"cklaus" == Christopher Klaus <cklaus @
shadow .
net> writes:
>cklaus> You dont have any PC's in your company? I guess you guys
>cklaus> have the src code to Windows, DOS, whatever wordprocessors
>cklaus> you have, etc. Correct me if I am wrong, but I bet almost
>cklaus> all companies in the world use software that they dont have
>cklaus> src code for. But maybe yours is an exception.
No mine is not. You just did not understand what I said. I
commented that my company does not allow programs to be sucked off of
the Internet unless the source code accompanies the binaries.
BTW, commercial programs are an exception to our rule because
there are such things as liability laws. If you purchase a program
from Microsquish that happens to contain a virus which trashes your
network, then they are liable. However, if you pick up Joe Shmoe's
word processor off the net and IT trashes your network, good luck
finding Joe.
>cklaus> Even if you have all the src in the world, it does not buy
>cklaus> you security. It may allow you to fix simple security
>cklaus> problems, if you know them and know how to fix them. But if
>cklaus> there is a kernel bug in your machines and no one in your
>cklaus> company knows anything about the kernel nor how to do a quick
>cklaus> fix, having the src doesnt help.
In our case, having the source *does* improve security. For
one thing, many people at my company (myself included) possess
intimate knowlege of the UNIX kernel. Therefore, a quick look at the
system function calls in a set of files provides an easy first line of
attack. Furthermore, having the source to an application allows you
to find a virus/Thorse if you suspect one does exist.
--tOm
--
/---------------------------------------------------------------------/
\ \
/ Thomas D. Nadeau ======== ======== /
\ Internetworking Software ======= ========= \
/ Xyplex, Inc. ======= ====== /
\ 295 Foster Street, ======== == \
/ Littleton, MA 01460 -------======= ------- /
\ ======== == \
/ Voice: (508) 952-4837 ======= ====== /
\ FAX: (508) 952-4887 ======= ========= \
/ email: tdnadeau @
eng .
xyplex .
com ======== ========== /
\ \
/---------------------------------------------------------------------/
Follow-Ups:
References:
|
|
