Welcome!

Linux Containers Authors: Carmen Gonzalez, JP Morgenthal, Elizabeth White, PagerDuty Blog, Craig Lowell

Related Topics: Linux Containers

Linux Containers: Article

An Approach That Works

Comparing open and closed source security

Seemingly everyone has insight into the open source versus closed source security debate. Each side provides plausible arguments for the benefits of their own model and points out drawbacks of the other. The proponents of open source argue that the source code is open and available for anyone to see, for many sets of eyes to examine, and is therefore more secure. Opponents of open source say that this "many eyes" theory is irrelevant since the vast majority of users will never look at the source code. Countless arguments ensue from there and can get quite derived, much like arguments over the exact number of episodes of Star Trek.

Looking past these arguments, it's helpful to examine the theory of security as it is approached by open and closed source software organizations. To that end I'll look at the security approach of the Debian Linux project as compared to the security approach of Microsoft - I'll use Microsoft as an example acknowledging the important role that they play as a target of security-related attacks due to their market share in the desktop operating system environment.

Security for both Debian and Microsoft is chiefly accomplished through the use of software patches. Debian issues patches for Debian-specific software problems as well as non-Debian-specific problems. These patches run the gamut of any of the thousands of software packages available with Debian. Some of this software isn't even Linux specific but runs on other operating systems as well, including Microsoft Windows. Microsoft releases patches only for Microsoft-specific software.

With the thousands of software packages available with Debian, security bugs are impossible to avoid. Most updates are not specific to Debian but rather affect the software as it runs on Linux, Mac OS X, and Microsoft Windows alike. Regardless, the software updates become available to users of Debian Linux through the apt package utility. Even if the problem isn't directly related to operating system functionality, the update is easily downloaded and automatically installed. On the other hand, updates for Microsoft through the default "Automatic Update" service consist of what Microsoft terms to be core functions. These core functions include updates to bundled products such as Internet Explorer and Media Player but don't include updates to other Microsoft software such as Microsoft Office, Exchange, SQL Server, and others. Security flaws in this additional software can lead to full compromise of the computer and the data contained therein, as is the case with operating system flaws.

The timing of security updates best reveals the differences in how the two models approach security. One of the aspects of open source security is transparency - virtually as soon as a security flaw, theoretical or practical, is reported, it's released to the general public so that users of the software can take steps to mitigate the effects of the security flaw. A patch follows very shortly after for all of the popular open source software packages. If a patch isn't readily available within hours, the community frequently steps up to release an intermediate patch and to help others mitigate problems associated with the flaw.

On the other hand, Microsoft has undertaken the policy of releasing patches only monthly for the operating system functions. While this results in fewer security notices to the public, it does nothing to enhance security. In fact, releasing patches on a monthly cycle rather than as necessary increases the possibility of exploit. The only people who know about the exploit are the people responsible for finding it and Microsoft. Of course, the people who find software exploits are all honest individuals with no ill intentions, right? Imagine that a burglar found a new way to pick door locks and shared this information with their friends-in-crime, and the police found out about the impending crime spree. Now imagine the police did nothing to alert the public about this danger because they only talked to the public monthly. Transparency and openness of security flaws and defects in products should be demanded by customers for their own safety.

Comparing the security approaches of open and closed source software organizations illustrates the inherent structural differences between the two models. Open source organizations such as Debian believe in greater protection, openness, and transparency of the security process so that their users can protect themselves. Closed source organizations such as Microsoft believe that they know best how, where, and when to disseminate information about security flaws. Unfortunately for users, this means quietly, discreetly, and belatedly.

More Stories By Steve Suehring

Steve Suehring is a technology architect and engineer with a solid background in many areas of computing encompassing both open and closed source systems, he has worked with a variety of companies from small to large, including new and old economy, to help them integrate systems and provide the best use of available technologies. He has also taken a hands-on approach with many projects and frequently leads teams of engineers and developers, and has written magazine articles as well as a book on the MySQL database server. He has also performed technical editing on a number of other titles.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
The 20th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held June 6-8, 2017, at the Javits Center in New York City, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Containers, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal ...
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lead...
The Internet of Things (IoT) promises to simplify and streamline our lives by automating routine tasks that distract us from our goals. This promise is based on the ubiquitous deployment of smart, connected devices that link everything from industrial control systems to automobiles to refrigerators. Unfortunately, comparatively few of the devices currently deployed have been developed with an eye toward security, and as the DDoS attacks of late October 2016 have demonstrated, this oversight can ...
You have great SaaS business app ideas. You want to turn your idea quickly into a functional and engaging proof of concept. You need to be able to modify it to meet customers' needs, and you need to deliver a complete and secure SaaS application. How could you achieve all the above and yet avoid unforeseen IT requirements that add unnecessary cost and complexity? You also want your app to be responsive in any device at any time. In his session at 19th Cloud Expo, Mark Allen, General Manager of...
Bert Loomis was a visionary. This general session will highlight how Bert Loomis and people like him inspire us to build great things with small inventions. In their general session at 19th Cloud Expo, Harold Hannon, Architect at IBM Bluemix, and Michael O'Neill, Strategic Business Development at Nvidia, discussed the accelerating pace of AI development and how IBM Cloud and NVIDIA are partnering to bring AI capabilities to "every day," on-demand. They also reviewed two "free infrastructure" pr...
As data explodes in quantity, importance and from new sources, the need for managing and protecting data residing across physical, virtual, and cloud environments grow with it. Managing data includes protecting it, indexing and classifying it for true, long-term management, compliance and E-Discovery. Commvault can ensure this with a single pane of glass solution – whether in a private cloud, a Service Provider delivered public cloud or a hybrid cloud environment – across the heterogeneous enter...
"Dice has been around for the last 20 years. We have been helping tech professionals find new jobs and career opportunities," explained Manish Dixit, VP of Product and Engineering at Dice, in this SYS-CON.tv interview at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
"ReadyTalk is an audio and web video conferencing provider. We've really come to embrace WebRTC as the platform for our future of technology," explained Dan Cunningham, CTO of ReadyTalk, in this SYS-CON.tv interview at WebRTC Summit at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Extracting business value from Internet of Things (IoT) data doesn’t happen overnight. There are several requirements that must be satisfied, including IoT device enablement, data analysis, real-time detection of complex events and automated orchestration of actions. Unfortunately, too many companies fall short in achieving their business goals by implementing incomplete solutions or not focusing on tangible use cases. In his general session at @ThingsExpo, Dave McCarthy, Director of Products...
The many IoT deployments around the world are busy integrating smart devices and sensors into their enterprise IT infrastructures. Yet all of this technology – and there are an amazing number of choices – is of no use without the software to gather, communicate, and analyze the new data flows. Without software, there is no IT. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, Dave McCarthy, Director of Products at Bsquare Corporation; Alan Williamson, Principal...
Businesses and business units of all sizes can benefit from cloud computing, but many don't want the cost, performance and security concerns of public cloud nor the complexity of building their own private clouds. Today, some cloud vendors are using artificial intelligence (AI) to simplify cloud deployment and management. In his session at 20th Cloud Expo, Ajay Gulati, Co-founder and CEO of ZeroStack, will discuss how AI can simplify cloud operations. He will cover the following topics: why clou...
Video experiences should be unique and exciting! But that doesn’t mean you need to patch all the pieces yourself. Users demand rich and engaging experiences and new ways to connect with you. But creating robust video applications at scale can be complicated, time-consuming and expensive. In his session at @ThingsExpo, Zohar Babin, Vice President of Platform, Ecosystem and Community at Kaltura, discussed how VPaaS enables you to move fast, creating scalable video experiences that reach your aud...
"At ROHA we develop an app called Catcha. It was developed after we spent a year meeting with, talking to, interacting with senior citizens watching them use their smartphones and talking to them about how they use their smartphones so we could get to know their smartphone behavior," explained Dave Woods, Chief Innovation Officer at ROHA, in this SYS-CON.tv interview at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web communications world. The 6th WebRTC Summit continues our tradition of delivering the latest and greatest presentations within the world of WebRTC. Topics include voice calling, video chat, P2P file sharing, and use cases that have already leveraged the power and convenience of WebRTC.
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life sett...
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.
DevOps is being widely accepted (if not fully adopted) as essential in enterprise IT. But as Enterprise DevOps gains maturity, expands scope, and increases velocity, the need for data-driven decisions across teams becomes more acute. DevOps teams in any modern business must wrangle the ‘digital exhaust’ from the delivery toolchain, "pervasive" and "cognitive" computing, APIs and services, mobile devices and applications, the Internet of Things, and now even blockchain. In this power panel at @...
The Internet of Things will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform and how we integrate our thinking to solve complicated problems. In his session at 19th Cloud Expo, Craig Sproule, CEO of Metavine, demonstrated how to move beyond today's coding paradigm and sh...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place June 6-8, 2017, at the Javits Center in New York City, New York, is co-located with 20th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry p...
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.