Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | RE: Writing Secure Code... |
|---|---|
| Date: | Tue, 25 Jan 2005 11:43:07 +1100 |
Exon said:
Deadlines maybe, but what is the reprocussion if they aren't met ? Nothing. You're not getting paid, so you don't lose many.You can justblame it on being busy with your real work (which itprobably would bedue too) ...Not true. Many large OSS projects (Apache, Samba, Linux, GNU, openssl, openssh, ..., the list goes on and on and on) are funded by organisations and/or companies (FSF, Dell, IBM, RedHat, to name a few) that expect deadlines to be met. If they stop developing (fast enough), funds will be cut and people will lose their jobs.
Which involves money, like I said ...
The main difference between proprietary vendors and OSS is that things getsfixed faster,and if you don't think it gets done fast enough you canalways fix ityourself.I can fix things where I work currently, myself. Whats thedifference ?You can't fix it if you bought it closed source.
I see, you are talking about _purchased_ software. Well sure, that's an advantage... but really, how many people make use of it ? And maybe it's appropriate for some people, but (obviously) the typical end-user couldn't care at all about that aspect. (i.e. the typical user corporations aim for...)
The main difference between OSS and commercial is you aregetting paidfor one. This affects your priorities, hence what getsattention. Needto beat your competitor out the door, etc, etc, etc... Business priorities outweigh the development ones. The problem is, they shouldn't. The fact is, they will. And always will. As long as customers are happy to receive faulty products... Then the development issues _become_ business ones, and itwill hurtthe business if they don't meet XXX standard, or whatever.I wholeheartedly agree. Business decisions + software = shoddy implementation. OSS removes the business decisions and leaves the programmers to thrive in excellence.
But you say "OSS" projects are "funded" by corporate customers. This - money - introduces "business" decisions... (i.e how to spend the money, and how to get more of it).
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: Writing Secure Code..., exon |
|---|---|
| Next by Date: | secure storage of sensitive data in J2EE, chaim moshe |
| Previous by Thread: | Re: Writing Secure Code..., exon |
| Next by Thread: | RE: Writing Secure Code..., Michael Silk |
| Indexes: | [Date] [Thread] [Top] [All Lists] |