Language Selection

English French German Italian Portuguese Spanish

The Truth About Open Source Security

Filed under
OSS

Open source software -- it's fast, it's popular, it's practical, and, best of all, it's free.

Chances are (if your firm is like most) you're using some of it somewhere in your enterprise; in fact, you're probably using it in multiple places. One of the most frequent questions security professionals get asked is how open source compares to its commercial counterparts from a security perspective.

There are a number of well-respected individuals arguing on both sides of the "open source security" fence: some say that the fact that open source code is transparent and freely available helps make open source more secure than commercial software.
On the other hand, there are other well-respected individuals who claim that lack of contractual agreements between vendor and purchaser in the open source world makes open source deployments less secure.

So which is it? Is it better to run your company's firewall or IDS using an open source tool, or is it better to buy something off the shelf? Let's step through some of the most common arguments used by each side of the open source security debate and see how they do or do not stand up in the light of practical reality.

Full Story.

More in Tux Machines

today's howtos

Linux 4.15, Linux 4.16, and Linux Foundation's CNCF and CII

  • Linux 4.15 Gets Fixed To Report Current CPU Frequency Via /proc/cpuinfo
    A change recently in the Linux kernel led the CPU MHz reported value via /proc/cpuinfo to either be the nominal CPU frequency or the most recently requested frequency. This behavior changed compared to pre-4.13 kernels while now it's been fixed up to report the current CPU frequency.
  • Linux 4.16 Will Be Another Big Cycle For Intel's DRM Driver
    We are just through week one of two for the Linux 4.15 merge window followed by eight or so weeks after that before this next kernel is officially released. But Intel's open-source driver developers have already begun building up a growing stack of changes for Linux 4.16 when it comes to their DRM graphics driver.
  • CNCF Wants You to Use 'Certified Kubernetes'
  • Open Source Threat Modeling
    Application threat modeling is a structured approach to identifying ways that an adversary might try to attack an application and then designing mitigations to prevent, detect or reduce the impact of those attacks. The description of an application’s threat model is identified as one of the criteria for the Linux CII Best Practises Silver badge.

Linux World Domination and Microsoft Corruption in Munich

Programming/Development: 'DevOps', NumPy, Google SLING

  • 5 DevOps leadership priorities in 2018
    This week, DevOps professionals gathered in San Francisco to talk about the state of DevOps in the enterprise. At 1,400 attendees, the sold-out DevOps Enterprise Summit has doubled in size since 2014 – a testament to the growth of the DevOps movement itself. With an ear to this event and an eye on the explosion of tweets coming out of it, here are five key priorities we think IT leaders should be aware of as they take their DevOps efforts into the new year.
  • NumPy Plan for dropping Python 2.7 support
    The Python core team plans to stop supporting Python 2 in 2020. The NumPy project has supported both Python 2 and Python 3 in parallel since 2010, and has found that supporting Python 2 is an increasing burden on our limited resources; thus, we plan to eventually drop Python 2 support as well. Now that we're entering the final years of community-supported Python 2, the NumPy project wants to clarify our plans, with the goal of to helping our downstream ecosystem make plans and accomplish the transition with as little disruption as possible.
  • Google SLING: An Open Source Natural Language Parser
    Google Research has just released an open source project that might be of interest if you are into natural language processing. SLING is a combination of recurrent neural networks and frame based parsing. Natural language parsing is an important topic. You can get meaning from structure and parsing is how you get structure. It is important in processing both text and voice. If you have any hope that Siri, Cortana or Alexa are going to get any better then you need to have better natural language understanding - not just the slot and filler systems currently in use.