Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security SecProg
[Top] [All Lists]

RE: Writing Secure Code...

Subject: RE: Writing Secure Code...
Date: Tue, 25 Jan 2005 11:43:07 +1100
Exon said:
Deadlines maybe, but what is the reprocussion if they aren't met ?
Nothing. You're not getting paid, so you don't lose many. 
You can just 
blame it on being busy with your real work (which it 
probably would be 
due too) ...


Not true. Many large OSS projects (Apache, Samba, Linux, GNU, 
openssl, openssh, ..., the list goes on and on and on) are 
funded by organisations and/or companies (FSF, Dell, IBM, 
RedHat, to name a few) that expect deadlines to be met. If 
they stop developing (fast enough), funds will be cut and 
people will lose their jobs.

Which involves money, like I said ...

 
The main difference
between proprietary vendors and OSS is that things gets 
fixed faster, 
and if you don't think it gets done fast enough you can 
always fix it 
yourself.


I can fix things where I work currently, myself. Whats the 
difference ?


You can't fix it if you bought it closed source.

I see, you are talking about _purchased_ software. Well sure, that's
an advantage... but really, how many people make use of it ? And maybe
it's appropriate for some people, but (obviously) the typical end-user
couldn't care at all about that aspect. (i.e. the typical user
corporations aim for...)

 
The main difference between OSS and commercial is you are 
getting paid 
for one. This affects your priorities, hence what gets 
attention. Need 
to beat your competitor out the door, etc, etc, etc... Business 
priorities outweigh the development ones.

The problem is, they shouldn't. The fact is, they will. And always 
will. As long as customers are happy to receive faulty products...
Then the development issues _become_ business ones, and it 
will hurt 
the business if they don't meet XXX standard, or whatever.


I wholeheartedly agree. Business decisions + software = 
shoddy implementation. OSS removes the business decisions and 
leaves the programmers to thrive in excellence.

But you say "OSS" projects are "funded" by corporate customers. This -
money - introduces "business" decisions... (i.e how to spend the
money, and how to get more of it).

<Prev in Thread] Current Thread [Next in Thread>