Welcome!

Linux Containers Authors: Ian Khan, Elizabeth White, Yeshim Deniz, Liz McMillan, Miska Kaipiainen

Related Topics: Linux Containers

Linux Containers: Article

An Approach That Works

Comparing open and closed source security

Seemingly everyone has insight into the open source versus closed source security debate. Each side provides plausible arguments for the benefits of their own model and points out drawbacks of the other. The proponents of open source argue that the source code is open and available for anyone to see, for many sets of eyes to examine, and is therefore more secure. Opponents of open source say that this "many eyes" theory is irrelevant since the vast majority of users will never look at the source code. Countless arguments ensue from there and can get quite derived, much like arguments over the exact number of episodes of Star Trek.

Looking past these arguments, it's helpful to examine the theory of security as it is approached by open and closed source software organizations. To that end I'll look at the security approach of the Debian Linux project as compared to the security approach of Microsoft - I'll use Microsoft as an example acknowledging the important role that they play as a target of security-related attacks due to their market share in the desktop operating system environment.

Security for both Debian and Microsoft is chiefly accomplished through the use of software patches. Debian issues patches for Debian-specific software problems as well as non-Debian-specific problems. These patches run the gamut of any of the thousands of software packages available with Debian. Some of this software isn't even Linux specific but runs on other operating systems as well, including Microsoft Windows. Microsoft releases patches only for Microsoft-specific software.

With the thousands of software packages available with Debian, security bugs are impossible to avoid. Most updates are not specific to Debian but rather affect the software as it runs on Linux, Mac OS X, and Microsoft Windows alike. Regardless, the software updates become available to users of Debian Linux through the apt package utility. Even if the problem isn't directly related to operating system functionality, the update is easily downloaded and automatically installed. On the other hand, updates for Microsoft through the default "Automatic Update" service consist of what Microsoft terms to be core functions. These core functions include updates to bundled products such as Internet Explorer and Media Player but don't include updates to other Microsoft software such as Microsoft Office, Exchange, SQL Server, and others. Security flaws in this additional software can lead to full compromise of the computer and the data contained therein, as is the case with operating system flaws.

The timing of security updates best reveals the differences in how the two models approach security. One of the aspects of open source security is transparency - virtually as soon as a security flaw, theoretical or practical, is reported, it's released to the general public so that users of the software can take steps to mitigate the effects of the security flaw. A patch follows very shortly after for all of the popular open source software packages. If a patch isn't readily available within hours, the community frequently steps up to release an intermediate patch and to help others mitigate problems associated with the flaw.

On the other hand, Microsoft has undertaken the policy of releasing patches only monthly for the operating system functions. While this results in fewer security notices to the public, it does nothing to enhance security. In fact, releasing patches on a monthly cycle rather than as necessary increases the possibility of exploit. The only people who know about the exploit are the people responsible for finding it and Microsoft. Of course, the people who find software exploits are all honest individuals with no ill intentions, right? Imagine that a burglar found a new way to pick door locks and shared this information with their friends-in-crime, and the police found out about the impending crime spree. Now imagine the police did nothing to alert the public about this danger because they only talked to the public monthly. Transparency and openness of security flaws and defects in products should be demanded by customers for their own safety.

Comparing the security approaches of open and closed source software organizations illustrates the inherent structural differences between the two models. Open source organizations such as Debian believe in greater protection, openness, and transparency of the security process so that their users can protect themselves. Closed source organizations such as Microsoft believe that they know best how, where, and when to disseminate information about security flaws. Unfortunately for users, this means quietly, discreetly, and belatedly.

More Stories By Steve Suehring

Steve Suehring is a technology architect and engineer with a solid background in many areas of computing encompassing both open and closed source systems, he has worked with a variety of companies from small to large, including new and old economy, to help them integrate systems and provide the best use of available technologies. He has also taken a hands-on approach with many projects and frequently leads teams of engineers and developers, and has written magazine articles as well as a book on the MySQL database server. He has also performed technical editing on a number of other titles.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, wh...
Adobe is changing the world though digital experiences. Adobe helps customers develop and deliver high-impact experiences that differentiate brands, build loyalty, and drive revenue across every screen, including smartphones, computers, tablets and TVs. Adobe content solutions are used daily by millions of companies worldwide-from publishers and broadcasters, to enterprises, marketing agencies and household-name brands. Building on its established design leadership, Adobe enables customers not o...
Why do your mobile transformations need to happen today? Mobile is the strategy that enterprise transformation centers on to drive customer engagement. In his general session at @ThingsExpo, Roger Woods, Director, Mobile Product & Strategy – Adobe Marketing Cloud, covered key IoT and mobile trends that are forcing mobile transformation, key components of a solid mobile strategy and explored how brands are effectively driving mobile change throughout the enterprise.
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lea...
What are the new priorities for the connected business? First: businesses need to think differently about the types of connections they will need to make – these span well beyond the traditional app to app into more modern forms of integration including SaaS integrations, mobile integrations, APIs, device integration and Big Data integration. It’s important these are unified together vs. doing them all piecemeal. Second, these types of connections need to be simple to design, adapt and configure...
24Notion is full-service global creative digital marketing, technology and lifestyle agency that combines strategic ideas with customized tactical execution. With a broad understand of the art of traditional marketing, new media, communications and social influence, 24Notion uniquely understands how to connect your brand strategy with the right consumer. 24Notion ranked #12 on Corporate Social Responsibility - Book of List.
Just over a week ago I received a long and loud sustained applause for a presentation I delivered at this year’s Cloud Expo in Santa Clara. I was extremely pleased with the turnout and had some very good conversations with many of the attendees. Over the next few days I had many more meaningful conversations and was not only happy with the results but also learned a few new things. Here is everything I learned in those three days distilled into three short points.
What happens when the different parts of a vehicle become smarter than the vehicle itself? As we move toward the era of smart everything, hundreds of entities in a vehicle that communicate with each other, the vehicle and external systems create a need for identity orchestration so that all entities work as a conglomerate. Much like an orchestra without a conductor, without the ability to secure, control, and connect the link between a vehicle’s head unit, devices, and systems and to manage the ...
The Jevons Paradox suggests that when technological advances increase efficiency of a resource, it results in an overall increase in consumption. Writing on the increased use of coal as a result of technological improvements, 19th-century economist William Stanley Jevons found that these improvements led to the development of new ways to utilize coal. In his session at 19th Cloud Expo, Mark Thiele, Chief Strategy Officer for Apcera, will compare the Jevons Paradox to modern-day enterprise IT, e...
Major trends and emerging technologies – from virtual reality and IoT, to Big Data and algorithms – are helping organizations innovate in the digital era. However, to create real business value, IT must think beyond the ‘what’ of digital transformation to the ‘how’ to harness emerging trends, innovation and disruption. Architecture is the key that underpins and ties all these efforts together. In the digital age, it’s important to invest in architecture, extend the enterprise footprint to the cl...
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management solutions, helping companies worldwide activate their data to drive more value and business insight and to transform moder...
SYS-CON Events has announced today that Roger Strukhoff has been named conference chair of Cloud Expo and @ThingsExpo 2016 Silicon Valley. The 19th Cloud Expo and 6th @ThingsExpo will take place on November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. "The Internet of Things brings trillions of dollars of opportunity to developers and enterprise IT, no matter how you measure it," stated Roger Strukhoff. "More importantly, it leverages the power of devices and the Interne...
What does it look like when you have access to cloud infrastructure and platform under the same roof? Let’s talk about the different layers of Technology as a Service: who cares, what runs where, and how does it all fit together. In his session at 18th Cloud Expo, Phil Jackson, Lead Technology Evangelist at SoftLayer, an IBM company, spoke about the picture being painted by IBM Cloud and how the tools being crafted can help fill the gaps in your IT infrastructure.
Digital innovation is the next big wave of business transformation based on digital technologies of which IoT and Big Data are key components, For example: Business boundary innovation is a challenge to excavate third-party business value using IoT and BigData, like Nest Business structure innovation may propose re-building business structure from scratch, as Uber does in the taxicab industry The social model innovation is also a big challenge to the new social architecture with the design fr...
Data is an unusual currency; it is not restricted by the same transactional limitations as money or people. In fact, the more that you leverage your data across multiple business use cases, the more valuable it becomes to the organization. And the same can be said about the organization’s analytics. In his session at 19th Cloud Expo, Bill Schmarzo, CTO for the Big Data Practice at EMC, will introduce a methodology for capturing, enriching and sharing data (and analytics) across the organizati...
DevOps at Cloud Expo, taking place Nov 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 19th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long dev...
IoT offers a value of almost $4 trillion to the manufacturing industry through platforms that can improve margins, optimize operations & drive high performance work teams. By using IoT technologies as a foundation, manufacturing customers are integrating worker safety with manufacturing systems, driving deep collaboration and utilizing analytics to exponentially increased per-unit margins. However, as Benoit Lheureux, the VP for Research at Gartner points out, “IoT project implementers often ...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life sett...
In his session at @ThingsExpo, Kausik Sridharabalan, founder and CTO of Pulzze Systems, Inc., will focus on key challenges in building an Internet of Things solution infrastructure. He will shed light on efficient ways of defining interactions within IoT solutions, leading to cost and time reduction. He will also introduce ways to handle data and how one can develop IoT solutions that are lean, flexible and configurable, thus making IoT infrastructure agile and scalable.
SYS-CON Events announced today that Bsquare has been named “Silver Sponsor” of SYS-CON's @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. For more than two decades, Bsquare has helped its customers extract business value from a broad array of physical assets by making them intelligent, connecting them, and using the data they generate to optimize business processes.