“Open source” does not mean “more secure”

One of the stupidest lines of the pro-open source crowd is that open source code is more secure than closed source. The reasoning is that since everyone and his brother and roommate can review the code, it is unlikely that security holes will go unplugged.

The reality of open source is that, generally, everyone and his brother and his roommate can modify the code. Who guarantees that these people are competent and have good intents? Nobody. Who guarantees that a competent person reviews the code? Nobody. Even if that code appears secure, there is no guarantee that anyone understands how it impacts the security of all other code within an application or in other applications.

The biggest open source project of recent memory is the Firefox browser. It’s a pretty good browser. I use it. But it has already had three security revisions. The security problem is so serious that Firefox marketers are already in damage control mode.

Firefox may be more secure than Internet Explorer, but it gets this security by leaving out many of IE’s features. Suppose you got a current version of IE (with all patches installed) and disable or remove these extra features. Would it be less secure than the current version of Firefox? I doubt it.

Open source is not a guarantee of more security. Regardless of whether it is open or closed source, all software must be carefully scrutinized. No software should be fully trusted.

Horrible hard drive experience

Last Wednesday I got a 300 GB Seagate Barracuda hard drive. My 80GB drive is almost full, and I know that my camera’s huge picture files will quickly use the remaining space.

This 300GB drive is $130 after a rebate, although taxes and the return receipt shipping on the rebate will put the net cost just over $150.

Problem after problem has made this the most frustrating hard drive experience of my life.

  • Problem 1: Seagate’s included DiscWizard software cannot correctly copy my Windows XP system to the new drive. The copied version of Windows XP on the new drive had a blue screen of death pretty quickly. Before that, Office applications kept asking for a file that does not exist. (The file is inside a MSI that is part of Office XP SP1.)
  • Problem 2: Windows XP pre-SP1 cannot use drives over 137GB. To fix this, I slipstreamed SP2 into my XP CD and burned a CD.
  • Problem 3: Windows XP’s Automatic Updates crashed my computer. Would you believe that Microsoft classified a video card driver update as a “Critical Update”? For some reason this driver caused my GeForce4 MX 420 video card to end up in some kind of infinite loop. When Windows switched into the full GUI mode, the computer hung, wrote a log file, and auto-rebooted. It took a while to figure this out. I had to search the crash log files for Windows error codes and do a convoluted search. In the end, I had to tell Windows Update to not install the video drivers. That means that Windows Update will always whine about me missing this driver, even if I tell Windows Update not to load it.
  • Problem 4: The stupid hard drive is bad. After finally getting everything installed, I still got occasional BSoDs. I tried all sorts of hardware configuration combinations, but finally I whittled the system down to just having the Seagate drive on IDE bus 1 and nothing on IDE bus 2. Still got the BSoD. Sometimes, right after a BSoD and a reboot, the computer couldn’t even detect any hard drives installed. Reverting the system to its previous state—with my Western Digital 80GB drive as the single—returns to flawless performance. The BSoDs usually were the 0x00000077 or 0x0000007A error, which suggests a hard drive problem.
  • Problem 5: Fry’s printed out the wrong rebate! Yup. I just double-checked the rebate form. It’s the kind where the cash register prints out this lengthy duplicate receipt/rebate form. The top of the rebate receipt shows my hard drive purchase, but the rest is a $20 rebate for a 2.5GB Seagate pocket drive, not the $50 hard drive rebate. Fortunately, I managed to get Fry’s to fax me the correct form.

Argh! Experiences like this make me question why I do my own computers.

Microsoft InfoPath–promising but flawed

I just watched a demo of Microsoft InfoPath.

I am not impressed.

InfoPath is a data entry, manipulation, and reporting solution. It’s slightly more robust than web forms, and it softens the rigid development-compile-roll out-use cycles of a traditional application.

This product is fundamentally flawed. InfoPath forms users must have the InfoPath application. If you’re on the road somewhere without a laptop, you only have a lightweight client (e.g., PDA phone), or you aren’t running Windows, you’re screwed.

To make matters worse, the InfoPath application is $200 per user unless you buy an expensive Office 2003 bundle. There is no InfoPath “viewer.”

In a world moving towards thin clients, standards compliance, and platform independence, InfoPath smells of a dinosaur and vendor lock-in. Microsoft would win my vote if InfoPath created standards-compliant web forms that are just as robust as the client version.

UPDATE: Gee, whiz. One hour later, I find an article from 2003 at http://www.sdtimes.com/cols/winwatch_090.htm which almost totally agrees with me. The dearth of InfoPath information on the web suggests that InfoPath is a big dud.

Stupid, Stupid, Stupid!!

For the past two days I have been banging my head against the wall with an ASP.NET problem.

I created a custom WebControl composite class, meaning that it contains other WebControls.

I overrode its render method and used the provided HtmlTextWriter to spit out the code specific to my WebControl and the HTML code of the child WebControls which, by the way, were dynamically created in my WebControl’s Init event handler.

Anyway, what confounded the heck out of me is that if I would push a button on the ASPX page, thereby triggering a PostBack event, the ASPX page forgot all of its dynamically created controls. In other words, a richly populated page became a blank page just by me hitting the submit button!

After a lot of research on this problem, I stumbled across an article at http://scottonwriting.net/sowblog/posts/2129.aspx that didn’t directly provide the answer but proverbially slapped me across the forehead and jumbled the facts into place. I needed to add these child controls to my parent control’s Controls collection! Stupid, stupid, stupid!

I removed my custom render method and added the controls to the Controls collection, and it works like a charm. View state is preserved!