Julie Brandon said:
Plus of course, you shouldn't hang too much on peer review, there's been a
few interesting reports detailed in NewScientist about research into the
real-world success of peer review out there, and its less than perfect.
You are quoting out of context here... the NewScientist
discussion was about Scientific journal peer review where
2, 3 or maybe as many as 5 people get to review your paper.
In the Open Source world, we are talking about thousands of
people reviewing the code. This is a completely different
situation.
However, I _am_ a big open source advocate, and prefer open source [and
source as opposed to executables] wherever possible; however I'm also aware
that it has its limitations too.
The only limitation that I can see is not enough people
getting involved and that is steadily changing.
It wouldn't be that "him" that'd be writing them though would it, it'd be
people who've spotted a vuln that others haven't; or much more likely,
someone who just uses a currently known and popular vuln that still exists
on many unpatched systems.
I think we can safely presume that anyone churning out virus
code would also be taking measures to avoid identification.
Thus the threat of punishment would not be much deterrent
unless there was a realistic liklihood of getting caught.
However, any particular vulnerability that gets used will
also get documented, published and fixed and there is no
doubt that this process is faster in the Open Source world.
Too late, if people don't then patch their systems, though.
I think that, on average, sys admins working on Open Source
systems tend to be a bit smarter and a bit better at reacting
to threats than the equivalent Microsoft admins. This might
be merely because the smarter admins were quickest to adopt
the better technology or maybe because (for a dopey admin)
Microsoft does a better job of hiding the problems and making
it look like everything is running smoothly without any
supervision. The fact is that every server needs a good admin
no matter what OS you choose. This will remain a fact until
serious strong-AI is achieved (which won't be soon).
- Tel