~ryanlowe/blog: Black Box vs. Crystal Box Development and Security

Black Box vs. Crystal Box Development and Security

Dana Epp has written an interesting post about security of closed source versus open source projects. The main issue I have with it is that he groups all open source projects together. As a whole, they all have different reasons for being and different sizes of teams. They also have different security requirements, which cannot just be generalized under one heading.

While I generally agree as a software engineer that the Build-it Fix-it (BIFI) approach that open source software development uses is not at all secure by itself, the fact that most people don't read the code doesn't make it less secure either.

Some enterprising young hacker would love to be able to brag that he wrote a Linux/Apache/SAMBA exploit and it's getting more attractive every day. It's the same kind of challenge that attracts people to write Windows viruses and worms. That kind of attention on *open* source code only makes it that much better for these projects, even though they use a BIFI process.

The truth is that code audits ARE done on important OSS projects by many people experienced and not and these audits take place over months and years. Many eyeballs make all bugs shallow. The newest Linux kernel won't be considered to be production quality for at least a year but many people will still use it for less than mission-critical things to try to break it. If you want extreme security you stick with Linux kernel 2.4 because it's seen so many eyeballs.

Comparing the two processes then isn't really valid. Projects like the Linux kernel, SAMBA and Apache follow a long, iterative open development process with many developers, testers and (maybe most importantly) users on the bleeding edge. Black box projects like Windows have internal testing, a few external test releases and a handful of outside (but not unpaid) code reviews before it is quite suddenly released into the wild to thousands of users all at the same time, updated on a monthly patch schedule. So of course the black box development style requires a more constructed and thought out process and security auditing because it can't possibly compete with open source software otherwise from a security standpoint. It doesn't seem to have the same level of iterations of development and use, nor the eyeballs on its code.

He does have a point about the rest of the smaller open source projects with less resources being much less secure though. Maybe those projects should be using (generally) sandboxed languages like Java or C#, instead of "vulnerable" languages like C++ (buffer overflows, etc). The authors of these smaller projects should be able to write software without having to worry about larger security concerns, don't you think? A sandbox is the way to go.

Posted at February 16, 2004 at 05:22 AM EST
Last updated February 16, 2004 at 05:22 AM EST

Comments

Ryan,

Do you give out the URL for your blog to prospective employers?

I think if any employer sees your blog, they would hire you right away.

What do you think?

» Posted by: Jimmy at February 16, 2004 03:40 PM

Hey Jimmy,

Yes, my resume that I put on applications is also on this domain (http://www.ryanlowe.ca/resume), so if they go to http://www.ryanlowe.ca, they will see the blog. I've also had people find my resume from my blog and email me about jobs, so it goes both ways.

The idea for this site always was as a way to get a job, I guess. If an employer can see how I think, what I know or how well I write ahead of time he can make a better decision about the hire. Blogs are great for that. One of the most notorious bloggers, Robert Scoble (http://scoble.weblogs.com), got his job at Microsoft because of his blog.

In the same vein though I never talk about interviews or work on this blog except in a general sense. Talking about work is just too risky (information leaks, etc), so I don't do it. I would blog about work if my boss asked me too though -- if it benefitted the company somehow. Like if I worked for Eclipse and wrote tutorials on this blog to help people ... well, I kinda already do that. Companies are starting to realise that if they get real people to talk to their customers and build communities they can make more money. Who'da thunk it eh?

» Posted by: Ryan at February 16, 2004 05:03 PM

Agreed that the blog is a great tool for letting employers know how you think and what you know, but I disagree with the fact that employers are going to come looking for you.

I think I expressed this before, but recruiters/HR people are lazy by nature. Unless you get lucky and have a PRO-ACTIVE director of IT at a software company come across your site, you aren't going to be found (even if you aren't looking ;)

HR process is the same everywhere. Word docs are king... I know a number of IT recruiters who don't venture outside the realm, especially to view websites which involve a lot of reading, etc... they like to be able to print/send resumes in a way that people are use to.

» Posted by: Travis at February 17, 2004 10:30 AM

Agreed that the blog is a great tool for letting employers know how you think and what you know, but I disagree with the fact that employers are going to come looking for you.

Sucks, but it's the truth.

» Posted by: Travis at February 17, 2004 10:30 AM

how did that happen?

weird... hope my point got across ;)

» Posted by: Travis at February 17, 2004 10:31 AM

Oh definitely, I'm not writing this blog for recruiters. They wouldn't know what I was talking about anyway. I'm writing it for developers who would refer me to recruiters or get me in for an interview themselves.

Besides that, I don't expect anyone to come looking for me here. It would be more by chance or if they read my resume or if I was linked from another blog. So the blog is definitely a secondary thing when looking for a job, but it's good to have.

» Posted by: Ryan at February 17, 2004 11:14 AM

BTW, I'm still not actively looking for a job. I'm still taking a break and working on AudioMan for the most part. I'm learning a heck of a lot, that's for sure.

» Posted by: Ryan at February 17, 2004 11:20 AM

learning is overrated I think... I like to use the 'learn as I go' method of career movement... that way I don't waste time learning stuff I'm never going to use.

and look where that got me... New Hampshire.

» Posted by: Travis at February 17, 2004 03:43 PM

Ha, ya good point. Maybe I can get to Delaware the same way ... always wanted to go there. 8-)

» Posted by: Ryan at February 17, 2004 05:18 PM