<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Op/Ed: Why Releasing Server Code is A Terrible Idea</title>
	<atom:link href="http://alphavilleherald.com/2008/03/oped-why-releas.html/feed" rel="self" type="application/rss+xml" />
	<link>http://alphavilleherald.com/2008/03/oped-why-releas.html</link>
	<description>Always Fairly Unbalanced</description>
	<lastBuildDate>Tue, 04 Oct 2016 13:18:56 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.1</generator>
	<item>
		<title>By: Adipex phentermine.</title>
		<link>http://alphavilleherald.com/2008/03/oped-why-releas.html/comment-page-2#comment-15750</link>
		<dc:creator>Adipex phentermine.</dc:creator>
		<pubDate>Tue, 22 Sep 2009 15:09:59 +0000</pubDate>
		<guid isPermaLink="false">http://localhost/wp_2/?p=823#comment-15750</guid>
		<description>&lt;strong&gt;Adipex without a prescription.&lt;/strong&gt;

Adipex fastin facts. Adipex. Adipex p phentermine ecureme com.
</description>
		<content:encoded><![CDATA[<p><strong>Adipex without a prescription.</strong></p>
<p>Adipex fastin facts. Adipex. Adipex p phentermine ecureme com.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: deadlycodec</title>
		<link>http://alphavilleherald.com/2008/03/oped-why-releas.html/comment-page-2#comment-15749</link>
		<dc:creator>deadlycodec</dc:creator>
		<pubDate>Sun, 19 Apr 2009 11:40:44 +0000</pubDate>
		<guid isPermaLink="false">http://localhost/wp_2/?p=823#comment-15749</guid>
		<description>The irony is that the very arguments that suggest that &#039;security by obscurity&#039; is a sham actually prove that it isn&#039;t!! The very thing that makes Firefox and Linux more secure than popular alternatives IS the fact that it is less common (aka more obscure).

For example, there are numerous Linux distros including Redhat, Ubuntu, FreeBSD, SuSe, Debian, and Fedora just to name a few. A given exploit that affects software on one of them is exploited differently on the others if it can even be exploited at all. If tomorrow, magically debian linux became the universal standard for operating systems we&#039;d see at least as many viruses, worms, and vulnerabilities in the software within the first year and the same people would be begging for windows. In fact, keeping extremely popular OSS secure would be damn near impossible since every fix and upgrade could potentially contain another vulnerability and the code is totally exposed to everyone! There have been exploits that affected windows that took quite some time for people to find because people weren&#039;t able to simply download the source and look for shitty coding. Instead they had to search blindly or bruteforce bofs. I think the wmf exploit that widely affected windows xp sp1 and sp2 is a good example of this in action though I can&#039;t be bothered to check and see how long it took people to find it.
</description>
		<content:encoded><![CDATA[<p>The irony is that the very arguments that suggest that &#8216;security by obscurity&#8217; is a sham actually prove that it isn&#8217;t!! The very thing that makes Firefox and Linux more secure than popular alternatives IS the fact that it is less common (aka more obscure).</p>
<p>For example, there are numerous Linux distros including Redhat, Ubuntu, FreeBSD, SuSe, Debian, and Fedora just to name a few. A given exploit that affects software on one of them is exploited differently on the others if it can even be exploited at all. If tomorrow, magically debian linux became the universal standard for operating systems we&#8217;d see at least as many viruses, worms, and vulnerabilities in the software within the first year and the same people would be begging for windows. In fact, keeping extremely popular OSS secure would be damn near impossible since every fix and upgrade could potentially contain another vulnerability and the code is totally exposed to everyone! There have been exploits that affected windows that took quite some time for people to find because people weren&#8217;t able to simply download the source and look for shitty coding. Instead they had to search blindly or bruteforce bofs. I think the wmf exploit that widely affected windows xp sp1 and sp2 is a good example of this in action though I can&#8217;t be bothered to check and see how long it took people to find it.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: deadlycodec</title>
		<link>http://alphavilleherald.com/2008/03/oped-why-releas.html/comment-page-2#comment-15748</link>
		<dc:creator>deadlycodec</dc:creator>
		<pubDate>Sun, 19 Apr 2009 11:08:42 +0000</pubDate>
		<guid isPermaLink="false">http://localhost/wp_2/?p=823#comment-15748</guid>
		<description>The firefox versus internet explorer argument is the same. FF is less common than IE and thus less people are exploiting it. Even with the &#039;benefits of collaboration&#039; the FF updates released in late 2008 and early 2009 made the software rather buggy and unstable compared to IE. Additionally, as firefox has become more popular as more and more people are catching on to the fact that it is more secure, it has in fact become less secure than it was before. When firefox meets or exceeds the popularity of IE it will be known for being just as insecure if not more so.

Additionally, when a given piece of software inevitably evolves (ie is updated) inevitably NEW exploits are inadvertently introduced. With OSS the danger is that if the problems are not discovered quickly by people with good intentions, it WILL be exploited by malicious individuals.

In this case collaboration can be a bad thing since really anyone can contribute code that is less than optimal, potentially resulting in the introduction of even more vulnerabilities. This sort of thing would usually happen by accident but it is possible for a malicious person to develop improvements and deliberately &#039;slip in&#039; code that he or she intends to exploit en masse later. Don&#039;t underestimate the profitability for this line of thought when it comes to more common software. Malware is a booming business for spammers, identity thieves, and pay-per-install adware affiliates. Closed source software isn&#039;t really prone to this.

I think a perfect example is that I could devise improvements to the Second Life client in such a way that would allow me to later exploit the people that use it. I could even submit the patch anonymously and have it integrated with the new releases of the client available for download on Linden Lab&#039;s own servers!!!
</description>
		<content:encoded><![CDATA[<p>The firefox versus internet explorer argument is the same. FF is less common than IE and thus less people are exploiting it. Even with the &#8216;benefits of collaboration&#8217; the FF updates released in late 2008 and early 2009 made the software rather buggy and unstable compared to IE. Additionally, as firefox has become more popular as more and more people are catching on to the fact that it is more secure, it has in fact become less secure than it was before. When firefox meets or exceeds the popularity of IE it will be known for being just as insecure if not more so.</p>
<p>Additionally, when a given piece of software inevitably evolves (ie is updated) inevitably NEW exploits are inadvertently introduced. With OSS the danger is that if the problems are not discovered quickly by people with good intentions, it WILL be exploited by malicious individuals.</p>
<p>In this case collaboration can be a bad thing since really anyone can contribute code that is less than optimal, potentially resulting in the introduction of even more vulnerabilities. This sort of thing would usually happen by accident but it is possible for a malicious person to develop improvements and deliberately &#8216;slip in&#8217; code that he or she intends to exploit en masse later. Don&#8217;t underestimate the profitability for this line of thought when it comes to more common software. Malware is a booming business for spammers, identity thieves, and pay-per-install adware affiliates. Closed source software isn&#8217;t really prone to this.</p>
<p>I think a perfect example is that I could devise improvements to the Second Life client in such a way that would allow me to later exploit the people that use it. I could even submit the patch anonymously and have it integrated with the new releases of the client available for download on Linden Lab&#8217;s own servers!!!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: deadlycodec</title>
		<link>http://alphavilleherald.com/2008/03/oped-why-releas.html/comment-page-2#comment-15747</link>
		<dc:creator>deadlycodec</dc:creator>
		<pubDate>Sat, 18 Apr 2009 21:24:32 +0000</pubDate>
		<guid isPermaLink="false">http://localhost/wp_2/?p=823#comment-15747</guid>
		<description>I think that in the end, a lot of you are confused about WHY the open source versus closed source argument exists in the first place. OSS is a valuable learning tool because it has been shown that learning by example is the best way to learn, especially when it comes to programming. This whole &#039;information should be free&#039; line of thinking doesn&#039;t really apply to software developed for profit since obviously businesses don&#039;t really want people to learn from their innovation since that results in more competition and more competition results in less profit.

Basically at some point someone somewhere assumed that the whole argument was relevant to security and then the rest of you conformists jumped on the bandwagon without really taking everything into account.

</description>
		<content:encoded><![CDATA[<p>I think that in the end, a lot of you are confused about WHY the open source versus closed source argument exists in the first place. OSS is a valuable learning tool because it has been shown that learning by example is the best way to learn, especially when it comes to programming. This whole &#8216;information should be free&#8217; line of thinking doesn&#8217;t really apply to software developed for profit since obviously businesses don&#8217;t really want people to learn from their innovation since that results in more competition and more competition results in less profit.</p>
<p>Basically at some point someone somewhere assumed that the whole argument was relevant to security and then the rest of you conformists jumped on the bandwagon without really taking everything into account.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: deadlycodec</title>
		<link>http://alphavilleherald.com/2008/03/oped-why-releas.html/comment-page-2#comment-15746</link>
		<dc:creator>deadlycodec</dc:creator>
		<pubDate>Sat, 18 Apr 2009 21:01:55 +0000</pubDate>
		<guid isPermaLink="false">http://localhost/wp_2/?p=823#comment-15746</guid>
		<description>Actually I do have a rebuttal, I just had difficulty communicating it for awhile. The discussion came up again today and after some careful thought I was able to articulate exactly why I still believe OSS is shit.

Here ya go:
Do you think OSS is more secure or less so? I know the general consensus is that OSS is more secure but the problem is that people are using a comparison of both Linux and windows operating systems to illustrate the point which is totally invalid. There are at least several times more computers running windows operating systems than there are running Linux in the world. There is at least hundreds of times more applications for Windows. The result is that of course there are more security problems for windows and windows applications. People also forget that the majority of exploits being used to compromise computers are not in actuality exploiting the operating system, but they are exploiting common software on operating systems that was developed completely independently by totally different and unrelated organizations. To see what I mean, check out &lt;a href=&quot;http://www.milw0rm.com.&quot; rel=&quot;nofollow&quot;&gt;http://www.milw0rm.com.&lt;/a&gt; Based on that assessment it seems that while both OSS and &#039;security by obscurity&#039; are not fullproof, it would appear that it is easier for people to find buffer overflows or other vulns in open source software as opposed to software that is not. On the other hand, OSS makes it easier for collaboration but in the end, many people who find exploits are going to submit them in hopes of recognition whether they find them in OSS or otherwise. They&#039;ll also submit lesser bugs like that too and it&#039;s not incredibly difficult for a dev to fix a bug once it is identified so I think in some respects OSS as a means for collaboration is overrated and thus it can be concluded that it is in actuality NOT superior, but inferior.

I&#039;d like to here another rebuttal from you though, Gareth, since you know, you&#039;re the open source expert on here or something apparently. I&#039;m willing to bet it&#039;ll be something more along the lines of &#039;duuurrr it took you ages to respond stupid&#039; or something equally irrelevant.


&quot;Don&#039;t worry folks. One thing that *won&#039;t* change once the server code is opened is Prokofy Neva&#039;s ability to pull a conspiracy / leninism / bolshevism / racism theory out of her ass about any situation whatsoever&quot;

True dat. Another thing that won&#039;t change is your butthurt at me for outperforming you. Cry moar?

</description>
		<content:encoded><![CDATA[<p>Actually I do have a rebuttal, I just had difficulty communicating it for awhile. The discussion came up again today and after some careful thought I was able to articulate exactly why I still believe OSS is shit.</p>
<p>Here ya go:<br />
Do you think OSS is more secure or less so? I know the general consensus is that OSS is more secure but the problem is that people are using a comparison of both Linux and windows operating systems to illustrate the point which is totally invalid. There are at least several times more computers running windows operating systems than there are running Linux in the world. There is at least hundreds of times more applications for Windows. The result is that of course there are more security problems for windows and windows applications. People also forget that the majority of exploits being used to compromise computers are not in actuality exploiting the operating system, but they are exploiting common software on operating systems that was developed completely independently by totally different and unrelated organizations. To see what I mean, check out <a href="http://www.milw0rm.com." rel="nofollow">http://www.milw0rm.com.</a> Based on that assessment it seems that while both OSS and &#8216;security by obscurity&#8217; are not fullproof, it would appear that it is easier for people to find buffer overflows or other vulns in open source software as opposed to software that is not. On the other hand, OSS makes it easier for collaboration but in the end, many people who find exploits are going to submit them in hopes of recognition whether they find them in OSS or otherwise. They&#8217;ll also submit lesser bugs like that too and it&#8217;s not incredibly difficult for a dev to fix a bug once it is identified so I think in some respects OSS as a means for collaboration is overrated and thus it can be concluded that it is in actuality NOT superior, but inferior.</p>
<p>I&#8217;d like to here another rebuttal from you though, Gareth, since you know, you&#8217;re the open source expert on here or something apparently. I&#8217;m willing to bet it&#8217;ll be something more along the lines of &#8216;duuurrr it took you ages to respond stupid&#8217; or something equally irrelevant.</p>
<p>&#8220;Don&#8217;t worry folks. One thing that *won&#8217;t* change once the server code is opened is Prokofy Neva&#8217;s ability to pull a conspiracy / leninism / bolshevism / racism theory out of her ass about any situation whatsoever&#8221;</p>
<p>True dat. Another thing that won&#8217;t change is your butthurt at me for outperforming you. Cry moar?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Hazim Gazov</title>
		<link>http://alphavilleherald.com/2008/03/oped-why-releas.html/comment-page-2#comment-15745</link>
		<dc:creator>Hazim Gazov</dc:creator>
		<pubDate>Mon, 12 May 2008 06:29:29 +0000</pubDate>
		<guid isPermaLink="false">http://localhost/wp_2/?p=823#comment-15745</guid>
		<description>I can see it in the headlines: Prokofy Neva finally loses it, goes postal on fellow special olympics participant d3adlyc0d3c.
</description>
		<content:encoded><![CDATA[<p>I can see it in the headlines: Prokofy Neva finally loses it, goes postal on fellow special olympics participant d3adlyc0d3c.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Witness X</title>
		<link>http://alphavilleherald.com/2008/03/oped-why-releas.html/comment-page-2#comment-15744</link>
		<dc:creator>Witness X</dc:creator>
		<pubDate>Sun, 11 May 2008 11:02:33 +0000</pubDate>
		<guid isPermaLink="false">http://localhost/wp_2/?p=823#comment-15744</guid>
		<description>Actually, I think he hasn&#039;t responded because he can&#039;t.  Something&#039;s happened.
</description>
		<content:encoded><![CDATA[<p>Actually, I think he hasn&#8217;t responded because he can&#8217;t.  Something&#8217;s happened.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Hazim Gazov</title>
		<link>http://alphavilleherald.com/2008/03/oped-why-releas.html/comment-page-2#comment-15743</link>
		<dc:creator>Hazim Gazov</dc:creator>
		<pubDate>Sun, 11 May 2008 04:49:51 +0000</pubDate>
		<guid isPermaLink="false">http://localhost/wp_2/?p=823#comment-15743</guid>
		<description>a side note to gareth, d34dl7c0ck, and whatever other fools are posting in this.

Internet. arguing. special olympics. serious business. stop feeding the troll.
</description>
		<content:encoded><![CDATA[<p>a side note to gareth, d34dl7c0ck, and whatever other fools are posting in this.</p>
<p>Internet. arguing. special olympics. serious business. stop feeding the troll.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Hazim Gazov</title>
		<link>http://alphavilleherald.com/2008/03/oped-why-releas.html/comment-page-2#comment-15742</link>
		<dc:creator>Hazim Gazov</dc:creator>
		<pubDate>Sun, 11 May 2008 04:40:03 +0000</pubDate>
		<guid isPermaLink="false">http://localhost/wp_2/?p=823#comment-15742</guid>
		<description>&gt;d3adlyc0d3c is a Linden Lab double agent who was caught, bribed, blackmailed, and turned, and is now being exploited to drop propagandistic ideas and disinformation into the minds of the masses through its agitprop megaphone, the Second Life Herald.

Don&#039;t worry folks. One thing that *won&#039;t* change once the server code is opened is Prokofy Neva&#039;s ability to pull a conspiracy / leninism / bolshevism / racism theory out of her ass about any situation whatsoever.
</description>
		<content:encoded><![CDATA[<p>>d3adlyc0d3c is a Linden Lab double agent who was caught, bribed, blackmailed, and turned, and is now being exploited to drop propagandistic ideas and disinformation into the minds of the masses through its agitprop megaphone, the Second Life Herald.</p>
<p>Don&#8217;t worry folks. One thing that *won&#8217;t* change once the server code is opened is Prokofy Neva&#8217;s ability to pull a conspiracy / leninism / bolshevism / racism theory out of her ass about any situation whatsoever.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Hazim Gazov</title>
		<link>http://alphavilleherald.com/2008/03/oped-why-releas.html/comment-page-2#comment-15741</link>
		<dc:creator>Hazim Gazov</dc:creator>
		<pubDate>Sun, 11 May 2008 04:34:12 +0000</pubDate>
		<guid isPermaLink="false">http://localhost/wp_2/?p=823#comment-15741</guid>
		<description>Opensim is backed an pretty much run by LL behind the scenes. The source code is already out and there is no way to stop it, sorry toots.
</description>
		<content:encoded><![CDATA[<p>Opensim is backed an pretty much run by LL behind the scenes. The source code is already out and there is no way to stop it, sorry toots.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

