent Items 
The nfoCentrale Blog Conclave nfoCentrale Associated Sites |
2004-09-21Open-Source: How Trustworthy, How Secure?The Myth of Open-Source SecurityHere are more gleanings on security, this time with emphasis on open-source development processes and the opportunity, or not, for trustworthy, secure software. I'm still looking for a vaguely-remembered blurb where a group of experts identified lack of a disciplined process and measures for quality as an impediment to credible claims to inherent security of open source.Slashdot | Open Source Security: Still A Myth. This blurb suggests that the many-eyeballs characteristic of open-source software is not an automatic assurance of security. It is uncertain that "those eyeballs are looking for security problems in a structured way." John Viega's 2004-09-16 ONLamp.com Security Devcenter article begins with this intriguing lead: "Open source may have many benefits over closed systems, but don't count security among them--yet." The article examines the concern by commercial and governmental users that open source developers are "too little 'engineer,' cobbling together solutions without going through a structured software engineering process (such as requirements, specification, and analysis)." I have begun to argue that the open-source community has a unique opportunity to raise the security bar on software. Viega has evidence that the open-source culture may not be anxious to do the work required. One daunting example is the Sardonix project. Although funded by the Department of Defense to collect reports of security audits of open-source packages, there has not been wide acceptance of this DARPA Composable High-Assurance Trusted Systems (CHATS) funded research project. After an initial flurry in 2002, the discussion list of the site (considered to be in beta) has dwindled to three postings in 2004. It is not clear what the impediment is, and I will not speculate here. It seems that the serious tension around adoption decisions is that "people who want to sell software to organizations in [security-conscious] markets have to answer tough questions about the security properties of their software. Many times, potential customers must fill out extensive documentation about their products and the processes and technologies used to build them. Sometimes, potential customers must even submit their software to independent third-party source code auditing before purchase." The difficulty is that the customer is not expecting to pay for the software security, but open-source developers have no way to fund software security and include it in the price of the product. There is more to the article, and the many comments. Viega's summing-up is close enough for now: "I believe that in the long run, open source software does have the potential to be more secure than closed systems, since open source projects can do everything commercial projects can. ... Open source projects need to migrate to software engineering processes that resonate with the industry." Yes, Still a MythDana Epp's ramblings at the Sanctuary : Open Source Security: Still a Myth?. Dana Epp looks over John Viega's article and sees its resonance with Dana's own thinking. There are links to two earlier posts of Dana's that bear on this issue. April 15, 2004: Open Source vs. Closes Source Security with rich comments too. February 14, 2004: Shattering the Crystal and Poking Holes in the Black Box was Dana's initial foray onto this territory. More links to articles, an extended essay and an extensive accumulation of comments.Security is Really a Low-Level Software Issue?ACM News Service: Open BSD's Theo de Raadt Talks Software Security. This blurb juxtaposes three remarkable items:
Open-Source Opportunity for EuropeACM News Service: EU Boost to Open Source Software. I notice high expectations of the open-source developments that are conducted in European Union research initiatives of the kinds reported in IST Results. In extreme cases the open-source software is automatically assumed to be better along with other magical qualities such as being automatically useful (although not being installable and configurable by anyone who didn't actually write it, as well as I could tell after fumbling around and giving up in the case of one open-source software-engineering tool). The Coordinated Action for Libre Software (CALIBRE) is an EU effort designed specifically "to improve the deployment of open-source software development projects." There is some thought of leap-frogging the U.S.-led software industry too. Matthew Broersma's 2004-09-03 TechWorld article identifies CALIBRE as starting in September 2004 and continuing for two years. There's other fascinating context here, including this observation by the University of Limerick Professor Brian Fitzgerald: "Interestingly, the majority of open source contributions come from Europe, but strategic thinking and leadership of many open-source projects is probably very much US-dominated." The goal is to build the case for open-source development and also identify best practices. There are links to two related initiatives for open source and open standards in government and public administration.Related Gleanings
|
||
|
You are navigating Orcmid's Lair. |
template
created 2004-06-17-20:01 -0700 (pdt)
by orcmid |