{"id":6395,"date":"2016-06-15T07:00:27","date_gmt":"2016-06-15T15:00:27","guid":{"rendered":"http:\/\/formtek.com\/blog\/?p=6395"},"modified":"2016-05-11T08:16:10","modified_gmt":"2016-05-11T16:16:10","slug":"open-source-unpatched-vulnerabilities-show-a-dark-side-to-open-source","status":"publish","type":"post","link":"https:\/\/formtek.com\/blog\/open-source-unpatched-vulnerabilities-show-a-dark-side-to-open-source\/","title":{"rendered":"Open Source: Unpatched Vulnerabilities Show a Dark Side to Open Source"},"content":{"rendered":"

Open Source has great benefits, as we reported a couple of weeks back on the results of Black Duck’s Open Source survey<\/a>. \u00a0Benefits like stability, quality, flexibility, no vendor lockin, and speed of development were frequently cited as reasons why upwards of 67 percent of companies are using open source.<\/p>\n

But a companion study by Black Duck<\/a> was also recently published that found that open source vulnerabilities can be a problem, especially when combined into much larger projects. \u00a0The study looked at commercial software and estimated that most commercial software contain at least 100 different elements that originate from open source. \u00a0About 35 percent of all commercial software are open source components.<\/p>\n

While on the one hand open source helps speed development, it is also to forget about those elements of software once they have been integrated as a component of a larger software package. \u00a0If the software continues to function correctly open source components are seldom tracked and reviewed again. \u00a0The result is that even when open source projects update their software to make improvements and fix vulnerabilities, those fixes often\u00a0don’t make it back into the larger software packages that are using them.<\/p>\n

67 percent of the more than 200 commercial applications examined by Black Duck were found to have vulnerabilities in open source software components. \u00a0Many of the vulnerabilities that were detected had been reported often many years earlier.<\/p>\n

Fraser Kyne<\/a>, regional SE director at Bromium, told SCMagazineUK.com<\/a> that “developers are busy and fallible. Users are busy and gullible. These basic truths are never going to change. Identifying vulnerabilities and fixing them one by one is the proverbial \u2018whack-a-mole’ security plan.”<\/p>\n

Paul Vixie<\/a>, CEO at Farsight Security Inc., told SearchSecurity<\/a>, that “technology providers win or lose based on time to market, feature level and price. Security is sometimes thought about afterward, and field upgrades and patches are usually not thought about at all. \u00a0I think it’s reasonable to assume that most bugs will live forever, somewhere.”<\/p>\n

\"Digg<\/a><\/div>
\"Reddit<\/a><\/div>
\"Stumble<\/a><\/div>
\"Buzz<\/a><\/div>
\"Vote<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Kick<\/a><\/div>
\"Shout<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Post<\/a><\/div>
\"Google<\/a><\/div><\/div>","protected":false},"excerpt":{"rendered":"

Open Source has great benefits, as we reported a couple of weeks back on the results of Black Duck’s Open Source survey. \u00a0Benefits like stability, quality, flexibility, no vendor lockin, and speed of development were frequently cited as reasons why…<\/span><\/p>\n

Read more ›<\/a><\/div>\n

<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24,31],"tags":[],"class_list":["post-6395","post","type-post","status-publish","format-standard","hentry","category-open-source","category-security"],"_links":{"self":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/6395","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/comments?post=6395"}],"version-history":[{"count":0,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/6395\/revisions"}],"wp:attachment":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/media?parent=6395"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/categories?post=6395"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/tags?post=6395"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}