Re: Gauntlet: source code anyone ?

["nate campi" <nayfin () hotmail com>]

I hate to see someone like Mr Ranum lose faith in opening up the source 
of his products. Granted, I cannot hope to audit the source code of a 
product like Guantlet as I cannot code anything other than rudimentary 
Perl, but many users still can. 
In fact, I would wager that more people now can audit source code than 
ever before.  What has changed in the percentage of the users who can. 
In the not-so-distant past I'm sure that at least half of the users of 
the FWTK could custom write code to enhance thier firewall 
installations. Now perhaps only a small percentage could hope to do so, 
but the total numbers of C/C++ coders can only be greater than at any 
time before. Even if a smaller percentage of the coders actually take 
the time to audit the code, at least the rest of us (non-coders) can 
rest assured knowing that if the code was complete trash that someone 
would ring the alarm and tell the rest of us about it.
When I use an open source security product I feel better knowing that 
eventually many (hopefully all) weaknesses/vulnerabilities will be 
discovered and made public.  I hardly care the color hat of the person 
who discovered it either, as long as they don't demonstrate the 
vulnerability on my sytems :)
The point of my little speech is that I still believe in the value of 
open source security products (commercial or otherwise) and I hope that 
the pioneers of the movement like Mr Ranum don't lose faith as the 
landscape changes a little. 
Even though the landscape has changed, the open source view is still 
beautiful from where I'm standing...

nate campi


> From: Steve George <stevege () i-way net uk>
> Reply-To: Steve George <stevege () i-way net uk>
> To: Darren Reed <darrenr () reed wattle id au>
> CC: firewall-wizards () nfr net
> Subject: Re: Gauntlet: source code anyone ?
> Date: Sat, 20 Mar 1999 11:57:12 +0000
> MIME-Version: 1.0
> From owner-firewall-wizards () nfr net Sun Mar 21 19:29:02 1999
> Received: (from lists@localhost)by nfr.net (8.8.8/8.8.8) id RAA03318for 
firewall-wizards-outgoing; Sun, 21 Mar 1999 17:44:09 -0600 (CST)
> Received: (from fwiz@localhost)by nfr.net (8.8.8/8.8.8) id RAA03170for 
firewall-wizards () nfr net; Sun, 21 Mar 1999 17:21:29 -0600 (CST)
> Received: from vpn.i-way.net.uk (soho.vpn.i-way.net.uk 
[194.207.109.62])by nfr.net (8.8.8/8.8.8) with ESMTP id FAA25486for 
<firewall-wizards () nfr net>; Sat, 20 Mar 1999 05:53:07 -0600 (CST)
> Received: by vpn.i-way.net.uk; id NAA14760; Sat, 20 Mar 1999 13:32:28 
GMT
> Received: from unknown(10.10.11.98) by soho.vpn.i-way.net.uk via smap 
(4.1)id xma014758; Sat, 20 Mar 99 13:32:27 GMT
> Message-ID: <36F38D18.5418AEE8 () i-way net uk>
> X-Mailer: Mozilla 4.5 [en] (X11; I; Linux 2.0.34 i586)
> X-Accept-Language: en
> References: <199903172150.IAA03539 () avalon reed wattle id au>
> Sender: owner-firewall-wizards () nfr net
> Precedence: bulk
>
> It strikes me that source code availability is like free speech: you 
may
> not use it but you sure notice when it's gone. 
>
>
> Steve

Get Your Private, Free Email at http://www.hotmail.com