By and large, I think open source is a huge win for security. At the same time, if you made a list of the top security debacles of the last 20 (fuck I'm old) years, that list would certainly include:
* Sendmail
* BIND
* CMU SNMP
* WordPress
All of these are open source.
Also, while the list would clearly be headed by Microsoft Windows, commercial software can do something open source can't. Pre XP SP2, Windows was a debacle. Then Microsoft spent 8-9 figures on security, and within 4 years, MSFT led the industry in code security. Sendmail is still a bad bet.
Again, don't get me wrong. If you have a choice between a random open source project and a random commercial project, and each is over some reasonable threshold of popularity, you're better off with the open source project almost every time. If you're a closed-source vendor and you aren't Microsoft, chances are your code is quite poor. It is at least harder to hide sheer awfulness in open source code.
But in any case, the reason I commented was, we can't cop out on the WordPress security debate by saying "it's open source, so the standards are different". WordPress is the Sendmail of our times. Lots of pro-bono effort went into it, but that can't obscure the fact of its very poor security design.
* Sendmail
* BIND
* CMU SNMP
* WordPress
All of these are open source.
Also, while the list would clearly be headed by Microsoft Windows, commercial software can do something open source can't. Pre XP SP2, Windows was a debacle. Then Microsoft spent 8-9 figures on security, and within 4 years, MSFT led the industry in code security. Sendmail is still a bad bet.
Again, don't get me wrong. If you have a choice between a random open source project and a random commercial project, and each is over some reasonable threshold of popularity, you're better off with the open source project almost every time. If you're a closed-source vendor and you aren't Microsoft, chances are your code is quite poor. It is at least harder to hide sheer awfulness in open source code.
But in any case, the reason I commented was, we can't cop out on the WordPress security debate by saying "it's open source, so the standards are different". WordPress is the Sendmail of our times. Lots of pro-bono effort went into it, but that can't obscure the fact of its very poor security design.