Open Source software vs. Proprietary software

With no push to get-it-out-the-door-damn-it, OS/FS never comes out of the oven 'til it's either fully cooked or as an acknowledged beta so people can test it and provide feedback.

One need only compare and contrast this to the "Ready. Fire! Aim...?" development model MS uses to see that your argument is baseless and devoid of merit.

Bix

...is what I said.

They don't walk up, mug someone and then stand there counting their spoils.

That's waht it'd be like to abrogate a popular piece of OS/FS, then sit back and wait for the credit card numbers to caravan in.

Bix

It is just a matter of choice.

You might be sleeping right now, KaceyR, but I am posting my reply anyway. You might read it when you have the time.

From what I have read on all the reply from different members, and your reply to them, I think you already know what is the answer to your question: "With this in mind, why would you turn to Open Source software?"

First-party vendors like Microsoft makes good products, but sad to say, they release it without thoroughly testing it. That is why from a Retro-Active Company, they have become Reactive. And they made a vow to be Reactive. You know what I mean.

Opensource software is meant to be free. With scuh a multitude of developers doing their part to produce a very good and stable software. But all to this, there is a catch. It is prone to abuse. That is why they have a host, like Linus. The host, or, hosts, has the final say to this. that is why there are corporations investing on opensource software. Need I say more? Oh, you know where this is going.

In your example, with Firefox, will you download it from an untrusted source? Of course not. Maybe you just misunderstood open source software, or maybe not? Example is RedHat, there are rumors then that the boot sector modifications they make looks like a virus. But since they are a legit company, they ensure their users that it is not. And it is proven and justified.

Again, it is just a matter of choice. There are dangers in using opensource software, but do you think there is none with proprietary software?

Having said my piece, I rest my case. I hope this enlightens.

... interesting that you should use Foxfire (FF) as a for-instance ... I am a management consultant (mostly business plans), have used the net alot on a day to day basis since 1996 ... been totally a Microsoft user, do somje programming, for my own consumption ... have XP, but sp2 such a hastle went back to Win2000 Pro...

... gradually over time problems have gotten worse and worse with viruses, and more recently spyware (have all the protection programs, firewall, etc) ... downloads of MS upgrades were extremely aggravating in that frequently programs I had been using no longer worked ...

last summer was, reading a discussion like this of what programs to employ to combat adware (Spybot, Spyguard,etc), someone said the best way around the problems was Foxfire, so downloaded it and installed it from the Moziila site ...

... since July I have had zero problems with viruses or spyware of any kind, no more MS updates ... Foxfire is alot cleaner and faster, and the adblock feature is terrific ....

... never had given Open Source much thought, but because of this experience I sure am now ... this discussion is really an excellent one, has given me all sorts of insights into the various pros and cons ... as to whether the internet community is ready for Open Source, I can say for sure that Foxfire is ... interesting, 4-5 months ago, there were various sites that I couldn't access properly with FF, had to use IE, but now almost all those sites work !! ... think the big surge of FF usage over the last few months has influenced sites to reprogram to industry standa

This actually brings up a very important point, particularly as regards using MS software in preference to Unix-based open source software, and most specifically as regards your chosen example of using IE in preference to Firefox.

Unix software, for the most part, forces the user to make a conscious choice to trust a source before any new code is accepted, "installed", and run on the user's system. Open source software in general follows that lead. Firefox in particular is effectively barred from downloading and installing software with access to anything outside of Firefox itself, because it doesn't incorporate ActiveX and other misfeatures of IE.

ActiveX cuts out the middleman. All those security issues that you would blame on lusers in a Unix environment (such as a Linux OS) are allowed to develop without even requiring any user interaction. If a given website loads with an ActiveX control, for instance, that installs a trojan horse on your system, it's too late — you've already opened yourself up to system compromises. If you won't blame IE for the problem, you can't blame the user.

If, on the other hand, you're willing to ascribe the vulnerability to IE, where it belongs, you'll once again find yourself in a position to blame the end-user. The reason, of course, is that the user has used IE, a known vulnerable system. IE is, in effect, a trojan horse all its own, interacting with malicious code on the web in a manner detrimental to the stability and security of the user's system. The decision to use IE, then, becomes a violation of intelligent security policy.

Don't know if this is covered somewhere else(haven't read all the posts), but are you saying that you distrust Open Source because you download it over the internet? Where you have to use checksum's to verify code and there can be DNS spoofing etc.

But because Windows comes in a box from a store its more reliable, e.g. hasn't been replaced with something malicious ...

Then instead of downloading linux from the internet. Why not buy one of the tested stable releases, burnt onto CD's and sold at stores. I know that you can buy Mandrake in that form at least.

I believe that before being added to a linux dist, all software is tested/audited not only by the organisations programmers but also by many independant programers - people cant just add in their code in a reliable distribution. So any programs/code being added is checked by multiple people.

As for someone actually at the organisation adding malicious code before the product ships, there is as much chance of that happening at MS as any other place.

cheers

james

I think what you said "open source software ...."
are just some few of OSS community, Not the whole OSS. So it's understandable what you said just like somthing happen in our living that there are thiefs, police and judges. AS the goal is diffrent between MS and OSS,I wouldn't like to put them on the same table. However I'm always thankful for OSS what give us much diversity and horsepower to create and enjoy it.

Hmmm, the last 10 times my pc was rendered useless by a security hole in IE, I can't recall getting money from MS. Besides that, have you ever read the EULA for any of their software? They don't guarantee it will do anything at all much less that they'll pay for problems. You have to look at both types of software and be smart about installing and maintening both.

I have to agree that the chances of OSS being tampered with are much greater than the code from IBM or MS being tampered with. The source code is out there for the taking.

HOWEVER - By saying that, I don't want anyone to think that I don't trust OSS. There are a LOT of good intentions and good people in the OS communities. There is only a very few hackers who are low enough to infect a software package.

One point I would like to make is that I run into a LOT of problems with COMMERCIAL packages that simply do not work or mess up several other programs during installation. My SBC Yahoo install programs did that to me. It seems like these commercial software houses (Microsoft included) have a tendency to release a product before it is completely tested because they need the cash flow. No real malicious intent - just plain old greed.

You can always take a cheap shot trying to poke a hole in a product but at least you don't risk a broken leg falling into the many holes a typical Windows system provides.

I'm ex-Microsoft server level tech that had ran bugs from NT5 that became what is known as 2000 Server/Pro during the last of the 90's. Sure that was pre-RC1 but we were still patching NT 4 - people still want SP7 on that. It would be at SP12 by now. I still love 2000 Server/Pro but find Linux has over 40 years of history to become secure and a world to draw from for expertise.

Bottom line is any server needs to be hardened and is not a machine for "browsing around the Internet".

As for personal machines - rebuild XP a couple times a year or run Open Source and take a tiny chance on your scenario. Load XP from CD (or network share) and by the time you can get Service Packs and security updates applied, you have a significant chance of contracting Bagle, Sasser or their many variants.

There never has or ever will be a connected machine that cannot be compromised if someone wants in bad enough. I will gladly choose Linux.

If your legal recourse demonstration meant anything - there would be no Microsoft at this point. Too many ambulance chasing attorneys would have given their right arm to have a class action suit with the world as members.

Well, the point here is...OSS is all about transparency and community team work. It is always better in the long run for 100 of us to move a step ahead together than to have 1 of us go 100 steps ahead of the rest.
I do agree that it's not in the best of selfish interests to develop on an OSS platform and in certain cases, proprietary software still has a role to play but i see its days as numbered...VERY numbered considering the fact that even 10 year olds can develop full-fledged websites nowadays ;-)
The ball has rolled and it's not stoppable anymore nor is it reversible.

I have the same issue with my servers. Something just broke and I don't have a clue how to fix it, because it's been so long since anything broke ;).

Oops wrong spot.

So let me get this straight. It doesn't matter at all if you feel comfortable suggesting a program? How does that work?

On the topic of the add-ons. They shot down Open Source to just end up getting add-on code from you? Who the hell is going to support that, since as you say it was a work for hire? On top of that why'd they hire you to write them if they can handle it from there? You're obviously a much better salesman than a consultant.So let me get this straight. It doesn't matter at all if you feel comfortable suggesting a program? How does that work?

On the topic of the add-ons. They shot down Open Source to just end up getting add-on code from you? Who the hell is going to support that, since as you say it was a work for hire? On top of that why'd they hire you to write them if they can handle it from there? You're obviously a much better salesman than a consultant.

According to the FSF that's sort of the point. Freedom to choose what you want to use :)

I know this is petty, but it's more annoying than these pathetic which-is-better arguments.

The word is lose; as in, to have lost. Loose would imply that it needs tightening.

...it leaves us depending on the Germans to tell us what Uncle Bill is shoving up the collective ass of his victims.

Bix

...how many people are migrating from OS/FS to Windows...?

Going away, my royal ass. The original premise is as flawed as a block of decomposed granite.

Bix

While it's true that Microsoft does seem to try to fix the most
glaring bugs and security holes in Windows in a reasonably
amount of time, not all companies do such a good job. What if
you spend hundreds of dollars on a closed-source IDE, only to
discover that it won't work with your favorite closed-source
compiler, and then find that both the IDE manufacturer or the
compiler manufacturer blame each other and refuse to fix
anything? Or, for that matter, if one or both of the companies
go out of business and the source code to their products is lost?

Closed-source software is prone to this sort of dead-end
situation in a way that open-source software is not.

Since we seem to be dealing with KacyR's paranoia about the "possibility" of foul play, how do we know you, KacyR, are not a shill for Microsoft. It would be a great ploy to send out the Microsoft minions to perpetrate the politics of fear on all us little IT developers et al out here. A little seemingly innocent reasoning, a ad nauseum thread about the dangers (omigosh!) and next thing you know, the fearful people run into the arms of big momma Microsoft.

There is sooo much open source out there right now running mission critical websites, apps, and infrastructure that you point is pointless.

Truth is, there is to guarantee no matter what you do. Microsoft costs companies billions in lost time and meaningless effort in updates that should never have had to be done.

It is an issue of who you want to control the store....them....or you?

They could have written all of the add-ins in-house. They have the ability, just not the time.

The funniest part is that their standard contract states all work as work for hire, where they exclusively own the code. They even provide a hold harmless clause for me once the code has been accepted.

They do this because they try to market all of their software to other organizations. If they didn't own it all, they couldn't do it.

Needless to say, I maintain a good relationship with this client!

Well, just remember "there ain't no such thing as a free lunch". Someone, somehow, somewhere has to pay for OSS...
That's exactly why OSS people rejected the term "free software" - it's unnecesarily ambiguous. Me personally, I prefer to say "liber software", most others just "open source"... a matter of choice.
However, there IS still a benefit from it: development costs are distributed almost equally among all the participants...
Imagine we were to recreate windows in an OSS form... what would be the costs of it? paying enough to a team of, let's say, 2 thousand programmers during at least 5 years to enable them to dedicate full time to the project...
Perhaps one million dollars, if not more... very few companies could do that... and... in order to let it out for free??? No way man!!!
However, if a companies subsidises not one thousand, but just one (its employee) and puts it to work on the project on his spare time... and another one does the same... and 2 thousand other companies do the same...
Total cost of development remains the same (millions of dollars) but for each company the costs of its involvment are ridiculously low... and when the project is over... they get a wonderful product!!! and the cost "paid" for it was indeed very free... and they get in-house expertise on the product (their home programmers) as well as direct support for free...

And business with OSS is not licensing software, but services... business model is: I give out for free my product, you can adapt it the way you want, but I'll only help you if you pay me...

So don't worry, either as programmer or as support staff, in an "all OSS" world there'll still be plenty of job for us...

That is exactly what I was saying at the release of 2003 MS claimed that they had tested it fully and found no problems but 2 weeks latter they had a patch out for it.

The current MS model is to me a sinking ship that is attempting to bail out the incoming water faster than it gets in but of course there are far more holes than buckets to move the water away with.

I just find it funny the way that MS tries to make people think that they are a believable company when it comes to security. I have yet to see any of their products which do as they say when released and they all have a multitude of Undocumented Features which in anything else would be considered as flaws.

Col

Why bother going to all that bother for such a small section of the market?

Wouldn't it be far more profitable to do something like this to MS who has the lions share of the market? That way the person/s involved would be doing far more harm than a couple of OSS applications. The reality of this is that OSS is only a very small section of the market and the really big section is MS and Windows so unless you are downloading some OSS that runs on Windows which has been compromised there is very little point in the exercise.

Col

Uses Linux with their recently acquired Hot mail?

It was my belief that when MS insisted on switching from Linux to Windows they had massive problems and lost existing users in droves never to return.

Col

Rely on the makers or suppliers to make the developments available as service packs or whatever you chose to call them just like MS.

But unlike with MS you also have the ability to have a look see at what is going on in any piece of code. Very few write a version of Linux with all the Open Source Apps for themselves.

Col

Your premise represents a theory. One that can be validated by the available data. Which has a better track record of security?

Windows with daily crashes, hourly virus attacks, lost data (or data locked into a proprietary format I can't access without MS permission).

Or Linux (or Firefox, or Open Office or Evolution or Samba, etc) that never seems to crash or require a reboot. Never seems to suffer a virus attack. Which leaves my data in an open format that I can access with other non-proprietary tools.

If you answer Windows - you are obviously not paying attention. And if you aren't paying attention, why are you wasting our time on your stupid opinions?

i am sorry, but it seems like you are contradicting yourself(and you sound a lot like u r working for Microsoft)... allow me to quote u : "As for the downloading of software only from trustworthy sites, trust of the source is primary to the discussion."

now, why don't you ask all the ppl here, whom they trust more? Software that you can pry open, line by line or software that you can't even peek into legally?
It's like asking us to buy a car and not open up the boot, even when the car has stalled ;-)

Go figure!

hmm...let's go for a little history lesson, years ago, MS gave the big boys of tech a good thumping by providing low-cost software that(ahem!) kinda worked. MS did give us, the little guys, the chance to own PCs. Now, MS has become one of the big guys, the greed has set in, and MS wants it all, so...what do we, the little guys do? Open up a new avenue, create history again by levelling the playing field...it's called revolution and it is the way the little guys make a statement, collectively...it is unstoppable, because it is the very innate human desire to be free !
All those who failed are those who try to suppress freedom!

tsia

People just want to blame the big pockets.

Most problems are configuration issues anyways. We've got this guy I know that run around cusring Bill Gates all the time and it ends up being that he misconfigured AD... not Bill's fault.

People like Kacey or whatever her name is just want someone to pay when she screws up. Plain and simple. You can't make the linux guys pay, so screw them.

Unfortunately, even with commercial software, if you read the print in most EULAs, they won't pay you a dime, either.

I think that KaceyR is just trying to stir the pot and rattle everyone's cages.

The argument proposed is faulty and misdirected. If you obtain Open Source software from an unknown source without checking its contents, you might as well start buying Micro$oft products on blank CDs from some guy in an alley at midnight.

It doesn't matter what 'brand name' the product carries. When you obtain products that aren't identified from strangers you don't know - don't be suprised when you get burned!

You're right, I see that I didn't draw a clear distinction between open source and proprietary software. I didn't give a reason why open source software would necessarily require more expert knowledge to run than proprietary software. In fact, as some have pointed out, there are situations in which support of proprietary software requires more expert knowledge by its very nature.

I should said, instead, that one weakness of open source software is that it tends to require relatively more help from vendors of expert services, as distinct from the original software vendor, than proprietary software does. This is a practical result of the fact that creators of proprietary software are more concerned with marketing and packaging than their open source counterparts. Microsoft would not consider releasing any software without a carefully designed interface and a few wizards thrown in, and a clearly defined map for potential users to follow through installation, configuration, and use. Open source software makers are not nearly as concerned about such things.

I'm quite certain you still disagree, given what you've said. But I'm surprised that you feel that there is absolutely no sense in which this is true.

I think that PostgreSQL is a great and effective database package, particularly at its asking price. But I wouldn't recommend it to the same set of users that I would recommend Microsoft's SQL Server, for example. Both require expert knowledge to implement correctly. PostgreSQL, however, is esoteric to a degree that no commercial database package would ever be. Also, through no fault of PostgreSQL's, Microsoft has spent millions promoting SQL Server and making it easier for users to find help resources, reducing the necessity to rely on people with specialized knowledge. I know from experience that it's quite a bit easier to setup and use SQL Server than PostgreSQL in its raw form.

Of course, one could say that open source has plenty of alternatives to make up any such supposed deficiency. I could counsel someone to use MySQL instead, or to use PostgreSQL in the form of RHDB from Red Hat. But these are the exceptions that prove the rule. To the degree that these companies are exposing their proprietary code to public view, they are making up for it by positioning themselves as providers of expert services.

Since you are a consultant, you can certainly speak to the issue: is there really NO sense in which it would be easier to outfit an office with a dozen computers running Windows rather than Linux? This to me is an amazing statement. I would think that for it to be even approximately true, it would be necessary at the very least to make clear which distribution of Linux is to be installed. Just on the basis of factors which have really nothing to do with Linux in itself, that more people have experience with Windows or that Microsoft office software is more widely encountered, it seems reasonable to suppose that supporting Windows would offer fewer complications.

Just to make myself clear, I don't think that this an inescapable feature of open source, nor do I think there's anything wrong with using providers of expert services. But I do think that if someone has to provide basic computing services without a budget for consultants, that person may well find that the greater price of commercial software is more than worth it.

Early on, KaceyR made the point that open source could be vulnerable to malicious hacks because it was harder to verify sources. Lot of people didn't think this was true due to checksum verification.

But KaceyR mentioned that malice and determination could contrive a hacked executable that could pass a checksum test. I didn't see any specific rebuttal (maybe I missed it). Is this true? Just curious.

Neither open source nor proprietary software guarantees anything.

I have never seen any of the proprietary software guarantee anything. Even to the point of making you agree by forcing you to press 'I agree' button or implicitly agree that if you do install, you are not ever going to sue the company for any features that damage your data.

But open source at least guarantees that you can look at the source code, modify it as you see fit, or at least know that there are many people looking at the inside and hope for some assurance.

The issues that are given only occur if the software is downloaded in binary form from a non-official download site, which is equivalent to buying a proprietary software from a shady vendor (probably a pirate, who knows), which would have exactly the same problem if it happens to contain malicious malware. In this case, you cannot ever sue the original vendor at all.

At least open source allows you to download the source code from an official site, compile it any way or form you want, then execute it. This is very easy for an open source platform.

You haven't really said anything untrue in this post. To be perfectly accurate in describing the relationship between Microsoft products and directly competing OSS products, it would probably be best phrased similarly to this:

Often, the knowledge entry barrier for deploying software at all is slightly higher for open source software than it is for professional proprietary software. The total amount of expertise required to deploy software correctly (meaning: stably, securely, and perhaps even functionally) tends to be the same, or perhaps even greater for professional proprietary software. As a result, the minimum effort and expertise required for deployment of the open source solution will typically render a more functional, stable, and secure product than the minimum required effort and expertise for depoyment of professional proprietary software of equivalent purpose.

Understand that there is a great deal more software available for the Linux platform than for the Windows platform. That software runs a broad range of functionality, from PostreSQL to a set of flat-file database scripts in Perl that someone whipped up in an afternoon. Microsoft's stand-alone database software, by way of comparison, runs a much smaller range of functionality, between SQL Server and Access. SQL Server, by some measures, is more functionally complete than PostgreSQL, and by some measures is less functionally complete than PostgreSQL. Access, by any measure, is likely to prove to be more functionally complete than the hypothetical set of Perl scripts.

There are a couple of modifying points that need to be brought up in reference to those ranges of availability. One is that an amateur can muddle his way through setting up SQL Server without really learning a thing, but anyone managing to set up PostgreSQL either needs to come to the task with some competence already in hand or will learn something from the experience. That having been done, no production environment should ever trust either database for long under those conditions because of the hidden frailties and vulnerabilities that will exist in inexpertly deployed software of that complexity. PostgreSQL will tend to be more stable and secure under those conditions, but wearing a leather jacket as opposed to running around shirtless when many of your enemies are carrying swords isn't really much protection. It takes experience, expertise, and a great deal of knowledge to maintain either DBMS as a secure, stable environment. Of those who have that level of expertise in both of them, the vast majority (I have no statistics to back this up: only my own experience and estimations) would prefer to choose PostgreSQL over SQL Server because of the platform(s) on which it will run, the eventual effort expended, and the long-run stability and extensibility of the software, to say nothing of the fact that whereas an amateur might need to contract outside help to understand the system, PostgreSQL is 100% free to the true expert.

That having been said, you also should realize something else about the way OSS development happens. Specifically, OSS is an extension of the Unix culture, where the preference is to create small tools that do one job and do it well, rather than create large tools that do many jobs and probably screw many of them up when they are put to a given purpose that their creators didn't plan for. These small tools in Unix development are designed to be easily made to interact with other tools, so that meta-tools can be created whose job it is to basically tie several disparate tools together to achieve larger tasks. In proprietary software design, because tools are made large and incorporate a multitude of smaller functions, if you want a "large tool" effect that does something different than the task for which the large tool you already have was designed (even if it already has all the functionality you need, in terms of discrete internal capabilities), you have to buy another, separate, large tool that redundantly incorporates many of the same capabilities in its design. This, by the way, is part of the reason that Unixy OSes tend to run much leaner and faster, with less resource usage than Windows systems.

That being the case, I'm sure there are several graphical front-ends floating around for PostgreSQL, developed separately from PostgreSQL itself but designed to interoperate with it, that add the sort of functionality normally thought to exist only with MS SQL Server, and not with PostgreSQL. Some additional knowledge and/or effort might be required to get to the point of having the graphical, point-and-click interface from the point of thinking of "PostgreSQL", if you aren't just using RHDB from the beginning, but that is really the result of OSS "suffering" sort of a plague of freedoms: you have choices, options, and freedoms in choosing your software that greatly outnumber the individual pockets in your brain where you store decision options. Every time you start thinking about how you want to do something, you can just use the first tool you think of, but you can also research the matter and discover that there are (pretty much always) better ways to do it for your purposes. I think that it is in large part the fact that Windows platform administrators tend to fail to realize this wealth of options on the Linux platform that causes them to cling to the Windows platform much of the time. The Windows platform generally supplies exactly one option, and you force that option to fit your task. Doing similarly with OSS tends to be more work, because nobody ever set out to make every single tool cover every single forseeable need. Rather, each tool does one thing, and does it well, and by combining tools in the right way you should be able to achieve the Right Bundle of Tools for any given job in a far more effective fashion than with the equivalent situation in working with a Windows environment.

There are really two comparisons being made, generally, when comparing the two sides of this issue. One is the Unix vs. Windows comparison, and the other is the OSS vs. Commercial Proprietary Software comparison. There is a great deal of overlap between Unix and OSS, and a great deal of overlap between Windows and commercial proprietary software, so they tend to get confused, but there are times that it is useful to separate them in discussion. What I refer to in these debates as my preferred choice is generally the Unix plus OSS solution. When I do so, however, I try to do so in discussing the matter in terms of tendencies. I do not mean to portray any of this in terms of absolutes. It is possible for someone to create the bloated equivalent of Access as an OSS project for Unix (though highly unlikely) just as it is possible for someone to create the lean "one tool one job" equivalent of one of the several Perl scripts I hypothesized as a proprietary tool for Windows (though, again, highly unlikely, due largely to its probable unmaketability in a Windows environment). The tendencies to which I refer generally apply on the one hand just as much to Unix as to OSS, and on the other just as much to Windows as to commercial proprietary software, but those tendencies become very strong tendencies, often to the point that they can be treated for many purposes as certainties, when the Unix plus OSS combination of circumstances is set against the Windows plus commercial proprietary software combinatino of circumstances.

In summation: You're right. It's all just tendencies. I even carefully consider relevant Windows platform solutions using commercial proprietary software just as much as the Unix solutions using OSS whenever a new situation arises in which I must make a recommendation to a client. The more I learn about what is out there (and, really, I'll never stop learning unless I choose to: the options are seemingly endless) in the OSS world, the less attractive the Windows platform options tend to become.

From the email newsletter topic:
FEATURED DISCUSSION: OPEN SOURCE SOFTWARE VS. PROPRIETARY SOFTWARE

I won't quote the rest, but in reply to the points offered:

- You downloaded Firefox off an unknown third party site most likely AND you didn't check the signatures first? That takes LESS time than what you go through for purchasing proprietary s/w, yet you didn't do it... Consider it your punishment!

- If this happens with your proprietary s/w, do you REALLY think you will get anything but denial from the manufacturer?? You've obviously never tried this before ;-) It will take lawyers to get attention, and more $$ than you probably lost.

- AND, you should read the license agreement. I haven't found one in which you don't agree to hold them harmless and you agree that they are not responsible for any loss or damages. The MOST you should be entitled to is a REFUND of your purchase price according to your agreement.

Now, if you're savvy enough, AND this is a legitimate problem with the open source program, you can check it. However, the initial premise is apples and oranges. In one case, it's a distribution channel issue, which is not entirely open source related, and the other is a programming error. I think it's interesting that in this scenario, the open software wasn't flawed, but the other was.

Skip

I fear you're putting a bit too much faith in MS doing The Right Thing. They're human too (despite appearances to the contrary ;-).

I remember a Dev CD that was spread by MS which was virus infected. Not sure about it now, but they also had to resort to Unix (yes) to ensure their CD production line was safe from infection.

At which point we hit an interesting problem: by extension of your own argument, MS has two huge single point of failure in their patch strategy: the certificate and the single source.

Anyone hacking the cert will set up the platform for a huge problem. But even if we (very naively) assume that will never happen. pray tell me, where will I go to find out? MS won't admit to it for some time, and they're a single source.

In contrast, the very wide and distributed nature of OSS makes for a great degree of redundancy. I can pull sources from various sites and compare them. It is up to me which code I trust, and with OSS I have one further advantage: the authors are actually accessible.

Even with the best imagination you can't call MS accessible. I worked for a company who is in the top 10 best MS clients globally, and even they had problems.

Furthermore, with OSS, *I* get to pick the supplier as well as the distro method. If you're requiring trusted source, you buy a packaged solution. If you're confident of your own abilities you go for the technically more complex stuff like Debian or Gentoo. You actually have a choice, which in itself stimulates quality (frankly, I don't think most OSS people realise the impact the disappearance of MS would have: who would they compete against? ;-)..

Having supported both windows & OSS in an ISP I know which is right and its not down to original package cost. Windows & IIS have a large number of flaws, Apache & UNIX like OS have far fewer and on the whole less serious exploits because nothing runs as root. Ask any ISP which box needs rebooting most frequently it won't be the UNIX like one.

The key thing here is whether the operating system has been designed from the ground up as secure and with a good audit trail, I don't believe any version windows qualifies due to the compromises it makes to accomodate third party software developed for previous versions.

If you go for shrinkwrapped code from a repuatble supplier like Novell,HP or IBM then IMHO you are no more at risk than using Microsoft SW. As for legal recourse as already explained above you have no chance. Look at the Internet Explorer bundling case, if the DOJ can't chastise Microsoft then who can?

As to jobs going abroad, look who is investing billions in moving support & development jobs there - its not the OSS teams.

You read my thoughts .. this article is such bullshit FUD that it has to be the result of a bribe by MS to the author to 'publish'.

It is so basically flawed on all accounts, that I have to view the author as being quite clueless (as evidenced by the lack of logic & reasoning), let alone simple real world business facts like: MS will rush to pay you for _any_ problem you have with their fat binaries.

Yeah right.

Is the TR just a subsidiry of MS now?

So far, your main argument seems to be that IF something went wrong and IF you lost data from a bad open source project, there would be nobody to blame...

The assumption being that with a "real" company, you would have someone to sue in the event of data loss. If you're using commercial software and it breaks, causing you to lose money... then there should be someone to SUE to get that money back.

I don't know about you, but I've NEVER heard of a successful lawsuit against microsoft for lost data, time, or money. I HAVE heard hundreds of complaints about lost productivity, downtime, and even lost DATA that was caused by their malfunctioning commercial software.

As a side note, read the license agreements that come with open source code... there are no guarantees. You accept the risk that the products might not work. By using open source software, you legally agree to NOT hold the makers liable for the (mis)use of their products.

Thank goodness, because I think we've had more than enough frivolous lawsuits to last us a millenia... people suing McDonalds because the coffee was too hot (140 F), suing a bike manufacturer because there was no warning label saying "Dangerous to ride this bicycle in the dark on the freeway", and other such nonsense. And I won't even mention SCO and their witch hunt.
.
Open Source has no legal guarantees... but a MUCH cleaner track record than 95% of all commercial products that do.

You take your pick -- is it more important to you to use a product that costs more (but comes with defunct, unenforceable legal guarantees), or a product with no guarantees but a shining track record?

Granted, OSS isn't ready for the desktop, and most users don't care what software they use as long as it works... but blindly adhering to corporate products because it's "safer" is like shooting up with a sterilized needle... harder to get AIDS, but you're still in for a trippy ride.

How stable operating systems depends mainly on the admin (providing the hardware is stable). I work in an environment that supports Sun, Apple, Wintel, and Linux (Sun and Intel) solutions. I support Wintel and Apple solutions myself. with that said a friend of mine is desperately trying to leave Sun because he is tired of going out and fixing Sun hardware/OS problems due to lack of proper Q&A over the past year. Our organization is trying to get a way from Linux because it has started to cost more to support than Windows. If you work for the federal government hackers do not care what platform you are using, they want the data or to bring down a system. MS is not on the same scale as SUN, not all true! It is true that MS does not support the number of processors that Solaris supports but outside of that it is arguable as to the scalability of the OS or network applications.

When researching a solution all platforms must be evaluated in order to determine which is a viable production environment. Government News ? one of the top Java developers switches from JAVA to the .NET frame work stating reasons that .net is faster to deploy and less expensive to manage.

Business (workstations): the business industry is built on Wintel! SAP, Oracle and Gelco to mention a few have tried to get there applications to work on other platforms than Wintel and IE but not with much luck. One thing that must be understood is what takes place during backend processing and how the data is formatted on the client. M.S.I.E. utilizes 6 dll?s that helps the client process the information, whereas Motzilla/Netscape us unable to manage the info. (SAP-Java: when using SAP-Java on Macintosh OS 10.x the password is sent in the clear. Apple will try to tell you that it is compressed, which is true but compressed is not encrypted.)

Software Assurance: Not only cheaper but this can be leveraged to send admins to training (QuickStart) for less than the standard pricing. Server side does not apply, must be client.

Back to the original question of Open Source vs. proprietary! We have had more than a few problems where when using Linux the local admin modifies the kernel which presents support issues along with patching problems. You will lose support and now have to add creating patches to the admins task list.
All aspects of a solution must be researched before making a decission on the platform.

Living not in the States but in Europe, I can tell you, that there is a significant trend of goverments and communities to change to OSS.

An example would be the German city of Munich, which is converting its appr. 20000 workplaces to OSS, the German goverment and goverments of some German states are deep into the evaluation of a change to OSS.

The reasons for this change is not for money. Installation, training, adaption of existing applications to OSS consumes also large amounts of money. But the advantage of being in charge of exactly what code is running on the PCs and not being dependent any more from a single point of source seems have pitched the decision of Munich and other German cities in the direction of OSS.

And coming back to malicious or just unwanted features within a program, why do you think programs like XPAntiSpy are created by users of Window XP. Who knows what information Windows/Office/etc. collect and send out every time I go online?

As little as a year or two ago, I'd agree with your estimation of relative ease of use. While it's still true of many Linux distributions that the average Windows user would find the transition more difficult than moving up to a newer version of Windows, it is also true of some Linux distributions that it is actually easier to install the OS, even for the congenitally clueless, than it is to install a Windows OS. For examples, I refer you to MEPIS and SimplyMEPIS (two variations on the same LiveCD distribution, which includes an extremely simple GUI-intensive means of installing to the hard drive) and, more importantly, Novell's SuSE Linux. The newest SuSE, in particular, is a very good Linux distribution for installation to the hard drive on a system being used by a complete newbie to the world of open source software. It is reasonably stable (in Linux terms, which means "exhibiting an unprecedented level of rock-solid stability" in Windows terms), extremely intuitive to anyone used to the Windows GUI environment, an full of tools that make life easy for the unskilled end user.

I'm going to a literary club meeting this evening with a compartment of my soft-side briefcase full of SimplyMEPIS CDs. I'm going to enlighten a bunch of stubborn, clueless Windows users to the vast benefits to be had from the world of open source software. I wouldn't even attempt this if I didn't think they'd be likely to suffer less difficulty with SimplyMEPIS than they do with (any version of) Windows.

The problem with getting Linux to the desktop has migrated from ease of use, which is basically solved in many distributions, to mindshare. Users are resistant to change, simply because it's change. Many users are likely to require an epiphanic revelation to clue in to the fact that there is another option they might actually like more than what they're already using. People who are used to only learning something new about their computers when something goes drastically, aggravatingly wrong are understandably resistant to learning new things about their computers ? even when what they have to learn this time might be fun, rather than aggravating. It takes more than seeing to believe, sometimes. The experience of the last decade of working with Windows-based systems has conditioned most users to consider the process of getting their hands "dirty" with new software environments to be painful, and something to be avoided at any cost.

Linux is changing that. More and more end users are discovering that Linux can be much easier to learn and use than Windows.

I pretty much caught the tail end of the bad old days of the high expertise entry barrier for learning Linux. While ease of use has been a hallmark of Unixlike systems for years, ease of initial learning for Linux is a very recent development. I had to learn things the hard way. I had a little help in making the transition to learning the shell because of SuSE 8.0, but I would have been better off with a Linux mentor and Slackware, truth be told.

As I said, though, things have changed. With SuSE 9.x, the new Debian installer, and LiveCD distributions like MEPIS, SimplyMEPIS, and Knoppix available, the entire Linux experience has become so easy to move into that it's like falling down. All you really need to do is stop trying to stay upright, and gravity takes care of the rest. Luckily, unlike falling down, using Linux doesn't hurt. That's reserved for Windows.

You might consider giving the more user-friendly Linux distributions another look. In general, what Linux suffers from these days isn't a lack of user-friendliness, but rather a lingering reputation of user-friendliness that isn't really applicable any longer.

For instructing new Linux users, I recommend starting with SimplyMEPIS, moving from there to SuSE, and then eventually to Debian (which, because of the "apt" package management utility and extensive software package archives, is the most easily-maintained Linux distribution available). A newbie should move to the next step when comfortable with the preceding distribution.

Check out the book _Point_And_Click_Linux_ by Robin Miller. It uses MEPIS as its example distribution and explains how Linux can be a rewarding experience for the most GUI-centric end user with little or no interest in understanding how the OS actually works. If you happen to be in Florida, there's going to be a presentation and book signing for the book, featuring the author of course, at a Barnes & Noble near here (in Brandon, I think ? certainly in the greater Tampa Bay area, at least).

In any case, I suspect that if you provided a system pre-installed with the right Linux setup on it, many users would hardly notice the difference. If they did, they'd probably find Linux to be vastly superior. Considering that most Windows end users just buy a computer with Windows preinstalled, throw it away when they get a new one, and call a vaguely geeky friend for help if something goes wrong, I don't see how Linux could fail to live up to (and greatly surpass) these low expectations of functionality.

For the record: in general, I agree with all you say. I simply think that some Linux distributions are rather more ready for prime time than you do, apparently.

Please accept a well earned congratulations and thanks for your persistence in this thread.

You have converted a thread from one that (superficially at least) struck me as hysterical and mis-informed to one that gets to the nub of why it DOES make sense to move to linux ..... and why, now, its such an easy step to make for most users.

As you say, things were different 12 months ago and one cannot help but conclude that those who continue to assert otherwise are simply misinformed, have not taken the effort to bring their experience into line with current state of play, or have some sort of axe to grind beyond the actual subject domain realm of "is linux desktop ready".

Heh. I'm flattered by all the kudos. Thank you.

1) For a business/production environment, your choice of server depends largely on how much support you want to contract out and how much you want to do in-house.

If you want to maintain a support contract with the vendor, I believe that RHEL would be the obvious choice for best vendor support within the US. For international use, SuSE might be a better alternative. There are, as well, a number of distributions that are of particular value in Asia, such as Turbolinux, though I'm afraid I don't know as much about the various distros that focus on an Asian market.

If you intend to handle all of your support for servers in-house, with a knowledgeable staff, Debian is probably the distribution to go with. This is in large part because of native apt support and the fact that it's what I call a "lean" distro. It is, in fact, probably the best production server distribution on the market, aside from the lack of direct corporate backing. The fact that it falls into that class I term "lean" (as opposed to "kitchen sink") refers to the fact that it is easily installed with a bare-bones, minimal set of software packages, and is extremely easy to configure for whatever use to which you desire to put it. That ease of software configuration comes from the native apt support and the extremely well-populated apt archives. It also enjoys one of the best stability reputations of any Linux distribution, and is probably available across more hardware platforms than any other distribution as well.

Another option that might be worth considering is OpenBSD. While I don't really have any significant experience with any of the BSDs, they are all Unices on roughly the same level as Linux in most regards. OpenBSD has a better security reputation, as far as I'm aware, than any other OS that runs on x86 hardware. You may decide that the difference in security capabilities is insignificant in comparison to other issues, as I have (so far) in my own work, but if you are inclined to consider security to the exclusion of all else you might want to look into OpenBSD.

There are also various SELinux implementations, which are security enhancements to Linux that were developed in concert with governmental standards. I have not as yet researched the matter enough to be able to give you much advice in this area, except that it is probably worth looking into.

In any case, as I deal primarily with businesses that handle day to day IT administration entirely in-house and outsource to the consultancy I work for when outside expertise is needed, the option that I've been working with is Debian. No vendor support contracts are in place in most instances where I consult, with the occasional exception of a mission-critical application, and as such the ease of administration and impressive stability of Debian GNU/Linux wins hands down. These characteristics are not applicable only because of the apt system and the fact that it's a lean distro (though those are significant factors): they also apply because of the dedicated, and systematic, application of quality control and testing by the Debian maintainer teams.

2) Generally speaking, I would recommend matching your workstation solution to your server solution. Different distributions are interoperable, of course, in ways that even different Windows versions are not. By standardizing on a single distro, however, you can ensure that company-wide system maintenance procedures can be standardized as well, greatly reducing the amount of man-hours put into the maintenance of heterogenous systems. When all of your systems use apt, the same set of server-side scripts can be used to monitor and implement package upgrades for both workstations and servers. The same is true of YUM and YaST-based central management (these being the core package management solutions comparable to apt in RHEL and SuSE, respectively).

Also, of course, if you have an enterprise support contract with Red Hat, you may as well make sure that it covers both servers and workstations. If you're going to do your system administration in-house for either the servers or the workstations, you should (probably) do it for the other as well.

On the other hand, for a stand-alone workstation, or in a sufficiently small environment, other issues arise. The first such issue is whether it will be implemented by the person that will use it, and whether that person is familiar with Linux. In other words: Is this a tutorial project, as well as a workstation? If the answer to that question is "yes", I would probably recommend SuSE (or, perhaps, Mandrake, though I have some reservations about Mandrake; suffice to say that I wouldn't recommend Mandrake, but I understand why some would). SuSE has become about the most easily implemented distro (discounting LiveCD distributions) for new migrants from Windows, particularly as an enterprise workstation class distribution.

For someone already somewhat familiar with Linux, I would be more inclined to suggest Debian. The reason for this, again, comes back to the fact that it is a lean distro with extreme ease of system administration (so long as you're not afraid of the command line, where the most powerful administration tools are available). SuSE (like RHEL, Fedora, Mandrake, MEPIS, and any other kitchen sink distro) suffers from the problem of being implemented in a manner that the designers of the distribution think is "good". Debian, by that same measure, enjoys the benefit of being implemented the way the user thinks is best. The downside of that, of course, is that you have to know what you want and have some idea of how to implement it. Such things are slightly more obvious to the beginner in a GUI-intensive default environment like that of SuSE or RHEL. On the other hand, if you don't want your end-users running amuck with system administration, and don't want a bunch of time-wasters installed on the system, that GUI-intensive user friendliness might be something you don't need as much. Ease of use need not include extraneous bells and whistles, after all. Once Debian is set up, it can be as easy as (or easier than) any kitchen sink distro to use for day-to-day work, because all Linuxes draw on pretty much the same exact range of software.

If you're just building a single, stand-alone, performance-intensive "dream machine", there are many who would recommend Gentoo. I tend to feel that this is entirely the wrong choice for a production environment workstation (or server) because of the vastly greater amounts of time spent in getting that optimized system. The BSDs tend to be less "friendly" to the end-user than the various Linuxes, and is thus not typically as good a workstation option except in extremely stable environments where your users all follow very strict practices that won't interfere with system administration.

3 & 4) I'm afraid I haven't any experience with running Linux emulation in Windows. The most commonly recommended implementation of it that I've come across, though, is Cygwin. I recommend looking into that for possible future use of Linux from within Windows.

Another option is simply to set up a dual-boot system. That is typically extremely easy to arrange with any major (modern) Linux distro. You would, in short, choose which OS you want running when you boot up the machine. I don't know if this is an option for you. I don't mean to insult you if you're already aware of this and have already discarded it, nor do I mean to insult you if you haven't heard of the possibility before. I'm just trying to cover all the bases. In any case, it is an option.

Personally, aside from a laptop, I would have very little reason to run a dual-boot system. I do have to have access to a Windows system here because of my work (which often involves supporting Windows-using clients and prototyping Windows solutions), but I simply run more than one computer, managed through a KVM switch so that I can just toggle between computers with the same monitor, keyboard, and trackball. I currently have three systems thusly connected, one Windows and two Debian, at my desk.

By the way, remote administration of Linux and BSD servers is extremely easy, even from a Windows machine, through the use of SSH (Secure SHell). There is a Windows client application for SSH called PuTTY that might prove invaluable for you if you must administrate *nix boxen in a primarily Windows environment. It provides access to the shell on the server as though you actually had direct access to it through a keyboard and monitor connected to that server, but accessible from your Windows workstation. SSH can also, of course, be used from another Unix workstation. SSH is by far a better remote administration tool than some other, older options like RSH and Telnet, as SSH encrypts communications between server and client systems and uses an authentication procedure when going through session initiation. Use of SSH allows a server to be actively maintained and configured easily while running "headless" (without I/O peripherals), allowing complete functionality as though you were accessing it directly.

I'm beginning to sound like a broken record, I fear.

Other than as a means to access mission-critical applications that don't run on Windows, or as a tool for learning the ropes of Linux, I generally wouldn't recommend running Linux (or Linux emulation) inside a Windows environment. As I heard one wit put it, "Now you can have all the security and stability of Windows with the user friendliness of Unix!" Without knowing more about the specific use to which you'd intend to put such a thing, though, I don't have much to offer in terms of alternatives if VMWare isn't working out for you. As I said, I've not used it myself, and have no experience with it.

One of the most important pieces of advice for anyone new to Linux who wants to learn more about it is to join a LUG (Linux User Group). You can surely find one reasonably near you, if you want to attend meetings, but more important than the meetings is simply access to the mailing lists of LUGs. Any LUG with a couple years under its belt that is keeping active is certain to have two or three people monitoring it that know far more about any given question you might have than I ever will. On a given list, you'll probably have a couple of people that are experts with multimedia Linux systems, a couple that are experts with Windows and Linux interoperation, a couple that are experts with wireless networking implementations, and so on. LUGs constitute a rich resource whose value is beyond measure. Just be humble, at least to begin with, and willing to learn. Most LUG members are friendly, helpful people. You can probably get good advice from the list about what distros to use for various purposes, too, though you might want to be wary of touching off a minor "holy war" between devotees of various distributions. Linux geeks (myself included) tend to be extremely attached to their favorite toys. I, for instance, have done my best to be impartial in considering the benefits of various distributions, though my knee-jerk reaction is always to recommend Debian first, foremost, and only. When I realized (lo these many moons ago) that I could actually upgrade my OS kernel with no more work than a single command at the shell, there was no turning back for me. That kind of power with that level of ease sold me once and for all on Debian, for my own purposes.

Thanks again for the kind words.

rubbish. There's lots of ways of checking software is genuine (PGP signatures, etc). In fact, if you purchase it from one of the major distributors (RedHat, Suse, etc) the distributing company takes responsibility - in this respect it's not much different to purchasing proprietary software, except that in my experience it's cheaper, more secure! (but the support isn't necessarily all that good).

Just a thought but how many of you bought a cd each time MS ran an upgrade - I know that I downloaded XP SP2!

Flaw 1.
With proprietary software you also do not know
which hooks have been added in the executable.
This is exactly the reason why Microsoft will
never get a foot in the door in China,
regardless how many source code files they send
to China.
Flaw 2.
All licenses of proprietary software vendors
exclude explicitly any responsibility for
whatever damage their software may do.
For example just read what rights you have next
time you install a program from Microsoft.
Flaw 3.
How come all those big multi-nationals like IBM,
Sun and Novell are all moving towards Open
Source ?
Even Microsoft is sharing their code now with a
selected few.

If you are a 'normal' user, you will be using a package manager such as RPM. The package manager will check not only that the checksum of the downloaded file is correct, but that it's signed by a known GPG digital signature.

Of course a malicious provider can calculate their own MD5 sum, and they can provide /a/ signature as well. But they can't provide Red Hat's signature or Novell's, or the signature of the Debian QA team.

This system has been in place for at least three years.

And how different is changing a file from changing an image? Not at all.

Black Hats changing your files, to attack you users, most probably has happened. I guess the risk should be 'bout the same for open source software, as for proprietary.

And while you install windows an suchlike from a physical media, like a cd, do you also get all you updates on physical media? If not, what prevents a blackhat from infecting the update site? Wether this update site is windows update, or up2date... doesent really matter.

My point is, if you want a 'puter that is tamper proof, get thee an abacus. Otherwise, take due caution.

Simple question for the forum.

As a corporate network operations center responsible for SLA and infratructure management [with dollars tied to the meeting of those SLA's] of a corporate customer network B are you going to:

1. manage that infrastructure with OSS that is potentially unsupported and unreliable or

2. with proprietary software which is under license, mainatenance, and development support?

I would probably opt for 2 when reliability and big dollars are on the line.

I'm really frustrated of receiving today an email pointing again at this this discussion when your (kaceyR) has make an international politics issue ...

How can you think you are defending a technological point by guarding a country's contribuytion ? There is NO relation.

Seems we've deviated from the original purpose of this post. A comparison of OSS versus Proprietary SW.

sd_bert - yes you're correct this is the nature of OSS "its open" - thats the point. This topic is very near and dear to my heart because as a chief engineer and program manager within my company I'm tasked with developing IT solutions for our customers and always have to look at a solution on both its technical merits as well as its cost. When I have a customer thats business is reliant on its ability to see and manage their network I can't count on OSS. I agree that the OSS concept is a wonderful forum for bringing together new ideas and collaberation but eventually that idea has to be gathered and devleoped into something that will become both supportable and their in a releasable format when you need to be. Not here today and gone tomorrow.

If you need to try out linux you can check out colinux.org, it's a mini-kernel that allows you to mount images from linux distributions on your windows XP, there is a lot of how-tos and you can find debian and fedora images that can be configure over colinux.

You can check it at www.colinux.org: "Cooperative Linux is the first working free and open source method for optimally running Linux on Microsoft Windows natively."

Another option is to try knoppix, this a Live CD that you can boot from your CDROM and have its config files saved to your XP hardrive or even a USB storage devices (YES, linux does support USB and storage devices in some distros without having to install or configure anything special). This CD you can take anywhare.

Also consider dual boot, I use fedora for this and it goes just find, it also forces you to test email and office programs that you can use to access the same information you need to access from windows (email,webmail, office documents, sorry, no ActiveX ...)

Glad you are considering seriously to give it a try, we all don't need to migrate or decide for a single solution, but need to look at both worlds.

"I've actually had a case where an Open Source solution was a near perfect fit"

As a vendor and someone who my customers depend on, it is my duty and obligation to not only "Propose" solutions, but to sometimes "Sell" solutions. For example, I will often times recommend (almost argue) that my customer use Stomp backup software rather than one of those 24.95 packages. Why?? Because the software has been around for a long time and I know that it works - and works well. I know this is not OSS vs proprietary, but it is the same principle. If the OSS package does a better job, then it is your obligation to install it over any lesser product. Quality comes FIRST - Then Price.

"On the flip side, I did make good money writing add-ons to the commercial software to make it fit their business."

And here is your sales pitch. I have yet to come across a customer who would not prefer a better "Price" in the long run. Price includes purchase price + setup costs + training + down time getting the software to work properly + custom patches to make it do what they want + + + . What would "IN THE END" cost the customer LESS.

Good point K. The problem here though is that typically there's not even a company or cohesive product [technology] to point to when offering an OSS solution to a customer. There's a reason that proprietary SW can be [as its not always] expensive. The cost to develop and provide support for the technology or product suite isn't free. As a VAR I'm in the business of taking best of breed COTS SW and tailoring it to operate as a cohesive solution that meets the cusotmers needs. In a way I'm developing an OSS type of solution [the glueware if you will]. But I'm expected to support that solution and the glue throughout its lifecycle to include version enhancements. OSS in its traditional form can't provide that. Today its here but tomorrow it may not be.

Well apo problem one here is I could never get away with proposing Linux. I'm actaully a HUGE UNIX fan - preferably the Solaris variety. I propose this for all customer solutions that require a 4 9's or higher SLA uptime. Unfortunately with the weekly maintenance boot required of W2K I can't use it in critical scenarios as I've outlined above. In my design sets I'll typically place EM solutions on Sun/Solaris and Email/File/Print on W2K or higher. I'd probably be laughed out of the briefing room if I even proposed Linux...good stuff but needs a little more maturity to run with the big dogs IMHO.

I have to totally diagree with this post. As a chief engineer I have used proprietary applications in new and inventive ways for the past 10 years. I work very closely with the developing engineers of these companies to help them make their products better. Its NOT the goal of a proprietary vendor to get away with anything [thats just bad business]. SW will be released unfortunately with oversights that have to be patched [its just the nature of SW and the myriad of code involved]. As for the frontier...using proprietary SW solutions in inventive ways have now twice put me up for patents [hows that for the frontier].

I agree with you apo. But unfortuntately I don't have the flexibility of OSS. To give it the green light I'd either have to:

1. take the code and control of it under my wing - thus no holding me [my company] responsible OR

2. hold another responsible [i.e. the proprietary SW vendor]

One or the other has to be in place before I could ever propose it to a customer. Its one thing when for personal use its another when someone else it relying on you.

Whether this is a MS FUD attack or a well-meaning innocent comment by a knowledgeable person, it reveals the heart of the struggle between open-source and proprietary software. The struggle may never be resolved but this discussion is essential and enlightening. Thanks guys.

You are relying on specious logic. Your contentions about OSS vs. proprietary are just plain dumb.

By example, let's say you download a copy of Internet Explorer, and it's been tweaked with a hack that allows an external user into your system. You're browsing around the internet and everything is great, then one day you realize that you've lost all of your data. During a post-mortem, you discover that Internet Explorer was the culprit, so you go after the developers at Microsoft. Oops! The signature of the executable doesn't match ANYTHING that Microsoft has ever released. They're not responsible. Time to rebuild your system.

And the fact is, both scenarios could be correct. However, it makes no difference.

Spoofed software and URLs are all around us and proprietary software is no less vulnerable than open source. In fact, I would say proprietary software is going to screw you worse in the long run, as the code is hidden, so there is only the software company's programmers to sift through the hacked code to fix it. Whereas, open source code is open, so thousands of programmers can track down the offending code in far less time.

This whole article is just another ridiculous way for microsoft and it's puppets to try and instill FUD around open source. Once again, the clear minds of it's opponents have nothing to worry about

That is just your opinion. And frankly it's an ill-informed and ignorant one at that. Plenty of businesses use open source software and servers. They're smart because they are saving money and their software actually works. If you think open source is a hobby, why is it that SCO is trying to sue the entire civilized world of Linux and unix users. Pull your head out of your a$$, Linux is here to stay, and when users become saavy enough and start to see there are better alternatives, Microsoft will finally be put in their place.

It's pretty sad that a company can charge more for it's software than the hardware it runs on. Shame on Microsoft. All hail open source!

I haven't tried running Linux in a VM but I have installed Mandrake Linux in three computers, making all three dual-boot. Two have Windows 2000 Pro as the default OS at boot, and one has Windows Me as a secondary OS at boot, with Linux the default.

Making a dual-boot computer is very easy with Mandrake, and probably many other Linux distributions. Mandrake's installation program takes care of virtually everything and installs LILO, the Linux Loader, in the MBR instead of the MS loader. LILO is then easily configured, from Mandrake Linux when you reboot, to choose which OS on the hard drive is the default. Try it. If you don't like Linux, the MS loader is easy to put back, from the MS install disk using the "fixmbr" command.

Although I do agree with many of your points apo I thought the purpose of this discussion was an evaluation [or at the very least the industry's opinion] of OSS versus Proprietary SW, not whether Linux is better than the usoft OS. As I said earlier personally I'd deploy Solaris to everything but to be realistic in both a ROI and secure persepctiveand as many of my customers are in the sensitive federal sector I have to look at all possibilities.

Two things come to mind when I look at OSS vs Prop.

1. Maintainability
2. Supportability

Supportability - Its free there's no support and once deployed to a customer that didn't purchase seat management they need support.

Maintainability - its OSS and might just be gone tomorrow [we just don't know since there's no stake in the ground]

There are many others but these are 2 biggies...

I'm not sure the security issues of open source are really so much greater than the risks associated with proprietary software. The key is the adminstration of the software. No system, even proprietary, is secure unless it is securely managed.
Ever wonder how much proprietary code incorporates portions of open source assembled to meet the needs of the vendor ?

[soap box on]MS has so many security holes nobody has to inject any malicious code, it's easier to just hack it. [soap box off]

One of the attractors for Open Source for me is that many vendors I am forced to use can't keep up. The bundled software they ship with their OS is sometimes several versions behind, and many times the very buggy versions I'm trying to stay away from. I download source from the original site, verify checksums, and compile. The binaries are often built for the lowest common denominator so you gain speed and can check for incompatibilities in compiling for your system. The source also allows you to tweak if required, and debug problems if necessary.

There's also a lot of Open Software that does things you just can't find anywhere else.

No matter what you buy or download, the rule is still "buyer beware".

I agree that all of the issues you raise are of concern. My disagreement is with your contention that they do not effect proprietary software. More and more software is available for immediate download so the trusted source issue is relevant for all software. You mentioned that MS relies on retail channels - again this is really just another trusted source. Where did the retailer obtain the software, is it actually the "good" code distributed by the manufacturer. Did someone tamper with the program during manufacture. These are all points that you have raised for Open Source - they are also valid for proprietary software. Oh, and if you have a copy of that software that came through grey channels (unbeknownst to you) I doubt you will get anywhere in a lawsuit with the software company since they did not control that distribution channel and should be able to prove that the software was tampered with. So all in all it's pretty much a wash in my book. You have to determine your trusted sources, then you still really need to verify that the software has not been tampered with. This is actually easier to do with OS software since you have multiple sources to check without repurchasing and you can do diffs on the source (if you want).
Sorry for the run on sentences.

Very few software companies will accept any responsablity for problems with their software.
I don't know of any that will do anything except refund you purchase price for the software.

I use both opensource and proprietary software and find very that the quality is about equal and often the support is better with opensource, by way of the internet.

You keep saying you're "a chief engineer". OF WHAT are you "a chief engineer"? Actually, never mind. I don't give a damn. Argument from authority fallacies don't interest me.

I've used proprietary solutions innovatively as well. In fact, I still do. I find that, on average, open source solutions tend to be BY FAR the better-developed solutions, however. Furthermore, developers are in charge of themselves with open source projects, and you can contact them directly, discussing changes and additions on equal footing with them, and even submit additions or changes of your own if you happen to be a software vendor. The flexibility, accessibility, and transparency of the OSS development model is, generally speaking, far superior to closed source development.

There are, of course, exceptions. There are exceptions to every rule. By and large, I use what is appropriate to the task at hand. I don't like being held hostage by proprietary solutions, however, and when all else is equal I tend to lean toward the open source solution.

Even leaving that aside, however, and judging solely on the technical merits of the solutions available, the OSS solutions are almost universally preferable. I'll consider a closed source solution when appropriate, but experience tells me that more often than not I'll find open source solutions to be the better fit and, if it doesn't fit perfectly, I have the option of making it fit in ways I can't with closed source software.

Vendors, contrary to your stated perception here, are always looking for ways to "get away with" something, at least when they've become entrenched corporate vendors. First and foremost, they're trying to get away with the least possible financial investment, because doing so maximizes profits. Anyone that claims otherwise is either badly misguided or lying.