Response Team Boosts Open Source Security

IT managers often assume that open source software is more secure than proprietary commercial software. Anyone who uses open source can examine the original code to spot any lurking vulnerabilities, and potentially even fix the vulnerabilities themselves. With proprietary software, you have to trust the vendor to do it all for you.

But open source's supposed security advantage assumes three things: 1.) Someone is actually looking at the code; 2.) Security vulnerabilities are getting reported and fixed; and 3.) Information about those fixes makes its way to Linux distributors and other software vendors, who apply the fixes to their products. But what those things aren't happening? As a customer, how can you be sure?

A new initiative aims to help. Founded in March, oCERT is a Computer Security Response Team created specifically to act as a clearinghouse for security information about all kinds of open source software.

Say you're a small open source project -- maybe you only provide a library of code that's used in other, larger applications. As a two-person effort, you don't have time to contact everyone who uses your code to let them know about a recent security flaw. That's where oCERT can step in to make the news known. Similarly, large Linux distributions, which incorporate hundreds or even thousands of different open source projects' code, can work with oCERT to make sure all the holes get plugged in all the right places.

Open source users can help the oCERT effort, too, by reporting security incidents. If you're a business that is experiencing a potential software exploit, oCERT can offer reliable security contacts in the open source community that can help you plan and coordinate your response.

In keeping with open source tradition (and open source budgets), oCERT is a volunteer effort, and it provides its services free of charge. The team's operating costs are underwritten by corporate sponsors -- most recently Google, which posted a detailed summary of why this effort is so important to a blog Monday.

All in all, oCERT sounds like a worthwhile project that will provide a valuable service to the community of open source vendors and customers. Let's hope it wins enough support to sustain itself for the long run. (That name might be a problem, for starters -- CERT is a trademark of Carnegie Mellon University.)

Are you satisfied with the current state of security and vulnerability reporting for open source software? What about the proprietary applications you use? Sound off in the PC World Community Forums.