On 5/17/06, Brian Raymond <email@hidden> wrote:
I've used all of those arguments as well to fight for OSX/Linux/Solaris (used the closed source = security argument for Solaris in the past) in different environments to justify differnet things so I know very well how that can work.
I fought the "closed source = security" battle in the past at DISA in front of some high ranking officials and I have kept up with that fight in my current work and although that argument still holds a lot of strength it is being eroded away. Security through obscurity has won a lot of battles but hopefully in the not too distant future the general consensus will be that "security through obscurity" doesn't in itself imply a solution is more secure (read: closed source = high security).
I didn't go far enough to say "security through obscurity is no security at all" because that argument will take a long while to win.
Next time they argue in favor of closed source and "Microsoft only", ask them what happens if Bill Gates decides he likes the Taliban... do we really know that there is nothing in Windows that will bring us crashing down? Or hell, even a programmer at MS... what if they put in a little hook themselves.. similar to an Easter Egg only a lot more violent.
mike
