I'd like to add that our black hat adversaries are definitely sold on Open Source: (1) Their OS of choice is Linux, not anything manufactured by Microsoft, as they themselves don't like to be the target of successful penetration attacks; (2) They describe their exploits in painstaking details, and attach their attack scripts so that the script kiddies can see for themselves that these exploits work; (3) They certainly subscribe to the Open Source concept since they will post successful exploits on various black hat site sites. This enables news of exploits as well as exploit methodologies to spread very quickly.

Given the single-minded dedication of some of the most talented of our black hat adversaries, our best counter is Open Source disclosure of exploits as well as swift corrective action, and of course building security in our designs instead of patching in security as an afterthought. We have to be as fast on our feet, as thorough and as motivated as the most effective of our black hat adversaries. Otherwise, they'll kill us and the Open Source movement, too.
I note that this hack writer from ADTI has not been forthcoming at disclosing his technical qualifications, probably because he does not have any technical qualifications to disclose.

The NSA thinks highly enough of Linux to use it internally and to have posted a "Security-Enhanced" version of Linux for public access - Does Microsoft think it is as good as the NSA in matters of computer security? I'd let ADTI keep ranting on the "risks" of moving from a proprietary OS to an Open Source OS: I'd rather watch ignorants and fools destroy their credibility in their own words rather than engage in a debate with them - My momma always said: "You yourself are a fool if you argue with fools". And I always said to my little brother: "Kill'em [fools], wipe'em out but don't argue with them!" The word "debate" implies that they are my intellectual and professional equal, and this hack writer from ADTI clearly has not said or done anything that shows that he is anyone's intellectual and professional equal.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/89/13173#13173