This is why you don't hire non-tech tech Project Managers

[Asher]

Yes, but you're probably more educated in the physics realm than the arts-graduates working in the legislatures.

[Jon Miller]

True

JM

[snoopy369]

Originally posted by Asher

It is not my place that refuses it, it is the client which is the a governmental organization in the USA. It's surprisingly common. The commies write open source, remember.

What's funny is that usually they refuse to use it (often by state law!) because they are afraid it is less secure (because everyone can see the source code).

Technical people are aware that open source software is, when proprely used, more secure because people try to break it (particularly encryption, which is generally not considered secure unless its source is openly known [whether 'open source' or simply allowed to be used for break attempts]...

[Kuciwalker]

Security isn't a function of being able to see the source code, it's a function of coder quality. Freeware/shareware coders are typically WAY on the low end of that scale.

[Asher]

Originally posted by snoopy369


What's funny is that usually they refuse to use it (often by state law!) because they are afraid it is less secure (because everyone can see the source code).

Technical people are aware that open source software is, when proprely used, more secure because people try to break it (particularly encryption, which is generally not considered secure unless its source is openly known [whether 'open source' or simply allowed to be used for break attempts]...

Technical people actually understand it is a fallacy that open source software is more OR less secure than closed source.

[snoopy369]

Certainly some software is more secure than others, regardless of open source, but (professional-level) open source tends to be more secure on average because it is thoroughly tested and vetted by many coders, some of which are high quality coders.

[MikeH]

Exactly the same is true of proprietary software.

Asher is right we should treat each product's security merits on an individual basis, regardless whether it's Open Source or proprietary.

[Asher]

Originally posted by snoopy369
Certainly some software is more secure than others, regardless of open source, but (professional-level) open source tends to be more secure on average because it is thoroughly tested and vetted by many coders, some of which are high quality coders.

As I said, that is a fallacy.

There's far less coders than you think that actually look into the source code, and even less that can understand it to a level to be actually useful in vetting it for security flaws.

[Asher]

It could also be argued that some large proprietary software companies are actually more secure with new code these days.

For the past few years, all publicly released products MS puts out is thoroughly vetted by teams of security specialists that know exactly what to look for: it's their entire job. There's a whole process around regular and consistent code audits in companies like MS and Google that look for this stuff, and I'm not aware of a single open source project (unless you count Google's Chromium) that has the same attention to and process around code security. This kind of stuff is very time consuming and expensive to do, and the open source community -- by and large -- doesn't do it.

The problem is the Open Source community all takes for granted the "many eyes" theory. The source code is out there, surely somebody with extensive security experience is spending thousands of man-hours pouring over each line of code in various sloppily-coded OSS projects and fixing security bugs, so why should they bother?

[Asher]

MS has published a book on their security development process, which they call the Security Development Lifecycle (SDL): http://www.amazon.com/gp/product/073...e=UTF8&s=books

I haven't yet read it but colleagues speak very highly of it.

[onodera]

Originally posted by Asher

It is not my place that refuses it, it is the client which is the a governmental organization in the USA. It's surprisingly common. The commies write open source, remember.

Mindboggling. So they are okay with using something that comes with no warranty at all, is not supported by anyone and cannot be verified to be safe enough, but refuse to use something that also comes with no warranty at all, but is sometimes supported by a commercial firm (and can be supported by your own staff) and can be taken apart and inspected for backdoors?
At least our suits are not that retarded.

[Asher]

The problem is with licensing, more often than not it is the open source licensing (GPL, etc) that make it unusable for businesses.

If it is licensed under the GPL, then the company will need to open source every component it is built with (including the software _we_ write that uses it). It's childish and inhibits adoption of OSS.

It's because of this that all OSS projects at most big organizations need the lawyers to vet the licenses before they're used. And that is expensive, actually.

[Kuciwalker]

If it is licensed under the GPL, then the company will need to open source every component it is built with (including the software _we_ write that uses it). It's childish and inhibits adoption of OSS.

Only if you're reselling software that actually links with that code.

[Asher]

Originally posted by Kuciwalker
Only if you're reselling software that actually links with that code.

Which is precisely what we do?

[Asher]

The GPL is a legal minefield. Other licenses, like Apache and BSD, are reasonable but more rare. The GPL is so prevalent that it has tainted the image of OSS in big organizations and in many ways, set back the OSS movement.

Richard Stallman is a Luddite and a moron.