[83415] in North American Network Operators' Group
Re: Cisco crapaganda
daemon@ATHENA.MIT.EDU (Steven J. Sobol)
Sat Aug 13 15:04:05 2005
Date: Sat, 13 Aug 2005 15:02:08 -0400 (EDT)
From: "Steven J. Sobol" <sjsobol@JustThe.net>
To: Dave Howe <DaveHowe@gmx.co.uk>
Cc: "na >> Email List: nanog" <nanog@nanog.org>
In-Reply-To: <42FE3CB4.9010000@gmx.co.uk>
Errors-To: owner-nanog@merit.edu
On Sat, 13 Aug 2005, Dave Howe wrote:
>
> Rich Kulawiec wrote:
> > More bluntly: the closed-source, "faith-based" approach to security
> > doesn't cut it. The attacks we're confronting are being launched
> > (in many cases) by people who *already have the source code*, and
> > who thus enjoy an enormous advantage over the defenders.
> TBH though, usually the open source "faith based" approach to security
> doesn't cut it either. its easy to say "its open source, therefore
> anyone can check the code" but much harder to actually find someone who
> has taken the time to do it....
Depends on the project.
Some OSS projects turn around enhancements and bug fixes, and fix
vulnerabilities, quickly. Some don't. Some do some of the time, depending
on the type of change. (For example, Mozilla is good about patching
vulnerabilities quickly, but there's an Thunderbird enhancement almost 200
people voted for on Bugzilla, that people have been complaining about for
months, that they've not done anything about.)
--
Steve Sobol, Professional Geek 888-480-4638 PGP: 0xE3AE35ED
Company website: http://JustThe.net/
Personal blog, resume, portfolio: http://SteveSobol.com/
E: sjsobol@JustThe.net Snail: 22674 Motnocab Road, Apple Valley, CA 92307
