This question was brought up recenly in a forum I frequent, and I decided I should go on the record here on the blog. In short, my view is this:

I believe, as many others do, that it doesn’t necessarily mean anything at all, in terms of security, for a project to be open vs. closed source. It’s all about the quality of the work being done on a given project.

100 highly-skilled, security-oriented programmers working diligently on a closed-source project are likely to produce superior code to that of 1000 untrained hobbyists.

The concept of many eyes only works when the quality is the same, i.e. 1000 vs. 10,000 developers of comparible skillsets. When the quality of the work on a project is different, i.e. the closed-source coders are superior to their open counterparts (or vice versa), it’s that work quality that determines the code quality, not the development model.

This 1901 illustrated article from Pearson’s Magazine describes an unstoppable technique for defending yourself with a cane or umbrella:

An excerpt:

“You should aim a vicious blow at your assailant’s head, holding your hand very high in order to force him to guard high. Simultaneously, you should jump forward from the attacking position, shown in the second photograph, to the position shown in the third photograph, and strike him with the open hand high up on the chest, pulling his foot away from beneath him at the same time — in order to disturb his balance, and destroy his power to hit you. You could now strike your adversary such a blow with your fist on the face as to render him unconscious, or, of course, you could belabor him with your stick if it were suitable for the purpose.”

This is so excellent:

“Internet Explorer has been losing market share to the upstart Web browser. In the past few weeks, Microsoft Corp.’s dominant browser lost an additional 1.5 percentage points to fall to 90.3 percent of the Web browser-using public, according to Web research company WebSideStory Inc. Simultaneously, the Firefox browser rose 0.9 percentage points to reach 5 percent.”

Too little, too late.

/. just posted a link to the Coyotos project — a project that purports to focus primarily on security. It’ll be interesting to watch it develop.

Originally from Mike Gancarz’s book, here are the 9 main tenets of Unix.

Learn them; live them.

I. Small is Beautiful II. Make Each Program Do One Thing Well III. Build a Prototype as Soon as Possible IV. Choose Portability Over Efficiency V. Store Data in Flat ASCII Files VI. Use Software Leverage to Your Advantage VII. Use Shell Scripts to Increase Leverage and Portability VIII. Avoid Captive User Interfaces IX. Make Every Program a Filter

Eric Raymond’s quite a character. Check out this thought he just posted on his blog:

I believe, but cannot prove, that global “AIDS” is a whole cluster of unrelated diseases all of which have been swept under a single rug for essentially political reasons, and that the identification of HIV as the sole pathogen is likely to go down as one of the most colossal blunders in the history of medicine.

Brian Hook, know for his work at Id, had this to say about programming in ActiveX:

I’ve been doing some ActiveX coding on the side for a couple days, stuff I’m not familiar with, and I’m just flat out appalled at how bad that entire API and design is. I can make an OCX that basically formats your hard drive, stick it on a Web page with a tag, and if your security settings are set low enough, you’ll start formatting your hard drive the minute you visit my Web page.

Yet somehow Firefox is managing to become successful without this feature…

An excerpt from a CNN Money article:

A charismatic leader who said he ate a McDonald’s product most days, Bell was diagnosed with colorectal cancer just weeks after being named to the company’s top job in April.

We can only hope this is crap:

WASHINGTON (CNN) — The Bush administration has been carrying out secret reconnaissance missions to learn about nuclear, chemical and missile sites in Iran in preparation for possible airstrikes there, journalist Seymour Hersh said Sunday.

I can’t help but be reminded of the Palestinian struggle here. You have a group of people who are supposedly trying to do the right thing, but are using violence to accomplish it. What both groups fail to see is that their actions are playiing directly into the hands of the enemy. For the Palestinians it’s Israel, and for the U.S. it’s the terrorists.