RE: Writing Secure Code...

Exon said:
> -----Original Message-----
> From: exon [mailto:[email protected]] 
> Sent: Monday, 24 January 2005 7:34 AM
> To: [email protected]
> Subject: Re: Writing Secure Code...
> 
> Michael Silk wrote:
> > Well, think you can agree that OSS gives access to more 
> people, right?
> > I agree with you, however, that having lots of people is not 
> > neccessarily a good idea. The key is to have it structured as well, 
> > with reliable people doing it.
> > 
> 
> Hence the official maintainers who reviews and applies 
> patches submitted by the efficient and manyheaded crowd of 
> programmers enjoying OSS.
> 
> > Don't get me wrong, however, I don't think that OSS is the 
> answer to 
> > writing more secure commercial programs, and I think that a 
> > combination of both is probably the worst idea :) Basically because 
> > you introduce an unstructured system into a system that requires 
> > deadlines ... and that can only be bad :)
> > 
> 
> OSS development in general is quite structured and often 
> applies their own deadlines.

Deadlines maybe, but what is the reprocussion if they aren't met ?
Nothing. You're not getting paid, so you don't lose many. You can just
blame it on being busy with your real work (which it probably would be
due too) ...

Deadlines only matter if they actually need to be met, and in OSS
(i.e. free, "when you have time" development) I can't think of any
time where one would be required.


> The main difference 
> between proprietary vendors and OSS is that things gets fixed 
> faster, and if you don't think it gets done fast enough you 
> can always fix it yourself.

I can fix things where I work currently, myself. Whats the difference ?

The main difference between OSS and commercial is you are getting paid
for one. This affects your priorities, hence what gets attention. Need
to beat your competitor out the door, etc, etc, etc... Business
priorities outweigh the development ones.

The problem is, they shouldn't. The fact is, they will. And always
will. As long as customers are happy to receive faulty products...
Then the development issues _become_ business ones, and it will hurt
the business if they don't meet XXX standard, or whatever.


> > Corporations just need to forget about these quick fixes and train 
> > their programmers to program _correctly_ (i.e: securely) and _give 
> > them the time to do it!_. Unfortunately deadlines are a fact of 
> > corporate life, but even so...
> > 
> 
> Good programmers should be aware of the amount of time that 
> they need to write whatever (part of) program they are set to 
> write.

They do, but most (all?) managers don't care about that.

Anyway ... Like I said, it's all been said before, so ... :)