RE: Writing Secure Code...

Exon said:
> > Deadlines maybe, but what is the reprocussion if they aren't met ?
> > Nothing. You're not getting paid, so you don't lose many. 
> You can just 
> > blame it on being busy with your real work (which it 
> probably would be 
> > due too) ...
> > 
> 
> Not true. Many large OSS projects (Apache, Samba, Linux, GNU, 
> openssl, openssh, ..., the list goes on and on and on) are 
> funded by organisations and/or companies (FSF, Dell, IBM, 
> RedHat, to name a few) that expect deadlines to be met. If 
> they stop developing (fast enough), funds will be cut and 
> people will lose their jobs.

Which involves money, like I said ...

 
> >>The main difference
> >>between proprietary vendors and OSS is that things gets 
> fixed faster, 
> >>and if you don't think it gets done fast enough you can 
> always fix it 
> >>yourself.
> > 
> > 
> > I can fix things where I work currently, myself. Whats the 
> difference ?
> > 
> 
> You can't fix it if you bought it closed source.

I see, you are talking about _purchased_ software. Well sure, that's
an advantage... but really, how many people make use of it ? And maybe
it's appropriate for some people, but (obviously) the typical end-user
couldn't care at all about that aspect. (i.e. the typical user
corporations aim for...)

 
> > The main difference between OSS and commercial is you are 
> getting paid 
> > for one. This affects your priorities, hence what gets 
> attention. Need 
> > to beat your competitor out the door, etc, etc, etc... Business 
> > priorities outweigh the development ones.
> > 
> > The problem is, they shouldn't. The fact is, they will. And always 
> > will. As long as customers are happy to receive faulty products...
> > Then the development issues _become_ business ones, and it 
> will hurt 
> > the business if they don't meet XXX standard, or whatever.
> > 
> 
> I wholeheartedly agree. Business decisions + software = 
> shoddy implementation. OSS removes the business decisions and 
> leaves the programmers to thrive in excellence.

But you say "OSS" projects are "funded" by corporate customers. This -
money - introduces "business" decisions... (i.e how to spend the
money, and how to get more of it).