RE: Writing Secure Code...

Jesper said: 
> -----Original Message-----
> From: Jesper Anderson [mailto:jesper@pobox.com] 
> Sent: Tuesday, 25 January 2005 3:34 AM
> To: secprog@securityfocus.com
> Subject: Re: Writing Secure Code...
>
> On Mon, Jan 24, 2005 at 11:43:12AM +1100, Michael Silk wrote:
> > > OSS development in general is quite structured and often applies 
> > > their own deadlines.
> >
> > Deadlines maybe, but what is the reprocussion if they aren't met ?
>
> Loss of goodwill, trust and status. These are important 
> commodities to a great many OSS developers - and often 
> translate into direct monetary gain at the end of the day if 
> maintained.

Sure, and as much as it's nice to operate the world on good will, not
everyone will do so.


> > > The main difference
> > > between proprietary vendors and OSS is that things gets fixed 
> > > faster, and if you don't think it gets done fast enough you can 
> > > always fix it yourself.
> >
> > I can fix things where I work currently, myself. Whats the 
> difference ?
>
> You can fix the bugs in NT 4.0 that Microsoft have stated 
> they won't fix? Maybe the bugs in Windows Server 2003? If so, 
> you have *way* more clout than most developers do.

... I don't work for Microsoft.


> > The main difference between OSS and commercial is you are 
> getting paid 
> > for one.
>
> The main difference is that in OSS development any 
> improvements made by anyone make it back to the common 
> codebase. Most OSS development is commercial anyway, you are 
> trying to create a false divide here.

I'm not trying to create anything ... just to discuss it :)