Wednesday, June 25, 2008

Is Open Source Code Secure?

The contention that open-source code programs are more reliable and secure will hold no water. Those who argue in favor of this assertion believe that an open-source code system is tested by a huge number of people on the code level who discover all possible errors. Yes, testing for errors on the code level concurrently with is easy and effective, but the results of such testing are far from ideal. Even after extensive testing by thousands of users, errors crop up in Linux. Moreover, judging from the army of users that tested the latest Windows versions, you would think that it would finally become the perfect operating system. We do know better than that, don't we? Testing is one thing, but running under real-life conditions is another, with unpredictable results popping up.


Linux support is rather expensive, so you might encounter problems obtaining timely updates. Moreover, administering Linux is more difficult than administering Windows. But why is Linux so difficult to master? The answer is simple: Performance and convenience are two incompatible things. Linux is a performance product, and Windows is a convenience product.


Security is often sacrificed for performance or convenience. For example, some programs may have options that make the administrator's work easier (e.g., the PHP interpreter may have the debug option enabled) but at the same time make it easier for hackers to break into the system. Nevertheless, Linux security is higher than that of Windows, and this has nothing to do with it being open source. Simply, many security-related aspects in Linux are implemented better than in Windows. For Example you can see the today's pathetic situation of a windows effected by viruses or malicious programs. Other examples includes the memory allocation of programs in Linux, like in normal circumstances a program cannot oversteps the bound of allocated memory whereas in Windows any program can use the any memory area resulting in the danger of faulty operations or system crash if the memory area of one program being over written by other.


So over all you can grade LINUX far much better for Quality and Development than windows and once you get into it ... you will never look back and if you are still in catch22 try to re-recognize your needs and then decide!!

4 comments:

Waseem said...

People often do think that Opensource or FOSS softwares do not have good security because they are not tested well. Well this is not true. As you pointed out that those are tested at the *code* level by huge number of people(coders) itself makes it clear that it's been tested very well. But bugs are shameless those will creep in anyway.
I think here you are mixing two things security and bugs. Both are different. Security features make sure that nobody except you or the people whom you allowed, are able to access your system. Therefore security also demands something from your side too. You should not install such software which may harm your system. On the other hand Bugs are related to the improper functioning of your software. They cause your system to do certain things in such a way which you do not want to take place.
Now if we talk about bugs then FOSS softwares are much more likely to be free from bugs as they are Open and they(most of them) have better bug filing systems.
The thousand users(Lusers) who test the windows system actually do not test rather they simply press the *send error report* button on their Windows system.
Security is also concerned about how much you know about your system. At any given moment how much you know what's going on in your system.
You are right administering GNU/Linux is really difficult than windows. Think about double_click->next->next->next->and_the_software_is_installed feature(crap) of windows. it does not let you even know what's happening to your system.
I do not agree that Performance and Convenience are incompatible things. You should see the Macintosh for this. MAC has good performance and also great Convenience. One more thing to tell you MAC internally uses BSD kernel which AFAIK is Open. Dude GNU/Linux has better security than Windows is really because it *is* Open. Had it been proprietary I do not know what would have been happened to it.
The Memory Area example you give is really good. I did not know you could use any part of the memory for user programs. Anyways this shows how bad the windows is designed and we already know about the implementation.
I would also add to your Virus example. We all know what happens when viruses attack your windows. You simply do not have any other option but to again torture your machine by installing windows on it. Today I saw an advertisement of MAC in the news paper it said it was "virtually virus free". It means MAC is also not completely virus free. As far as GNU/Linus is concerned I have never heard anyone saying "OMG! Trojans, Worms and viruses have attacked my GNU/Linux PC. I will have to re-install it." Dude I think that is because simply GNU/Linux is Open and also the programs used on it are FOSS.
That was great read. Hope to see more from you.

Waseem said...

I forgot to point out a thing. Security and Bugs are two different things but are closely related. Bugs cause security hole in your system. So a better debugged system is much likely to be secure than a system which is not debugged properly or is debugged by lazy programmers or the programmers who are debugging the system under fixed time-line. FOSS programs are debugged by a large number of people of which most do it being a volunteer and so that they can learn more about programming. This also helps make FOSS programs much more bug free and resultant secure.

Kazim Zaidi said...

I see that your post fails to make a point.

You begin with arguments against reliability & security of OSS, but end with exactly opposing ideas.

There's a myth that OSS is tested by millions of users. Actually, quite the converse is true. OSS lacks developers on board, let alone testers. And every user using it is not testing it. They are only "reporting" bugs.

Just because Firefox is open, how many home-users actually look into its code?

So, software giants like M$ have hired much more testers than OSS got.

Another myth is that OSS has an army of developers. Again, except big software like Linux Kernel, no OSS has an army (i n that very sense of the word!). They often lack developers.

Still, OSS is better. This has been demonstrated all the time. Better security. Better focus on user needs. Better features. More power.

Compare Windows vs GNU/Linux.
Compare Apache vs Commercial Webservers.
Compare vim/emacs vs ____ (no equivalents?)

The reasons are not obvious. I try to explain.

First, the development methodologies used by OSS are quite effective. Agile software development, quick bug detection & fixing, early releases to name a few. Peer review (or eyeball-popping) style of development is hallmark of good code. You naturally write responsibly good code when you know 100 people will read it. Ego works.

Second, the developers' intention. OSS Developers work to make software good, and not to match deadlines. They are not under pressure of time (characterstic of commercial software industry). They are, rather, under the pressure of writing elegant code. That *actually* makes a big difference.

Third, OSS Developers are those people who work for fun. And I'm serious. They're great young programmers (with often 10+ years of experience) who devote their time for the sake of fun of programming. They develop software like an art. That explains why an OSS Developer would work entire day on his job, and then would be happy to write code for his favourite OSS in the evening.

Software developed in such environment is naturally healthy, with good design decisions and superior code. Better security implementations.

Performance & Convenience are not incompatible. Power & User-friendliness maybe, if that is what you meant. Nevertheless, they are not incompatible. They've to be worked on independently. (And I hope you are not a GNOME fanatic who believes in the GNOME disease that "functionality will confuse user").

Programming was an art. Open source brought this art back to life.

Anonymous said...

what I was looking for, thanks