The Problem with Open Source is it’s Open Source

Just because something is open source doesn't mean we can't have a rational conversation about whether it's well-designed.

Of course the counter is that the problem with Closed Source is that it's Closed Source and only a handful of people find and fix bugs, or find potential security vulnerabilities. This is of course one of the driving ideas behind OSS, that, as Eric S. Raymond said, "given enough eyeballs, all bugs are shallow".

I hesitate to go so far as to call this post a troll, but the author is making very broad statements based on a very small sampling.

Source code is highly overrated, when an attacker can take advantage of known classes of security problems and successfully exploit them without the bother of even looking at the source code.

See recent twitter XSS attack, SQL sanitization attacks, etc.

I think the better point to be learned here is administrating any public facing server has to be more than a hobby. The barrier of entry to installing WordPress or PHPBB is extremely low. Anyone can do it. Only a small subset of those people will ever take the time to understand security issues and keep their servers patched. I mostly blame the "I read a 2 page HOWTO now I'm an expert!" types. Pay someone to take care of the details if you don't want to handle it yourself. I've previously used Blogger (recently switched to SquareSpace) for exactly this reason. I don't want to spend my free time installing patches and checking logs. (I do enough of that at work)

This doesn't sound like the right argument to me.

There are lots of link spammers out there. Their goal is to make garbage sites seem more "important" to search engines by increasing the number of unique sites that link to them. WordPress is targeted because it is a popular enabler of web sites, that can essentially be used to make hundreds of unique sites do your bidding.

I have seen similar problems with any pervasive site technology. For instance, I've seen public wiki pages vandalized ("talk" pages with hundreds of lines of links to garbage sites, presumably to make Google find them more relevant). And I've seen problems with PHPBB forums (new "accounts" with profile links to "home pages" that are really just more spam for Google to find). These things don't happen because someone goes to one site, they happen because robots target the popular technologies and try to automatically find sites on the web that are exploitable.

You see this with closed-source pervasive technologies (like Windows). It's pretty clear that seeing source code is not necessary to repeatedly perform devastating hacks.

In all cases, the correct solution is vigilant and competent administration. Of course if you never change the defaults, you're more vulnerable. Of course if you don't patch your server regularly (these tools are constantly improved), you're open to old hacks. And ultimately, if you choose the popular tool, you can expect more frequent issues.

Since his only examples are wordpress and phpbb wouldn't it be more accurate to say that php sucks? Or that programmers who code in php tend to do a poor job?

No, I don't like this article, either. However, buried in it is a worthwhile idea, I think.

In particular, he notes that publishing source code makes vulnerabilities easier to find. True, obviously. I would note that it also makes them easier to fix. Now, we could get into a fight over whether "find" or "fix" is more important. But instead, let's observe that making software open-source, significantly changes the security dynamic.

Thus, we can ask, "What does it take to make closed-source software secure?" and "What does it take to make open-source software secure?" Whatever the answers may be, it is likely that they are different answers.

Troll.

What he's really saying is not that Open Source is worse than closed source, but that Open Source is more vulnerable to hacker attacks, because malicious users can use the source to find security holes. Makes perfect sense to me.