- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
Is open source software bad for business?
As well as insisting that OSS development communities do not adopt a secure development process that follows software security best practise, and therefore often leaves potentially dangerous vulnerabilities unaddressed, Fortify goes on to charge that "nearly all" such OSS communities are also failing to provide users access to the kind of security expertise that could help remedy the vulnerabilities and risks that remain. |
|
|
Comments (9)
What ticked me off was:
When I see "enterprise-worthy" I think http://www.thedailywtf.com and see an image of a self-proclaimed "IT expert" in a suit. It makes me cringe all over.
Quoting:It argues that little has been done within the OSS community to implement what it calls "enterprise-worthy application security measures"
When I see "enterprise-worthy" I think http://www.thedailywtf.com and see an image of a self-proclaimed "IT expert" in a suit. It makes me cringe all over.
This article needs 'humor' tags. Especially the last line- that makes it an opinion piece, not a news article.
Two things come to mind.
(1) An old african saying: "Pay a witch hunter, and by gosh they will find you a witch!"
(2) Something I saw in an image of a PowerPoint presentation on boingboing.net:
Scaling Extensible Whatever with Blah Blah Blah Across the Enterprise.
"Enterprise", when used as an adjective, means almost nothing. "Enterprise" "apps" are almost universally poorly designed, and execrably coded (as Visual Basic, even when they're nominally in Java), with predictably mediocre results.
(1) An old african saying: "Pay a witch hunter, and by gosh they will find you a witch!"
(2) Something I saw in an image of a PowerPoint presentation on boingboing.net:
Scaling Extensible Whatever with Blah Blah Blah Across the Enterprise.
"Enterprise", when used as an adjective, means almost nothing. "Enterprise" "apps" are almost universally poorly designed, and execrably coded (as Visual Basic, even when they're nominally in Java), with predictably mediocre results.
Do you mean tags like these?
<humor> Is open source software bad for business? Yes it is, but proprietary software is much much worse. </humor>
<humor> Is open source software bad for business? Yes it is, but proprietary software is much much worse. </humor>
6, that's not funny.
_Bob_R,
I was kind of playing off of the 'Enterprisey' theme of this thread.
I've worked for very large clients as a contract programmer for over 12 years, and have recently become an employee at one.
Even the smallest tasks are made maddeningly huge when built in the normal SDLC (Software Development Life Cycle) of a large corporation. There is no way to do a small project.
At least not following the rules.
There is almost nothing enterprising about enterprise. The best you can hope for is the least worst.
I was kind of playing off of the 'Enterprisey' theme of this thread.
I've worked for very large clients as a contract programmer for over 12 years, and have recently become an employee at one.
Even the smallest tasks are made maddeningly huge when built in the normal SDLC (Software Development Life Cycle) of a large corporation. There is no way to do a small project.
At least not following the rules.
There is almost nothing enterprising about enterprise. The best you can hope for is the least worst.
This one caught my attention because $employer is currently implementing Fortify to scan internal app code.
I'll bet some really smart corporate IT types might notice that the documentation in this "study" was produced by scanning source code using Fortify's scanning tools. Which can be had, for a small fee.
Such an executive, if she's really, *really* smart, might get the idea that it would be a good idea to scan the source code of any application her enterprise planned to deploy. Proprietary apps don't normally provide the source code, but I guess one could rely on a vendor's assurance that "best security practices" are being followed. Sure.
I wonder if Fortify has a certification program in which, again for a small fee, an application can be certified as having passed their rigorous certification process. "Certified by Fortify".
I'll bet some really smart corporate IT types might notice that the documentation in this "study" was produced by scanning source code using Fortify's scanning tools. Which can be had, for a small fee.
Such an executive, if she's really, *really* smart, might get the idea that it would be a good idea to scan the source code of any application her enterprise planned to deploy. Proprietary apps don't normally provide the source code, but I guess one could rely on a vendor's assurance that "best security practices" are being followed. Sure.
I wonder if Fortify has a certification program in which, again for a small fee, an application can be certified as having passed their rigorous certification process. "Certified by Fortify".
Sorry, 6, I forgot the {sarcasm} tags.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post