Originally posted by Jeroen Wenting:
Why is it such a critical weakness allowing crackers to invade every single Windows machine that a few thousand out of millions of lines of code of Windows were leaked by someone?
Why at the same time do you claim it's a strength of Unix that millions of lines of code for that are available to those same crackers?
Because open-source code is inspected by people who want to find bugs and fix them, and then the fixes are incorporated into the distribution. Do you honestly think anyone is going to find a bug in that leaked MS code, send it to MS and say "I found a bug in the leaked code, it seems to still be in XP, here's the patch" and MS is going to patch XP and send out an update quickly? Doubtful, since MS has been sending threatening snail-mail letters to people it suspects of having downloaded the code in the first place. There are black hats looking at the open-source code too, of course, but they're outnumbered by the good guys. Microsoft is guaranteeing that there
are no good guys.
Despite what you said about sendmail (and sendmail is far from perfect, I agree,) UNIX server admins tend to apply patches with regularity, and patches for new security holes come out quickly. Also, there are many other MTAs available, so not all sites run sendmail. And of course, sendmail, qmail, and all the other open-source MTAs run on multiple hardware platforms, so there's quite a variety of different systems. This tends to slow trojans, viruses, and hackers down; any given security hole only affects a fraction of systems, just as biodiversity creates a healthy ecosystem. You can contrast this to the Microsoft monoculture in which a single virus can spread around the globe in hours.
You know that saying about "If you outlaw guns, then only outlaws will have guns?" In open-source, everybody's got a gun. With MS, only the sheriff and the bad buys do -- everybody else is standing around, helpless, waiting to become a collateral damage statistic.