On Mar 16, 2005, at 4:59 PM, Mark Teicher wrote:
I tend to disagree on this, since there are more than ways to detect
an exploit or how to discuss how and why things work when they do.
The transparency issue is mute if the product is well constructed
and doesn't shake apart when folded, binded or crumpled. There is a
certain level of comfort that if something doesn't work right, one
can work it on themselves, but if can compare this if I pay $xxx,xxx
for fancy and very fast car. If it breaks under normal operating
circumstances, Otto the mechanic better fix it for free. Same issue
can be applied to the openness, if it breaks, it might not always
get fixed right away since Otto isn't specifically assigned to it,
or other wanna be Otto's attempt to know how to fix it. With the
commercial application, the fix may not be readily available or
until the number of days it is supposed to be released by the VRT :)
Support is a different issue all together. There are many instances
where people have received superior product support for open source
code than for equivalent and many cases where they haven't. It's like
anything, it depends on the providers commitment to support the
product. It doesn't change whether people like or trust a product. If
it works well and you can see why it is or isn't doing its job in
specific cases due to its nature as an open system then in many cases
that bolsters trust. If it's a black box and it just always does a
good job then people don't question it, but if it ever screws up then
people are going to want to know why and your black box is going to be
far less appreciated (and IDS could be said to frequently be a
candidate for the latter scenario).
-Marty
--
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Discover. Determine. Defend. - http://www.sourcefire.com
Snort: Open Source Intrusion Detection and Prevention -
http://www.snort.org
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
