Slashdot Mirror
Study Says Open Source Software a Security Risk
chareverie writes "Fortify Software released a study where they concluded that open source software poses a large security risk to corporations who have implemented it. They reason this by stating that the fault lies within the open source communities and their failure to adhere to minimum security practices. Fortify Software studied 11 open source software packages, where the application server Tomcat was determined to be the best. The other 10 were found to have poor results, with those being Derby, Geronimo, Hibernate, Hipergate, JBoss, Jonas, OFBiz, OpenCMS, Resin and Struts. Jacob West, manager of Fortify's research group, reminds that purpose of the study was 'not to condemn open source software, but rather to point out that the security practices need to improve because open source adoption by enterprises and governments is growing.'"
Wait, so you're saying a vendor of proprietary security software is criticizing FOSS security?!?
Why, this is just too much, how will we ever recover? And they even based it on 11 whole OSS projects... Game over!
Caveat Utilitor
Derby, Geronimo, Hibernate, Hipergate, JBoss, Jonas, OFBiz, OpenCMS, Resin and Struts
While we use tomcat, thankfully we don't use any of the others (in fact, I haven't even heard of several of them). As an example, we use Alfresco as our cms. If it ever caused security concerns, we could switch to a different open source cms. This would probably be quite a bit tougher if you were stuck with a single closed source package (and good luck finding out which "minimum security practices" a closed source vendor uses).
Tomcat and OpenCMS, to be specific. And I don't use any of them.
This might be interesting news to me if they found problems with: Apache 2, PHP 5, Wordpress, Gallery 2, or Python 2.5, which is basically what my site runs on.
And yes, I know there's security problems with PHP and Wordpress. I'm just pointing out that they aren't targeting more popular software; wonder why?
~ C.
Since Fortify is a security firm, it's obviously in their best interest to have everybody using 100% Microsoft products.
Have you read my blog lately?
How can you expect decidedly anti-corporate open source to have decidedly corporate security regimes?
There WILL be vulnerabilities, but at least you MIGHT know about them in time to do something.
This is a HR problem for said organizations.
This study doesn't show OSS is a risk at all. They forgot to compare it with proprietary software. Without such a comparison you can't tell wether OSS is worse. For all I know 10 out of 11 proprietary software packages would have issues too.
closed source software a security risk
Research has shown that closed source software poses security risks.
do i have to give out any examples ? how long does it take microsoft to fix issues and holes with asp, or windows ?
Read radical news here
I'm not an expert on open source and security but I get the feeling that the authors judged open source software based on closed source standards. They author complain that disclosing security issues with general bugs was a problem. Did the author not understand that full disclosure is one of the tenets of open source? The last gripe is that the service wasn't the same with lack of contacts and responses. Judging by the summary it appears that the author just monitored the community forums. Did the authors even pay for support? When you pay for software and support, you should get it. When you don't pay for software or support, why should you deserve service?
Well, there's spam egg sausage and spam, that's not got much spam in it.
Eric S. Raymond discusses the recent Microsoft security debacle in which an engineer inserted a back door in a library that allowed access with the phrase 'Netscape engineers are weenies!' The article notes that 'Apache will *never* have a back door like this one.
http://linuxtoday.com/stories/20234.html
Read radical news here
Closed source/propetiary software doesn't adhere 100% to industry "best" practices, such as providing a prominent link to security information on their Web site either.
It's just not as easy to see where closed source is lacking, because, well: you don't have the source to conduct research into the security flaws.
If the source was not public, you in many cases, would have never known that X practice wasn't being followed by certain elements of the software.
Closed software can ignore practices whenever convenience, and since the source is closed, they are all but immune to this type of analysis.
A true comparison requires actually obtaining the source to proprietary software and using that to its full advantage to find security flaws.
Studies also conclude that lunixes is a big intellectual IP property ripoff doomed to failure, laptops will completely replace desktops in ten years, and piracy is a really big problem that's sending business after business into bankruptcy.
It's wonderful how you can release any anecdotal evidence from a limited perspective as a marketable 'study'.
I'm releasing a study on how interest groups posing as reputable and productive companies pass bullshit around like the flu.
"Most people, I think, don't even know what a rootkit is, so why should they care about it?"
That list is a bunch of unrelated packages. Hibernate is not an application server, it is an ORM. OFBiz is an automation framework that runs on top of an application server. Hipergate is a collection of various web apps that run on an application server.
.NET, Matlab, and Age of Empires."
They also forgot to have a proprietary package -- so the comparison is between open source packages. They might as well say, "Proprietary software poses a security risk. We've evaluated
Palm trees and 8
Don't they know OSS is PERFECT in every possible and imaginary way!!!! :)
yes why don't we all dev software behind closed doors and pray nobody find the holes....like Diebold
Why don't the closed source company's show us there code are they afraid we will see it's all half-assed security...
Closed source is based on lies!!!
Is obviously to do a study on software no-one's EVER heard of.
Well, that's not true, I've heard of tomcat, the most secure thing there, what a surprise.
How about they study software people actually use? Like Linux, Apache, Python, PHP etc.
I wonder if it's because the last times studies were done on those it was found that they were far more secure than closed source software, in a US GOVERNMENT FUNDED STUDY
FTFA:
The projects in question:
Tomcat, Derby, Geronimo, Hibernate, Hipergate, JBoss, Jonas, OFBiz, OpenCMS, Resin and Struts.
For those who don't play in Java often:
Derby is an embedded database.
Tomcat, Geronimo, JBoss, Resin and JOnAS are Java (EE) app servers.
Hipergate and OpenCMS are (you guessed it) content management systems.
Hibernate is a persistent framework.
Struts is a web framework.
So of any of these, it seems that the only projects that would be open to XSS or SQL injection would be the CMS products. Unless they're referring to the web administration for the app servers?
The only way to have SQL injection attacks in javaland is if you're not using prepared statements or if your database driver isn't preparing/escaping properly.
So they're saying two CMS projects have tens of thousands of XSS and SQL injection vulnerabilities?
[guess]closed source is full of snagged open source code. That's one of the real reasons they want to keep it closed forever, legal liability.[/guess]
"Fortify identified a total of 22,826 cross-site scripting and 15,612 SQL injection issues associated with multiple versions of the 11 open source software packages examined. "
By multiple versions, do you mean they summed the bugs found across all versions released, so a program in version 1.23 which fixed a SQL injection in 1.22 gets nailed for it in 1.1, 1.2, 1.3... 1.22?
This just in: releasing more versions multiplies the storage space required to store all versions of the software, thus Windows, with its 6-7 versions has a tiny footprint when compared to a monolith like Linux with its 26 bloated 2.6 kernels (we'll be kind and not even count the 2.4 ones). Everyone should move to Windows (study sponsored by a not-fully-owned-subsidiary-of-Microsoft
Since Fortify is a security firm, it's obviously in their best interest to have everybody using their own products.
There. Fixed that for ya.
Is it just me, or is this survey extremely Java heavy?
Not only that, but there are a good number of Apache projects in particular... Apache Tomcat, Apache Geronimo, Apache Derby, Apache Struts...
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
This is a weak article about a specific set of open source projects designed to keep CIO's and CTO's from jumping off the Windows turnip truck.
FUD... it's what's for dinner.
On other news studies show that most studies are biased and wrong.
Can you feel that? The universe just imploded.
"we've got trenchcoats and bad attitudes" - John Constantine, HellBlazer
News Flash: researchers have released a study demonstrating that studies can conclude whatever you want them to conclude.
According to the article, the biggest security risk of Open Source Software is the lack of a support hotline number.
"security practices need to improve because open source adoption by enterprises and governments is growing"
So these fortify people think security has to improve not because of the adverse effects it can have on users at large, but specifically because of the adverse effects on enterprise and government.
Oh yea, thats the reason i donated my time the open source community, to help enterprise and government. After all, they are all about helping the people. I never did it to try help the little bloke. /sarcasm
Have you voted yet? Apparently, about 80% of the readers of that article "doesn't get it", and votes the opposite of what the article is trying to push across....
Some asshat in a big office thinking to himself, "how can something written by lots of people in a community be more secure than something written by lots of people in a corporate HQ". The problem is not open source, i dont nessecaraly think its a propriatry problem either. Its absoulutly clueless people pulling 6 figure salaries making infrastructure desicions based on nothing more than what they "KNOW" to be true.
Well, Bart, your uncle Arthur used to have a saying: "Shoot 'em all and let God sort 'em out."
very good point.
9/10 dentists agree that you should brush your teeth.
The other dentist wants more business.
Yes, it's Java-heavy. The study author sells a proprietary static analysis tool for Java. So the Java bias is understandable, but their title should have made it clear that they were only analyzing a few Java programs, and not a representative sample of major OSS projects. They also ignored the enterprise support options for these programs, which is completely unjustifiable.
I think its Java bias matters. Until very recently, most Java programs required Sun's proprietary Java implementation. The FSF and others warned of the Java Trap - so a very large proportion of the FLOSS community has actively ignored these Java programs. Sun has recently released most of its Java implementation as FLOSS, and the most recent versions of Fedora and Ubuntu have now integrated it (through Debian hasn't), so I think we'll start to see more cooperation in Java projects.
They made three claims, let's take a look at them...
"Failure to Provide Access to Security Expertise... [aka] documentation that covers the security implications and secure deployment of the software they develop, a dedicated email alias for users to report security vulnerabilities, or easy access to internal security experts to discuss security issues". Odd, they seem to be ignoring the enterprise versions (e.g., Red Hat sells JBOSS support); that doesn't seem to be a fair methodology. Their demand for a "dedicated email alias" and "easy access to internal security experts" shows that they fail to understand that some people want totally open discussions, which these projects do support. They may not LIKE that, and actually I'd agree with them, but claiming that there's NO way to report vulnerabilities or to talk with developers seems fundamentally mistaken. I agree with them that documentation about security needs improvement, though I don't see any evidence that FLOSS is worse than proprietary on that count.
"Failure to Adopt a Secure Development Process... In virtually every project analyzed, there were a significant number of security issues that went unaddressed over three generations of releases...". It's not clear what these "issues" were. Were these REAL issues, or just reports from a static analysis tool? I wish they'd gone more into this, it's hard to say this is really true or not given their report. Often static analysis tools' reports have LOADS of false positives. As a result, it's hard to see if this is real or not.
"Failure to Leverage Technology to Uncover Security Vulnerabilities: The number of security issues identified in the study - especially in the most popular open source packages - was surprising...". Again, not surprising if what is being measured is raw unanalyzed tool output. It could be that every single "vulnerability" is a false positive (not an uncommon result, unfortunately). I would agree with them that I'd like to see more projects use more tools, but a lot of FLOSS projects do use tools. For example, the Linux kernel developers ended up creating their own static analysis toolsuite because tools are normally designed to analyze applications, not kernels.
The claim that this is representative of FLOSS is unfounded, since it only considers a few Java programs and ignores their enterprise support options (which is what you'd use for an enterprise!). I really wish they'd explained what they meant by issues; the problem of tool false positives is very well known, and I don't see that they really addressed that.
The original said: "Government and commercial organizations that leverage open source should use open source applications with great caution. Risk analysis and code review should be performed on any open source code running in business-critical applications...". Um, let's try: "Government and commercial organizations that leverage software should use software with great caution. Risk analysis and code review should be performed on any software running in business-critical applications..."
- David A. Wheeler (see my Secure Programming HOWTO)
is supplied by these bastards. Looks like they run a very unethical shop all the way. Bet they're swimming in dirty dollars.
1. Make up your own definition for what good security is.
2. Pick 10 OSS projects that fail to follow that definition.
3. Release headline "OSS software a security risk"
4. ???
5. Profit! (From whom though?)
Copyright infringement is "piracy" in the same way DRM is "consumer rape"
I'm a DBA for a USAF Enterprise Java app. Recently, we underwent a security audit which involved a Fortify scan.
What makes this so interesting is that one of the Fortify findings was the lack of full implementation of Struts in the application, which we're in the process of correcting.
I find it quite funny that they're finding fault with Struts, which they recommend using in their security scans. Ah, Irony. How I love thee.
I have no regrets, this is the only path.
My whole life has been "UNLIMITED BLADE WORKS"