Is FOSS ready for USA?

E - FOSS currently does not have a unifying process, a method, a system by which the community as a whole becomes our own active and armed defense force, following an agreed set of rules, and all working together to defend our code. Large well funded distros have remarkable and impressive security practices, but no different than diligent security management efforts at commercial companies. What is lacking is the community taking an active responsibility to set the rules, processes and governance for the auditing, review and reporting of security issues for ALL FOSS. So what ? IMO, FOSS will always have *more* security issues reported as everybody can loook at it and find them. That's not the case of a Closed Source Software (CSS). So the fact that FOSS is at parity with CSS in that report, is already a *proof* that FOSS is more secure. E - In practice, FOSS applications by type do not have MORE issues or less, just the same, as reported to NVD. Having issues reported is not a bad thing, it is an indication thyat people are looking. The point that I see is that FOSS is in exact PAR with commercial by application type. Therefore, nobody is looking beyond the immediate user base, and only as much is being looked at relative to user base in FOSS as looks at issues in commercial. E - Another way of saying this is that issue reporting in FOSS is incidental and merely a residual byproduct of use of the software. There is no organized and diligent, transparent and trusted review process for FOSS, any more so than there is for commercial. There is no larger user group that is auditing FOSS and resolving issues that can be objectively measured by publication. Security management processes for FOSS is governed as can be seen by observation by funding available, not volunteers. E - If FOSS users were truly exploiting the advantage offered by access to the code, we would see a greater number of issues reported for FOSS, and a faster and more reliable rate. Additionally, FOSS issues would be resolved at a rate consistently faster than commercial. Neither of these represent fact. "In practice and as can be seen at NVD, FOSS is no more or less secure than commercial." This is wrong. FOSS *is* more secure, because each time a security flaw is reported, everybody with the relevant knowledge will be able to work on a fix for its own organisation, which you can't do with CSS. E - You state that when there is an issue with FOSS, everyone (para) works on it. How can we verify this, and verify that this differs significantly from what is done in commercial companies? Issue resolution processes for large distributions are funded and in some cases managed partially or fully by commercial companies. The practices put in place at resolve commercial issues are the same as those used for the FOSS distros, and visa versa. Security issues for large FOSS projects are sosolved by employees, not volunteers. . . . you have to wait that your editor fixes it (so rely on their resources, agenda, constraints). And people are then able to *share* the fix, which reduces the time to get one for everbody, which again you can't do with CSS. E - Aside from a bad PHP file, if you want to FIX a Linux distro, you submit the fix, it has to be reviewed and make it into the build process. If you want to put your own patch on the web outside of the distribution process, this is likely to not be used, and does not serve the community well. What if 5 people, or 500, release their own patches? Which one do we use, and trust? So this greatly improves security of the SW planet and that's why FOSS usage is more secure than CSS usage. E - FOSS provides "freedom", freedom to use, explore, improve. It is not better, it can be, by our unrestrained effort. Freedom is a responsibility which comes with effort. If we choose to accept the effort, we can make software, all software, more secure, trusted, verified and trasparent. We can PROVE it with FOSS, and then drive our proven methods to FOSS. We all can ;-) And thereare probably improvements to do as you point out. However, from a pure philosophcal standpoint, there is no debat possible on the fact that OSS is more secure for a government. E - If there were no debate, government would have no problem adopting FOSS. A socialist environment still needs centralized rules and constraints to avoid disorder and anarchy. Again, FOSS offers us freedom to do it better. We must accept the responsibility to put actions where our FOSS rhetoric is and prove that FOSS is better. President Obama asked for a white paper from Scott McNealy regarding a discussion of security around FOSS. It is not a foregone conclusion - it is a daunting question that is as yet unanswered from the perspective of the US government. E - FOSS has just as many issues per type on NVD as commercial, no more, no less. Issue resolution takes just as long. If FOSS truly were more secure, we would actually have less issues, and those issues would be of a lower individual criticality. This is currently not happening, but could. Why leave making a secure process to the commercial vendors? They will sponsor these innovations for FOSS, and the FOSS community will brag about how safe FOSS is, but such innovations will be driven, and currently are being driven, by commercial vendors for financial benefit. We can either define the standards, or eventually be ruled by them. Do you think I am making this up? The US government is trying to build standards, and trying to drive compliance - CWE, CVE, CPE, SCAP, OVAL, and more. Why is the community not embracing standards for audit, review, testing, reporting and resolution? Why are we not defining how security should work? Conclusion - FOSS is a specific implementation of copyright. It affords "freedom", not safety, not improvement. For those of us that appreciate our freedom, we must be willing to protect it with more active and organized involvement. E - Just because lots of people can look at stuff does not mean that it will be better. It only means that it "can" be better, but it can also be worse. Just as good guys can look at the code and processes, bad guys DEFINITELY are looking at the code and the processes. They are using diligent, documented and organized strategies to exploit FOSS and commercial. We need to be as organized to protect it. Apathy is NOT security. If we each fail to actively participate in a program to drive more secure processes and procedures into FOSS, someone will actively continue to undermine it.