Open Source software vs. Proprietary software

Most open source code comes with checksums to begin with, and if downloaded from a legitimate site should be hack-free. Check the hash prior to installing. A bit of responsibility outweighs potential legal hassles later.

The high cost of proprietary software is driving people to seek alternatives, and those so driven often find that there is some pretty great software out there for little to no cost. Used with the proper precautions (checksums, reviews, backups) open source can leave proprietary in the dust. Great help can often be found in forums dedicated to such software, though sometimes it is hit and miss. But you won't be generally charged for support, unlike some companies, unless it is used in a business.

With the Monster end of town namely Microsoft you are in exactly the same position as you are with unknown open source code the only difference is that MS just might put out a patch but you will not be covered for any finical loss.

Col

Shifting the blame is not a "Business need." Good security begins with responsible downloads. If all you want to do is find a "fall guy" for the bad code, let's balme the dufus that failed to check the signatures on the downloaded code...oops, in your scenario, that would be you.
I guess anyone that can write or review code, or administer a workstation even, should be able to check a signature on what he downloads, huh?

I am the IT Manager for an accounting firm. I have entertained the idea of open source before (working for accountants means the cost of everything is always a big factor), but it is just not feasible for us as we have to support the software that our clients use. We have to be able to run MYOB, Quickbooks, etc. so that we can read client data files. So far we haven't had a data file that comes from an open source app and I can't see it happening in the near future.

People in the IT industry get very worked up about arguments over open source vs proprietary, but the fact is that the vast majority of computer users don't care. They just want something they are comfortable with and that gets the job done for them.

As an example of how your argument falls down, let's take a look at a 100% free software solution.

The computer I'm using right now has Debian GNU/Linux installed on it. All software on it comes from the official apt archives provided by the Debian maintenance teams. It is all open source. It is all more trustworthy than Microsoft software.

Everything that ends up in these official archives is reviewed by Debian maintainers. It's all certified by them for stability, compatibility, and security. It doesn't use a browser prone to security holes to get updates, the way Windows does, so that there has never (to my knowledge, at least) been a problem with apt archives being spoofed, whereas such spoofing goes on all the time with Microsoft.

I don't even need to address the fallacies and FUD in your post. One example is all it takes.

the time to compare the md5 checksum or other "signature" is BEFORE you install the software.

Furthermore with proprietory "closed source" software, you also have no way of knowing if the developers have put in the same kind of malevolent "hooks" to your machine.

And even furthermore, the typical EULA that accompanies that kind of of crappy product usually explicity states the software is not fit for any kind of use and specifically absolves the developing company of any kind of liability.

There goes your law suit, nit.

Because for the cost of one person recompiling the source code, then distributing the product (Firefox, OpenOfice, etc.) to the entire enterprise, you can save millions in license fees. Those are jobs that can stay here, better equipment that can be purchased, etc.

In addition, there are people out there writing apps with open source code that charge only for the added value they provide. For that, you get a greatly discounted application AND the guarantees you attribute to proprietary software.

By the way, proprietary license agreements always have a "hold harmless" clause in them that says you can't sue for damages if they crash your system.

You're issue doesn't address trusted code at all, just trusted URL's.

Since the primary distribution method of Open Source software is via download, I perceive both issues as a greater threat to the validity of the Open Source software than to Microsoft software.

Microsoft's primary distribution is through retail outlets. The odds are in Microsoft's favor that the CD's in their packaging will not be replaced by a retail vendor. In fact, Microsoft's biggest threat comes from piracy, not the Open Source Community, and even the pirates aren't injecting malicious code into the products (yet).

A couple of points to note. Proprietary software in my experience is a closed book. You get updates and new versions without really knowing what yu get until you try. Having been burnt many times with upgrades from reputable companies that broke systems and didn't work as promised (remember Windows ME), I trial and test before putting any upgrade/patch into production. Makes for a slow response but it saves time and frustration, and the integrity of the systems I look after. Even with Open source the same precautions apply, but it is an open book. I can talk to developers/list maintainers about issues with upgrades. I can recompile applications with different configurations to optimise.
My company has to pay for the same support with the commercial packages we run.
You get what you pay for.
The argument should not be about the licencing type but how good the product is and how good the support is. If it's open-source, my experience is that fixes and support are far quicker than for the proprietary software, but that's why we chose that product. It's our choice and our responsibility.
Mix them up, and let the better products win.

Fair comment regarding the possibility of open-source code being malevolently doctored. However, the answer surely is to download open-source software (such as Firefox)only from the official developer's website, where it is unlikely to have been 'spiked'.

You bring up an extremely valid point about malware and open source. This is a similar to my continuing basic flaw about all open source practice: where do you turn to if the code does not work right? At least with proprietary software, you know that you turn to the company that provided the software. Where do you turn with open source? Where did the flaw come in? The original code? An extension? Someone's one-off version that got distributed? A bad bit? And how soon do you get a replacement that you do not need to handle yourself? Again, with proprietary at least you know the chances are slim before the next version, but the chances are also good that it will be in that version. With open source, aside from doing it yourself and continuing to do it yourself, what are your options?

Don't get me wrong, I am a programmer and love playing with code as much as any other. But I would not give a source to my father and tell him to compile and debug it.

I have a neighbor who wandered off one night to "go to the store". His girlfriend became worried several hours later and asked me to help her look for him. We checked the convenience store, the bowling alley and some bars. No sign of him. I told her not to worry. A week later, he did the same thing. She came by and asked to borrow the phone to call around to try to find him. No go. A couple of weeks later, she revealed the reason he had disappeared. He wasn't at a topless bar. He is in the Army Reserves, and was doing "top secret work" for the U.S. Government that he couldn't tell her about.

Are you her brother (or sister, Kacey is a little ambiguous)?

You are right thinks could go wrong, because it would be as stupid as downloading IE from a website different that Microsoft.

All OSS have a real HOME project site, sites such as SourceForge.NET take good pride in managin open source software in a even more transparent way that any commercial product. Also, someone already mentioned MD5 checksums.

So, if you download firefox from, let's say "firefox.tweaked_EXAMPLE.com" site you MUST trust that source. Same when you HAVE to give your operating systema a plug-in to manage pop-ups, spyware or anything else.

If you apply a little brain and common sense you can rely on OSS and commercial software, if you are dumb to believe anything you read, I advise you to have a very good backup of your PC, no matter you are into OSS, commercial or both.

Let's get real. System crashes and data loss happen every day. Systems that become unusable due to OS erros happen every day. The answer to these problems is not having a software company help you fix the problem. Rather, they tell you to reinstall the software/OS. Your lost data...It is lost. Legal recourse??What planet are you living on? MS has been responsible for more data loss than anything on this planet. When was the last time somebody sued MS because their software is defective?

I feel that your comparison is somewhat unfair for a few reasons. The first being that proprietary software is just that, propietary. You are subject to whatever the producer wishes to put in the software and limited to the same. Spyware comes to mind. Your biggest argument seems to be that IF something were to go wrong THEN you would have recourse. With open source you have the choice of looking for problems prior to integrating it into your system. With executables you do not have the option. Anyone with any amount of skill CAN edit distributed executables and repackage for distrobution. If someone is smart enough to do so in open source they are very much able to do so in the executables. The "open source software movement" was started for reasons much bigger then "checking code" look at the Apache web server for example. It has evolved to a point where it is dominating the serving market. As mentioned in other replies there are methods of checking if a file has been comprimised, but nothing is secure unless you know exactly what has gone into it. Open Source is about control not cost, that's what it boils down to almost any way you look at it.

I also would like to mention that just because some can read and write any given programming language DOES NOT mean you can do better or the same even. I take it you do not realise the amount of time involved in planning, writing, debugging, commenting and distributing software of any size. I personally could not of done nearly the job Mozilla has but I can understand their code......

KaceyR: "Companies today are very paranoid (and rightly so) about system intruders and industrial espionage. With this in mind, why would you turn to Open Source software?"

Several years ago, a long time commercial database product (Borland InterBase) was turned over to the Open Source community. Only after its public release was it discovered that an unpublished "back door" previously existed to bypass the security of both the DB and the OS it ran on.

How can you be sure that the same situation does not exist in other commercial products? Without access to the code, how will you ever know? With open source, at least the possibility exists that nothing similar will sneak by. But does this mean that everyone should eschew commercial software? Certainly not.

Open Source is not a cure-all, nor will commercial vendors ever drive the open code model away. The decision to implement one vs the other is a function of economics and trust. Do you trust the open source community more than you trust your vendor? Is the long-term TCO of open source greater or lesser than that of commercial programs? There is no right answer. Neither camp is 100% correct. It boils down to an individual's decision in specific situations.

But this concept of individual choice and responsibility brings to mind another trap that KaceyR falls into. The claim is that the only way to know if an open source product is safe is to personally perform a code review. While speciously correct, the argument neglects the power of community and the monitoring and reporting that the collaborative open source environment provides. If living in a vaccuum, open source exploits -- theoretical or otherwise -- would have a field day. But the reality is that with millions of eyes in the open source community, such an exploit would not exist for long. One could be paranoid and demand a self-performed code review on every single open source app, but then I would expect such an individual to be testing their gasoline before filling their car's tank just to be sure it wasn't ethanol or diesel!

Lastly, KaceyR's legal liability hypothetical was a bit of apples/oranges. A checksum-validated commercial product was compared to a checksum-failed open source project. Let's turn that around and compare like items: a commercial vendor is no more likely to support a checksum-failed product than an open source provider is. As for the checksum-validated converse, while it may be technically true that legal recourse would be possible in the commercial situation, reality dictates that no-fault EULAs and the long legal process would render the point moot. Legal indemnification of commercial software serves mainly to bolster the trust-in-your-vendor argument.

Trust in whom you feel appropriate. It seems clear from the comments that KaceyR will live happily in the commercial world. Zealots, meanwhile, will run with Linux on their desk, Opie on their PDA, and Freevo on their DVR. The rest of us will continue to strike that balance of economics and trust.

The world might not be the US, but the world certainly turns to the US every time they need help or to be bailed out. How does anything about the US keep you from getting a job in your country? If you can't find work in your country, maybe you should blame your own government or your own citizens.

Definitely one of those days that I should have taken a break instead of typing.

Here I try to create a discussion that doesn't degrade into a series of flames, and I'm the first to light up.

Sorry about that.

Debian's servers were broken into, but the Debian project members quickly detected the attack, checked the archives, and ensured that the important bits were uncompromised. Meanwhile, we don't even know how many times Microsoft servers have been compromised.

Basically, what you are talking about here is installing untrusted software. Regardless of whether the application is open source or shareware or freeware. The license isn't the problem. You are installing software from a web site, so unless you trust the source, you run the some risk, regardless of the license. Besides, what to stop a "legitimate" ABC proprietary software company employee doing a similar thing? I mean how many "legit" companies collect "statistical" information.

Legal recourse against ABC or the open source web site for fraud, theft, damages, etc is the same. The benefit is that ABC is probably more visible and traceable than some anonomous FTP web site.

My point is - The issue with open source software at the moment is that it's more freely available and the POTENTIAL for fraud is greater. A little it security dilligance here can mitigate this risk. - ie: a checksum verification from an independant source is a simple check to make sure your download is "origional".

I've read all the posts till now and I don't get the following -

1. Trusting any software is a question of faith and testing - Can we trust any/ all properietary software to be absolutely perfect - nope, same is true for OSS front - no difference here.

2. Will finding whose responsible for a coding problem in OSS or in MS or Borland etc. solve the problem in my plate now - nope, you've got to wait for someone to fix it, who pays that guy is irrelevant - no difference here.

3.If you are a corporate with service support - commercial OSS support and proprietary support is equally good - no difference here.

4. If you chose to download & install a software with no support identifed in advance - eg. freeware on MS or Linux - your support options are the same - NIL, if things go wrong its your funeral - no difference here.

5. Legal recourses are the same if you have the same support agreements in place - no difference based on platforms (OSS/ Proprietary).

Overall,the argument put forth is axiomatic since in simple words it says proper service agreements are useful to customers irrespective of the source/ ownership of the software installed - thats like saying 2 + 2 = 4, we all know it, so whats the big deal - I don't get KaceyR's issue - lets compare unsupported Proprietary software with supported OSS software - give me the supported software anyday, who cares about its origins.

I say, based on the lifespan you are looking for use whatever is functionally appropriate and cost-effective (over the lifecycle) IRRESPECTIVE of it belonging to the OSS world or proprietary - period.

Of course, if the Company really feared setting a precedent, they may be more willing to settle out of court and tie it to a nondisclosure agreement.

As for the Courts being exclusively for Big Money, there have been way too many suits won by the Little Guy suing Companies like AT&T, MCI, Microsoft and IBM to be dismissed.

I kind of see your point, but I do not undertand how you intented to do a "versus" propietary, when in no moment you have stated the risks that propietary software have, neither see you point any pros to Open Source.

You cannot conclude, from all the postings if OSS is worth or not taking into consideration, you cannot conclude propietary software is better either, the first part maybe for the biased original article, the second one, because it depends on each case and circunstances.

I do not thing Open Source, Oracle neither MS has the answer to our problems, they just give the tools. There is a very interesting comparison made by Bernard Golden, of Navica that gives the difference in the approach of both software models, that I thing make clear that you have to consider this, your way of managing IT and your technical capacities to choose one or the other. There will never be a winner in this race.

My point was that in both cases you can get acceptable installs. And in both cases you might not as well but that there is always a fix possible and the developer weather they be a big corporation or a small software house will always attempt to come up with a fix.

Failing that there are the various user groups where questions can be placed. Incidentally the Windows User Group is a far better place to try than MS for answers.

Currently I'm doing a rewrite for a Debian install on a server platform with all SCSI HDD and an IDE CD ROM which isn't recognized after the SCSI controller is loaded. But on the same piece of hardware the same thing happens with Windows which needs a rewrite to install.

What most of the "Programing Elite" are attempting to do is to create goods that are capable of being used by the complete novice so most take it for granted that the end user will have no experience and work accordingly.

Col

I have no idea where you got the impression from his previous post that HAL 9000 was saying that open source software was only for the programmer elite. I saw nothing in what he said that suggested such a thing. All he was saying was that the same problems you'd encounter with someone relatively computer illiterate when working with OSS would arise when working with proprietary software, such as Microsoft's, as well.

The previous suggestion that OSS is more problematic for beginners because they shouldn't be expected to be able to just compile a new binary to make things work is ridiculous, because one wouldn't ask a beginner to just compile a new binary, whether working in Linux or Windows. If you continue to compare apples with oranges, you'll continue to get wildly varying results. Don't compare advanced tasks in OSS with beginner tasks in closed-source software if you want a clear comparison without bias.

People seem to have this strange belief that just because you CAN compile from source yourself, you MUST compile from source. That's simply not true. There's a wealth of precompiled binaries out there for software designed to handle basically every major task, and if you're using a major Linux distro you'll find versions of those precompiled binaries that will run on your system.

Almost every manufacturer, including Microsoft and the big ones have so many disclaimers that they are not worth the electrons they are written with.

They deny all responsibility for any losses.

(and this denial has spread to products beyond software - ever used a recent GPS - they come with a warning "not to be used for navigation" - I kid you not!)

There differences are:
1) You know the name of the company you paid in the first place
2) With open source, you can at least (in theory, if you have the talent and time) fix it; more likely someone else will fix it as a service to the community

The only incentive a company has to fix things is in the hope that you will buy their next version. And like junkies, we do ... Microsoft are no longer fixing IE for anyone except XP users (and presumably Windows 2003 server). Thus we all have to pay or suffer the flaws that came from bad programming in the first place.

Let's face it - most of the security holes are buffer overflows - documented as an issue to be addressed since the 1970s in most books on operating systems i.e. the issue has been known longer than most people have been programming.

The difference seems to be that the open source community learn more from history as they do not want to be shown up as lacking in knowledge; companies want to get product out of the door with minimum effort and maximum return.

Finally, I have to own up - I am not an open source person, I am hooked on MS and others; only time and intellect prevent me kicking the habit.

Check your licence on most software(commercial or opensource or free/shareware). There's normally a big paragraph that says something like "if our program messes with your data and eats it, then we are not responsible".

Have a look at what info Windows update sends to Microsoft about software installed on your machine. I believe you'll find (via network sniffing) that it's sending info about ALL software installed on your machine, even though the web page says it doesn't!

Most open source publishers also send a checksum of the code (binary or source) so you can double check the validity of what you are downloading.

During the last 1 month I have been called upon to repair numerous hacked Windows 2000 and XP machines - yes Microsoft proprietary software. In addition to worms and trojan horses, every single machine contained at least one Internet Explorer browser hijack.

My clients receive absolutely NO recompense from Microsoft. So much for any advantage of proprietary software!

I've migrated every one of them to Mozilla Firefox, free open source software with proven superior security.

First case : i work with Open source, i loose anything, i have to rebuild my system, hard to find someone responsible, it's true, but...
Second case : i work with, call it SoftKKro and i loose anything too; shall i do something against SoftKKro ? Sorry i'm not rich enough to pay lawyers and i have no time to loose (did any user ever got any money back or repair from an editor in such a case ?), i'll just reinstall my system with more Open Source software and less SoftKKro. That's all.

The fact that your site is MS oriented is not new or onknown (who disagrees/is blind should stay that way). It is interesting that you post this related to the launch of Firefox 1.0 which is one of the most advertised open source product !
Maybe someone should enlight me about this or maybe not.
Anyway, leaving jokes aside, questioning that a software developing model is flawed or not is useless if that model works in real life and was tested before it is:
1) useless
2) waists time of readers
3) hey you've just waisted my time 2
bye

most companies disclaim all liability in the click-wrap agreement, so there's no advantage there.

some firms provide compensation up to the cost of the software (which you also get with open source, since you didn't pay for it). MS will give you $50 over that.

since i value my time quite highly, i try not to use proprietary s/w. in my experience, OSS tends to be higher-quality, more quickly fixed, and more actively developed.

as always, there are exceptions to this in OSS, as there are exceptions to the low-value-for-money generalization in proprietary software. for example, the Apple iBook is a great value for money. an IBM iSeries is great value, same with AMD64.

my 20 years of support experience tell me MS is mostly buggy crap. i love their keyboards, though. that's it, really.

You're comparing apples to oranges here. If you downloaded and installed an "improved version" of Internet Explorer from an anonymous third party, then you clearly would either a) be willing to take responsibility or b) foolish. If you want assurance that the software is what you want, and it's in a critical position (not just a little internal helper app or something), get it from your distribution vendor, who you are paying for support. Then you have a legal recourse as normal, you have a support recourse, and you're comparing like things. You made the mistake of assuming that open source software is just free (as in beer) proprietary software with nobody behind it. If you are doing it correctly for mission-critical positions in a business, it's not.

I have one time checked that this attack vector is even not covered by Common Criteria, but it is a classic:
Ken Thomson's Reflections on Trusting Trust:
http://cm.bell-labs.com/who/ken/trust.html

The point is that you have been compromised in both cases. Policies must be in place to decide which software and what type of contingencies. When hacked becuase of a bug in IE or Mozilla based software (as example), it needs to be corrected in a way that the risk analysis done by the company. In reality a company who wishes to persue an opensource company for liability should fire their whole management team.

KaceyR you right in your reasoning, but this issue should be handled on a higher level.

PS dont download from warez sites use the opensource site :)

Open Source is how Microsoft and others started.

What is the problem with using Open Source if you are a responsible IT person?

You should never just download anything, even upgrades, to a live operating system until it has been tested on a stand alone system first. The expensive proprietary systems have crashed more than one system because of an "OOPS, we forgot to" when releasing an update or patch.

Besides, Open Source is less dangerous than the BHO's (Browser Helper Object) which infest your IE Browser. Once a malware is compiled as a BHO Microsoft IE opens your entire operating system to its manipulations. The BHO can even make itself a Protected System File.

So, there goes the safety of a commercial product.

The original scenario is inherently biased. First, your Firefox example: "During a post-mortem, you discover that Firefox was the culprit ...[but] The signature of the executable doesn't match ANYTHING the original developers have ever released."

Now, your proprietary example: "During the post mortem you discover the culprit is the ABC product from XYZ company. The file signatures are compared and, sure enough, they match."

Switch the two. If the signatures on Mozilla matched, you'd have pretty good legal ground for restitution and Mozilla would be more than willing (I'm sure) to help identify and correct the problem. But if your proprietary software's signatures didn't match, how much help do you think you'd get from that company?

Others have raised the valid question of trusted download sites, but just because something is burned on a CD and sealed in a box doesn't mean it hasn't been compromised, just that whoever did the compromising did it before the CDs were burned.

I agree with the hypothesis that open source will tend towards greater reliability. Unfortunately, because closed source can't be independently verified, this is a debate that will rage for many years to come.

I also have an issue with the idea that companies are "paraniod about system intruders and industrial espionage." If that were true, there wouldn't be near universal Internet access at most places of business (and before you even bring it up, firewalls, proxies and net filtering still equals near universal Internet access) not to mention PC accessibility. Companies today are worried about the same things they've always been worried about: public perception and stock value. As long as a press release on the evils of "hackers" will maintain them, there won't be any real move towards secure systems

But I would like to add that a lot in not all the complicated ones of the special effects that we see in movies are not performed on a Windows Platform but on Linux based computers.

There is a place for everything in the business and some just need the raw power that the Linux platform deliver in not having a lot of unnecessary code being run to look all nice and pretty at the expense of computer performance.

Col

When that is the name of the virus that affects MS update site.

However more to the point while it is true that Open Source is not ready for the desktop yet or more correctly the End Users are not ready for Open Source.

It is a big hit in the high end server market which MS is trying to crack with their Windows 2003 Enterprise Server and their Trusted Computing Model which incidental is the most secure OS that MS has ever built but it still required a patch within 2 weeks of its release and has had several since then.

In that section of the market Unix/Linux rules and there is currently no likely hood that MS will be moving in in the foreseeable future.

Col

With Open Source you still need a corporate partner who will step up to the plate and give you open source that is secure.

One way to prevent problems with Accessing via The Internet is to purchase your Open Source on CD from the provayor directly.

I invite you to read the following regarding Open Source Security. I think it addresses this issue as much as it can be addressed because we are trying to discuss several unknowns on both sides of the issue.

http://www.novell.com/linux/security/mission.html

The real issue here sounds to me like the same old Microsoft slander against Linux Distributions. While I agree that there is a risk if you download open source software from certain websites that deal in pirated software. The same thing could be said of Microsoft Windows. Also, if you are using many of the p2p application to get your downloaded software. There are many distributions like LINUX which have legitimate websites that allow you to download their distribution software for free, that do not seem to have the malicious codes that you seem to be referring to. I personally have both Proprietary and Open Source software running on different systems(i.e. WindowsXP, and ELX LINUX. I seem to have more problems with malicious attacks(i.e. virus's, worms, and other security issues) on the MS WINDOWS system than I do with the LINUX system. To point a finger at Open Source and say that they have malicious codes that will screw up your computer is just bunk. You need to look at the other 4 fingers that are pointing back at you. Take the security problems that Microsoft seem to constantly have. They are Proprietary software, yet they seem to constantly have security issues, which makes you constantly having to download "security updates". May I suggest that if you're a company or business IT or Owner that you set up a nat firewall and a software firewall on your server. Then install a different software firewall on each of your different pc's. This will keep the hackers busy trying to figure out which way to go to get into your systems. Or better yet, maybe you need to format your systems and install Open Source software such as LINUX. I am not pushing Linux distributions, but I am impressed by the growth they are having as of the past couple of years. I am just a "Windows Dummy" and I was able to install the Elx Linux on my pc with the standard "default" install. Within 5 minutes of the installation being finished, I was surfing the internet, and sharing files from my windows pc to the Linux system( and this was my 1st attemt ever and didn't know anything about Linux). I have been running this Elx Linux for only 1-1/2months( with a total of about 8 hrs of playing around trying to learn some of the basics),yet I have been using Windows distributions for over 4 yrs(started on windows 3.11, then windows 95, then 98 s.e., then me, then windows 2000, then windows xp, and windows server 2003. I am only an A+ certified(should be known as "windows certification" with hardware repair)tech. As long as there is Proprietary software, there will be hackers, virus's, worms, and other malicious codes. Open Source software actually is fairly safe, and much more stable in most cases, than the Proprietary software. It is my opinion that Open Source just keeps the proprietary guys like Microsoft working at developing better software. If Linux Distributions can be so stable, and with less virus's(or other malicious codes), for so cheap, why cann't the proprietary guys develope a more reliable sosftware.

Strawman set up! It seems like the same "Help" I get from Bill Gates. If you don't keep backed-up and keep your system locked-down against intrustion, youve got trouble anyway.

The overflows inherent in MS's products provide ample opportunies for intrusions.

It's a matter of theirs. If my client is doesn't trust a company or a technology, it's beneficial to me to find (or create) an alternative.

Proprietary software can have the same thing happen to it that open source can do. If you are downloading an update for a piece of software the web site could be spoofed and you can end up in the exact same boat that you can with open source.

The basis of the argument is the same as the sailors on the ship taking Jonah away from Nineva. Why are we so often looking for someone to blame? The one of the basic tenets of America and it's cousin, the open source software movement, is personal responsibility.

The corollary is community assistance.

I've not once had a problem that was insurmountable because there were so many people in community fora who were willing to help me resolve it.

You should first determine kind of issue you are looking for. If it is having a tool that works then your choices are Open Source or Proprietary.

If you are looking for free support, then your choice is Open Source. If you are looking for someone to blame so you can wheedle free support out of them, then Proprietary is the way to go!

>>The only way to ensure that your executable is >>as it should be, is to perform a comprehensive >>review the source code and to recompile it >>yourself.

The difference is, you can.

Or you can trust an independent organization, or hundreds of independent organizations, that did.

What about the code for voting machines?

If the code isn't available, the results could easily be manipulated.

I used to laugh at people gambling on "video poker" - after all, the results are what was programmed, not "honest" like real cards or dice.

So, unless the source (and procedures for the object) are available for review, how can any voting be honest?

Considering that 35 % to 40 % of my income is spent by the government, it seems that open source for voting machines is an economic requirement.