Monique Y. Mudama said:
How many of us use open source tools
like grep and find on a daily basis?
Not me. Maybe more like on a yearly basis, on the odd couple of times I
feel like giving the Linux another shot. For the "average desktop user", you
might have better luck getting an emotional reaction from a name with
"FireFox", "ThunderBird", "Azureus", "eMule", "Bittorrent", "phpBB",
"VirtualDub", "gAim", "ffdshow", "AC3Filter", "ZSnes" etc. Maybe "Apache
httpd", "Hibernate", "phpMyAdmin", etc. in an enterprise environment.
Many people who've never never even heard the term "open source" still
happily use gcc. Heck, VxWorks ships with it!
Never heard of VxWorks before either. I've heard of gcc, but haven't
used it much. Eclipse is pretty popular on this newsgroup, and it's open
source.
I think it's healthy to be skeptical about any software. I don't
think that open source is any more risky, in general, than closed
source.
The concept that open source software is risker is unintuitive to me. To
me, it's exactly the opposite: Closed source software is "riskier" than open
source software. When I download an .exe, I don't know that it'll actually
do what it claims to do. I don't know if the programmer(s) who worked on it
are competent or not. I don't know what kind of assumptions were made by the
developers (strings must always be shorter than 1024 characters? ASCII
characters only? Windows is guaranteed to be located in C:\Windows? etc.)
With open source programs, I can in theory actually look at the source code
and check that it does what it claims, was well designed, and makes
reasonable assumptions. With open source programs written in Java (and to
some degree, PHP), I can actually do this in practice.
I have friends whose "mother programming toungue" is C++. If they tell
me "Yeah, this program is well written; I know because I've actually seen
the source code", I'm much more likely to trust them than if a sales
representative from Microsoft said the same thing, for example.
I guess for "the rest of the world", the impression that open source
software is riskier comes from the adage "you get what you pay for" and
perhaps the belief in security through obscurity. Against both these
(mis?)conceptions, I can't think of a concise argument that could address
all the relevant concerns while still be approachable to the average
layperson (i.e. a non-programmer). Sure, I could tell the naysayers to go
read Bruce Schneider's various essays on obscurity, but how many of them are
going to actually do that?
- Oliver