1.3. Is Open-Source Code Secure?

1.3. Is Open -Source Code Secure?

The contention that open-source code programs are more reliable and secure will hold no water. Windows XP has proven to be highly reliable and secure despite being a commercial product. Most importantly, any bugs in this operating system are timely corrected, with patches that are available for free download and are easy to install.

Those who argue in favor of this assertion believe that an open-source code system is tested by a huge number of people on the code level who discover all possible errors. Yes, testing for errors on the code level concurrently with testing the ready product is easy and effective, but the results of such testing are far from ideal. Even after extensive testing by thousands of users, errors crop up in Linux. Moreover, judging from the army of users that tested the latest Windows versions, you would think that it would finally become the perfect operating system. We do know better than that, don't we? Testing is one thing, but running under real-life conditions is another, with unpredictable results popping up.

The advantage of Linux being open source is an excellent value-to-dollar ratio. But although you save a significant deal of money on the cost of the operating system, you incur expenses on its support.

Linux support is rather expensive, so you might encounter problems obtaining timely updates. Moreover, administering Linux is more difficult than administering Windows. It does not have wizards or help windows to make your life easier by telling you what button to press and when to do this. You are supposed to know the Linux commands and be able to use them without outside help. These factors make Linux more difficult for the average home user , and this is why it has not become a common operating system on home computers.

But why is Linux so difficult to master? The answer is simple: Performance and convenience are two incompatible things. Linux is a performance product, and Windows is a convenience product. To do something in Windows, you just need to go through a series of dialog windows, choosing from the available options. But this requires making lots of clicks, which in turn consumes lots of precious time. To do the same thing in Linux, you just launch the console and run the necessary command, which is much faster. But the problem is that you have to remember lots of different commands for all occasions.

Windows uses images and a graphical user interface wherever possible. Graphical utilities in Linux are too unsophisticated and often do not offer many features. This, however, is changing as graphical configuration utilities are becoming available in ever increasing numbers , making the configuration process simpler and easier. It is only a matter of time before Linux becomes easy to use while preserving all of its power and the speed of the command line interface.

Because Linux configuration is a fairly complicated process requiring a high level of proficiency, incorrectly configured systems often become targets of successful hacker attacks. The default configuration of any operating system, be it Windows, Linux, or Mac OS X, is far from ideal. Security is often sacrificed for performance or convenience. For example, some programs may have options that make the administrator's work easier (e.g., the PHP interpreter may have the debug option enabled) but at the same time make it easier for hackers to break into the system. This is why system security is directly dependent only on the person who services it.

You task is not to simply learn to work with Linux but to learn to do so efficiently , meaning that you should be able to configure it for maximum performance and security. This will be your main goal as you use this book.

Nevertheless, Linux security is higher than that of Windows, and this has nothing to do with it being open source. Simply, many security- related aspects in Linux are implemented better than in Windows. Take, for example, memory allocation. When a program is run, it is allocated a certain memory area. In Linux, under normal circumstances a program cannot overstep the bounds of the allocated memory. It can do this only in extreme cases to exchange data with other programs. In Windows, any program can access any memory area. Overstepping the allocated memory area is fraught with the danger of the program mistakenly overwriting a memory area allocated to another program or even to the system itself, causing the system to crash in the latter case.

Starting with Windows 2000, the memory subsystem operation has been improving in this brand of the operating system, but it still has lots of room for improvement. For example, Linux can clear the program's memory area after its termination because it knows exactly how much memory and at what address it allocated memory for the program's needs. The same maintenance task is more difficult to implement in Windows, so you can only rely on the quality of the application software, which is unlikely to improve. Thus, there is constant memory leakage in this operating system.