How To Argue That Open Source Software Is Secure?

I didn't read all of the responses but those that I did read didn't address this.

Quoting:I have several customers who now want more than my word about the security of systems that have worked for them flawlessly for 5-6 years

Why not ask your customer who has used Linux for 5-6 years if they have had any problems with malware and being hacked? If they saw no, you then share how many of your Linux customers have had these problems,then ask "who do you believe your experience or a Microsoft salesman?"

If they have any academic or mathematical bent (*extraordinarily* rare in management, I grant), you may want to steer them to these:

http://arxiv.org/abs/cond-mat/0306511 http://www.andyozment.com/papers/Ozment_and_Schechter-Milk_O... http://www.cl.cam.ac.uk/~rja14/Papers/toulousebook.pdf http://arxiv.org/abs/0801.3924

In essence:

The security disadvantage to open source software amounts to "everyone can read the source and figure it out". The disadvantage to closed source software amounts to "only a few people get to read the source, and therefore it takes longer to rid it of bugs".

This seems to be born out in practice, as well. Steven Christey of MITRE had an observation that a lot of linux "remotes" were of the "format string overflow" type, while Windows remotes tended to be buffer overflows. One can find format string overflows by easy code inspections, while "fuzzing" can find buffer overflows.

The intelligent answer is :

Quoting:You don't "argue" security--you test security. Offer your clients periodic penetration tests as a routine part of your service.

Does bad open source include Microsoft's projects on CodePlex or the Windows Installer XML? http://en.wikipedia.org/wiki/Codeplex http://sourceforge.net/projects/wix/