July 24th, 2008
Ingres gives Fortify security study a good fisking
Since Fortify released its security study, unleashing the FUD flood, I have been waiting for someone to give it a good fisking.
Today we have a winner. Meet Emma McGrattan, senior vice president of engineering for Ingres, an open source database outfit.
McGrattan is no dirty hippie blogger. She is a candidate for the board of Eclipse, from which the photo was taken. And she’s a graduate of Dublin City University in Ireland, for my money the real fighting Irish.
Her main points:
- There are other security toolkits other than Fortify. Just because you don’t use their system doesn’t mean you don’t care.
- When reading vendor-sponsored studies consider the source. Always a wise move.
- Open source projects in Fortify’s Open Review report fewer defects per thousand lines of code than proprietary products in the same review. I didn’t know that.
Many of Fortify’s recommendations are cheap and easy to implement, McGrattan notes, and all projects should do more to protect their users.
Like post a security-specific e-mail alias on your Web site and have an expert on standby for questions concerning attacks.
Being transparent about your own vulnerabilities is also a good thing. Ingres is. Transparency does a lot more for everyone’s security than opacity. That’s just my personal bottom line.
One more point. Fortify’s study chose 11 open source projects to research. Ingres was not one of them.
Dana Blankenhorn has been a business journalist for 30 years, a tech freelancer since 1983. See his full profile and disclosure of his industry affiliations.
