Response team boosts open-source security
OCERT steps in to help bridge the communications gaps
PC World - IT managers often assume that open-source software is more secure than proprietary commercial software. Anyone who uses open source can examine the original code to spot any lurking vulnerabilities, and potentially even fix the vulnerabilities themselves. With proprietary software, you have to trust the vendor to do it all for you.
But open source's supposed security advantage assumes three things: 1) someone is actually looking at the code, 2) security vulnerabilities are getting reported and fixed, and 3) information about those fixes makes its way to Linux distributors and other software vendors, which apply the fixes to their products. But what things aren't happening? As a customer, how can you be sure?
A new initiative aims to help. Founded in March, Open Source Computer Emergency Response Team (oCERT) was specifically created to act as a clearinghouse for security information about all kinds of open-source software.
Say you're a small open-source project -- maybe you only provide a library of code that's used in other larger applications. As a two-person effort, you don't have time to contact everyone who uses your code to let them know about a recent security flaw. That's where oCERT can step in to alert everyone. Similarly, large Linux distributions, which incorporate hundreds or even thousands of different open-source projects' code, can work with oCERT to make sure all the holes get plugged in all the right places.
Open-source users can help the oCERT effort, too, by reporting security incidents. If you're a business that is experiencing a potential software exploit, oCERT can offer reliable security contacts in the open-source community that can help you plan and coordinate your response.
In keeping with open-source tradition (and open-source budgets), oCERT is a volunteer effort, and it provides its services free of charge. The team's operating costs are underwritten by corporate sponsors -- most recently Google Inc., which posted a detailed summary of why this effort is so important to a blog on Monday.
All in all, oCERT sounds like a worthwhile project that will provide a valuable service to the community of open-source vendors and customers. Let's hope it wins enough support to sustain itself for the long run. (That name might be a problem, for starters -- CERT is a trademark of Carnegie Mellon University.)
- Coding with JRebel: Java Forever Changed With JRebel, developers get to see their code changes immediately, fine-tune their code with incremental changes, debug, explore and deploy their code with...
- eBay uses 100% OpenSource WSO2 ESB to process more than 1Billion transactions a day Along with eBay's success comes a huge demand to ensure reliable, 24x7 availability of the services that enable these transactions. For eBay, that...
- What Developers Want: The End of Application Redeploys Eliminate application restarts in Java with JRebel! JRebel is a JVM plugin that eliminates application redeploys from the Java development cycle, a process...
- How a German energy company saved 1 day per week of development time with JRebel Check out the following case study to see how Heliocentris, a global energy supply and efficiency company deployed a development solution that was...
- Is SQL Server AlwaysOn really as powerful? Tips and Tricks from the field With the introduction of AlwaysOn, Windows Clustering Services is now more critical than ever.
- What Does it Take to Deliver a Superior Customer Experience? The Two Top-Rated Online Retailers, B&H Photo and Crutchfield Electronics, Share Their Secrets Discuss practical CX tools and service methods such as contact center agents and the use of realtime speech analytics to help contact center... All Open Source White Papers | Webcasts