Is Code Auditing of Open Source Apps Necessary? 108
An anonymous reader writes "Following Sun Microsystems' decision to release a raft of open source applications to support its secure cloud computing strategy, companies may be wondering if they should conduct security tests of their customized open source software before deployment. While the use of encryption and VPNs to extend a secure bridge between a company IT resource and a private cloud facility is very positive — especially now that Amazon is beta testing its pay-as-you-go private cloud facility — it's important that the underlying application code is also secure. What do you think?"
OpenBSD (Score:2, Informative)
OpenBSD does code audits. All security-sensitive applications should be, if not by the developers, by the people deploying them, if they have the resources.
Re:Yes. (Score:1, Informative)
Code review of **every line** is best practice. That's independent, desk check style code reviews. The reviewer needs to feel they could put their name on the code, or start writing action. Any questions need to be addressed prior to the sit-down review with an uninterested moderator. Any burning questions that were not answered to everyone's satisfaction, need to be researched until there aren't any more "I don't understand" that section of code.
Re:Flip the question. (Score:3, Informative)
IANAL, but that clause would be trivial to toss out
Lawyer: "I'm not a software developer, but it's trivial to use that java library in a C# application"
That's about how many orders of wrong you are here. I also play my share of lawyer on slashdot, but I know how to read cornell.edu - and it's amazing how much better the discussion would be if most people had - but I also know when to STFU and not make a fool out of myself. Like in this case UCC 2-316. Exclusion or Modification of Warranties. [cornell.edu] which quite clearly states that you can exclude any implied warranty of fitness or merchantability. You may get around that if you prove the disclaimers are unconscionable, but that's a tall order and not in any case trivial. Maybe for things that are more malice or fraud than incompetence, or in case of personal injury which is why software often explicitly exclude any such use.