On BNET: Gen Y: Your degree doesn't cut it
BNET Business Network:
BNET
TechRepublic
ZDNet

Talkback

Add your opinion
advertisement

From our video sponsors

advertisement
Open source security

Open-source software developers often rely on the "many eyeballs" theory to ensure security. Brian Chess of Fortify Software says this process is ineffective, and urges users to hold developers accountable.

Hi, I'm Brian Chess, Chief Scientist for Fortify Software, and today I'm going to talk about Open Source Security and why the many eyeballs theory just doesn't work. Now I'm a big fan of open source, but the many eyeballs theory has some problems. Before I tell you about what those problems are, I've got to explain what the many eyeballs theory is.

So imagine you're a software developer and you put some software out there on the internet. Here's your program. And you expect that a lot of people are going to download it and check it out. Now of course, all software has bugs in it. So, you might expect that your software is going to have some bugs in it, too. Now because you've got all these people who've got access to your source code, they're going to tell you about those bugs and you're going to be able to find some of them and get rid of them.

So they found some of those bugs and some of those bugs have security implications, so you wipe those out. So does that make your software more secure? Well, some of those bugs are still there, and that means big security problems. Let me give you an analogy to explain why this theory just doesn't hold water.

Imagine you've got a park, and you'd like to keep your park clean. So what are you going to do, ask the litter patrol to come in after hours and try and clean things up? No, that's not how we keep our parks clean. Instead we put up signs and tell people hey, nobody appreciates litter. We make sure that there are plenty of trash cans around so that people can do the right thing.

So that's what we need to do with software development, too. We need to educate software developers and make sure that they know how to create secure software. We need to give them the right tools, we need to give them the right programming languages so that they can write secure software. But in the end, we can't rely on people who are using open source software in order to make sure that the software is secure. We've got to have the developer be accountable for the software that they create.