Sciweavers

Share
HICSS
2010
IEEE

Increasing Software Security through Open Source or Closed Source Development? Empirics Suggest that We have Asked the Wrong Que

11 years 6 months ago
Increasing Software Security through Open Source or Closed Source Development? Empirics Suggest that We have Asked the Wrong Que
While many theoretical arguments against or in favor of open source and closed source software development have been presented, the empirical basis for the assessment of arguments and the development of models is still weak. Addressing this research gap, this paper presents the first comprehensive empirical investigation of published vulnerabilities and patches of 17 widely deployed open source and closed source software packages, including operating systems, database systems, web browsers, email clients, and office systems. The empirical analysis uses comprehensive vulnerability data contained in the NIST National Vulnerability Database and a newly compiled data set of vulnerability patches. The results suggest that it is not the particular software development style that determines the severity of vulnerabilities and vendors’ patching behavior, but rather the specific application type and the policy of the particular development community, respectively.
Guido Schryen, Eliot Rich
Added 18 Jul 2010
Updated 18 Jul 2010
Type Conference
Year 2010
Where HICSS
Authors Guido Schryen, Eliot Rich
Comments (0)
books