Interviewers: Scott Swigart and Sean Campbell
Interviewee: Ben Chelf
In this interview we talk with Ben Chelf from Coverity. In specific, we talk about:
Interviewers: Scott Swigart and Sean Campbell
Interviewee: Jamie Thingelstad
In this interview we talk with Jamie Thingelstad - CTO of the Wall Street Journal’s Digital Network. In specific, we talk about:
Interviewers: Scott Swigart and Sean Campbell
Interviewee: Justin Erenkrantz
In this second part of a two part interview with Justin Erenkrantz we talked to him about:
Interviewers: Scott Swigart and Sean Campbell
Interviewee: David Campbell
In this interview with David Campbell we talked to him about:
There’s a good article on LinuxWorld about the security debate between open-source and Windows. My first question is, does it need to be a debate? In this day and age, isn’t it easy enough to quantify vulnerabilities?
If you are looking for subjective opinion, I recommend looking through the interviews we’ve done here. At the risk of sounding like a Microsoft fan-boy, the Microsoft interviews (in my opinion) demonstrate a company where secure coding is “in the water”. Code goes through threat modeling, risky function calls have simply been banned, code goes through automated and human inspection, and vulnerabilities that do slip through feedback into the process to determine how to prevent them in the future.
I simply don’t get the same feeling from the open-source people we’ve talked to. When we’ve brought the subject up, the response is almost universally “many eyeballs,” and faith (without data) that “many eyeballs” is effective.
Am I completely off base? Do things like the Linux kernel and Apache go through rigorous security reviews? Is there proof that “many eyeballs” in open source is at least as good as something like the Security Development Lifecycle in Microsoft? If you’re in a position to know, let’s chat!
A while back, we did an in-depth interview with Michael Howard about Microsoft’s Security Development Lifecycle, which has been one of our most popular interviews to date. It seems there’s a lot of interest in pulling back the covers and looking at how Microsoft is approaching building secure code.
ComputerWorld just did an interview with Microsoft’s Scott Charney, which provides more insight into their efforts to produce secure products.
Interviewers: Scott Swigart, and Sean Campbell
Interviewee: Ryan Waite
|
| Ryan Waite |
In this interview, we talk with Ryan Waite, Group Program Manager for High-Performance Computing at Microsoft. We talk about:
