#Open source scanner softwre software#

Having many users look at source code does not guarantee that security flaws will be found and fixed. Having a large amount of eyes reviewing code can 'lull a user into a false sense of security'.At one time, there were over 2,000 sites using his toolkit, but only 10 people gave him any feedback or patches. An example of this occurring is when Marcus Ranum, an expert on security system design and implementation, released his first public firewall toolkit. Simply making source code available does not guarantee review.His ideas were the basis for many modern security practices, and followed that security through obscurity is a bad practice. Kerckhoffs' principle is based on the idea that an enemy can steal a secure military system and not be able to compromise the information.With access to the source code for the compiler, the developer has at least the ability to discover if there is any mal-intention. It is assumed that any compiler that is used creates code that can be trusted, but it has been demonstrated by Ken Thompson that a compiler can be subverted using a compiler backdoor to create faulty executables that are unwittingly produced by a well-intentioned developer.

#Open source scanner softwre software#

Proprietary software forces the user to accept the level of security that the software vendor is willing to deliver and to accept the rate that patches and updates are released.2.1 Number of days between vulnerabilities.