> As I stated yesterday, we already KNOW how akin to swiss cheese Windows > is. How could any OS provide less security?
I don't think any of us wants to promote ANY approach to security with the rallying cry of "better than Microsoft." Fortunately, we don't need to. I think there is a general misapprehension that simply being able to see source code for a system is equivalent to being able to subvert a system that is running that code. This is not the same thing. Even widely-used security techniques such as PGP have long made the underlying code publicly available for review (see, for example, http://www.pgpi.org/cgi/download.cgi?filename=pgp50i-unix-src.tar.gz) so that everyone may assure himself of the effectiveness of the safeguards and the rigor of the techniques. Knowing how PGP encryption works does not permit anyone to "break" the encryption. Likewise, knowing how an open-source system prevents intrusion does not mean that this knowledge enables anyone to circumvent that system's security. Moreover, an open-source system has the advantage that it does not require a blind reliance on any single vendor's assertions about its security; everyone may examine it and confirm for themselves that the code effectively precludes unauthorized access. Anyone's concerns with the code are quickly and broadly communicated to the development community, and many hands work on closing any cracks. However, because proposed changes to any aspect of any of the major "open" systems undergo an extensive peer review before their inclusion in the generally accepted system, any weaknesses are usually identified BEFORE the system goes into general release. In a closed-system environment, fewer eyes review code before it is released, and those who do review it have an allegiance to the owner of the code and an incentive to meet market deadlines. So there is no reason for open-source systems to be inherently insecure, and in fact, the number of people scrutinizing the code contributes to its stability and security and serves as a de facto certification of its effectiveness. - Ed - - - - - - - - - - - Ed Ward [EMAIL PROTECTED] _______________________________________________ DIGITALDIVIDE mailing list DIGITALDIVIDE@mailman.edc.org http://mailman.edc.org/mailman/listinfo/digitaldivide To unsubscribe, send a message to [EMAIL PROTECTED] with the word UNSUBSCRIBE in the body of the message.
