Advanced

The biggest threat to open source in 2009

Posted by Scott_Ruecker on · 19 comments
ZDNet; By Dana Blankenhorn
Mail this story
Print this story

Security and updates, which are often the same thing. There is no longer any doubt that hackers and malware writers are going after open source projects as they once went after Windows. Vulnerabilities are being found, discovered, created, exchanged. The best protection against vulnerabilities is to keep software updated, but most open source lacks update services. That’s one part of the Windows license that is worth paying for, and there does not seem to be an open source equivalent.

Full Story

  Nav
» Read more about: Story Type: News Story

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (19)

From the Linked to article
Quoting:Palamida Standard Edition is an application security solution designed for organizations primarily concerned about identifying and remediating vulnerabilities associated with undocumented use of open source software. Standard Edition provides a complete inventory of open source components, including detailed intelligence about associated security vulnerabilities. Accurate detection ensures thorough analysis of software composition and management of risks associated with open source usage within mission critical applications and products.


So that would be undocumented Open Source software on what Operating System? It can't be Linux, because Linux is Open source Software, and the Open Source applications that run on it are documented, they are also updated automatically by the package manager, either per desktop, in the case of stand alone Linux systems, or under the control of the System Administrator, from a local repository, in the case of Enterprise systems.

So we must be talking about the abysmal way in which Windows handles updates of 3rd party software, be it Proprietary or Free Open Source Software, where the vendor is responsible for ensuring that patches and updates are streamed to the individual desktop. So that when this is turned off for Site administration purposes, there is no controlled way, as there is with Linux, to ensure that updates of any sort are applied to Windows desktops.

The best solution to this problem is to replace all those Windows Desktops with Linux desktops.

From the second Linked to Article.
Quoting:The story you are about to read is true. A name was changed as an anniversary present.

Dragnet badgeThe name is Friday. Theresa Bui-Friday. She’s a marketing executive. Carries a laptop.

Monday, November 3, 5:30 PM. Ms. Bui-Friday is on the phone talking about her employer, Palamida, for whom she is vice president of product marketing.

Just the facts. They started out selling services to identify licenses on open source in enterprises, then started tracking security vulnerabilities in same.


It's never stated in the article, but it's obvious from the context, that the problem is not actually [Free] Open Source Software, which in the context of Linux is updated in a timely fashion automatically. The problem is precisely what the problem has always been.... Microsoft Windows, and the fact that Microsoft has made the security problems that plague Windows, Someone else's problem.
There is no Dana, there is only FUD.
Quoting:The best protection against vulnerabilities is to keep software updated, but most open source lacks update services. That’s one part of the Windows license that is worth paying for, and there does not seem to be an open source equivalent.


If this was written by someone I respected, I would be scratching my head. This is the "give me a free laptop so I can at least say I've seen Linux" DB. If I haven't been updating my system, I wonder what I've really been doing all these years.

This article is so extreme in the claims it makes that Red Hat might want to consider a lawsuit.
bigg, what's the charge? Terminal stupidity? Is that really illegal? How are these people going to be able to support themselves when denied the opportunity to practice their trade?
Dana, Your check is in the mail. Thanks for contributing to the new Windows 7 campaign.

Steve B
> what's the charge? Terminal stupidity?

Let's change it a little bit. Let's say that he were to write an article that says, "Microsoft's policy is to not issue any security updates at all. No matter how severe the vulnerability, you will not in any circumstances receive a security update for any reason as long as you use Windows."

I may not be a lawyer, but I do know there are limits to what you can write. This is not an opinion. It is stated as if it is a fact. "Dana Blankenhorn killed his mother" would be sure to get his attention.
> ...there is only FUD.

That was pretty much my reaction when I read the synopsis of the article. The line "...but most open source lacks update services..." made me discount the story immediately. I didn't bother to read it.
Agreed. The update services on Linux are astoundingly good, especially on debian-based systems (but even rpm-based systems these days have really nice software update repositories).
bigg,

I am astounded. Why take my question as being seriously proposed? It is common knowledge that is NOT my predisposition. So tell me why, where have I gone wrong?

YBT*

* Your Buddy Txt. [My new ™ ** ]

** I am not greedy, just send cash and you too can use it.
Quoting:bigg, what's the charge? Terminal stupidity? Is that really illegal?


Could we make it illegal? Pretty please with sugar on top? It would make things sooo much easier at times :-)
> Could we make it illegal? Pretty please with sugar on top? It would make things sooo much easier at times :-)

A Heinlein quote comes to mind:

"Stupidity cannot be cured with money, or through education, or by legislation. Stupidity is not a sin, the victim can't help being stupid. But stupidity is the only universal capital crime; the sentence is death, there is no appeal and execution is carried out automatically and without pity."
As I think about it, this is evidence that the guy has never actually seen a modern Linux system in operation. He has absolutely zero idea about anything related to the workings of Linux. I didn't pay much attention to him before, but now he's going to be moved to the Enderle file.
Quoting:A Heinlein quote comes to mind


Nice quote. I have a different one in mind though:

"Why don't we simply take the warning label off everything and let the problem sort itself out"
Three Cheers for bigg! [Or at least two and a half for the stingy among us.]

He has become enlightened, since there is no fouler place than the Enderle file. There is no lower state, near zero Kelvin where even electrons cease to move ...

YBT* [™]
I think, though it's not clear in the article, that DB is talking about open source apps on Windows. Or maybe not. The only point that is clear is the shill for Palamida. Oh, and that he still knows nothing about Linux, even though he's been paid to write about it for years.
I think, though it's not clear in the article, that DB is talking about open source apps on Windows. Or maybe not. The only point that is clear is the shill for Palamida. Oh, and that he still knows nothing about open source, even though he's been paid to write about it for years.

**edit** Am I the only one who sometimes feels like a fool for believing that a person should have some competence in their profession?
>> Am I the only one who sometimes feels like a fool for believing that a person should have some competence in their profession?

Ah but what is his profession? You might erroneously think journalist but if you put him down as a shill then all is good. He is quite competent. Nowadays it pays to follow the money rather than take things on face value.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post