From: Tony Williams 

Antti Kurenniemi wrote:
> "Tony Williams"  wrote in message
> news:3DE7AAB4.7010606{at}blarg.net...
>
>>That's where the open source peer-review comes into play. If I
>>publish a fix for a security exploit you can safely bet that it's going
>>to be  widely scrutinised. As opposed to a closed source fix
>>where you're back  to having only the vendor's word to rely on.
>
>
> Did you notice that you used the words "safely bet"? I don't
think that's
> any better than "safely betting" that MS has done good job
in fixing one of
> their problems. I either have a closed source vendor's word, or a bunch of
> open source programmer's words to rely on.

I chose the words carefully. You have a choice to trust many people working
out in the open and having their efforts publicly reviewed, or to trust a
single source with no third-party corroboration. Either way you have to
trust somebody to not have made a mistake or been malicious
- what's that saying? "Trust, but verify". Closed source lacks the
"verify" portion.

--
Tony

--- BBBS/NT v4.01 Flag-4