montanagrizzly -
On point 1, that's up for some debate and it depends. But yes, having the source does make it slightly easier to identify really poor design implementation. Other the other hand since most security exploits are largely buffer overflows, having the source doesn't make much difference.
On point 2, yes. The Linux community is still primarily stuck in the world of "You're on your own, baby." That is, you don't get support. You don't get notification emails. You don't know. There is no MBSA or HFNetChkPro monitoring your servers and letting you know that there are updates available. And if there are, you're stuck in the whole download the source code, do a 'make configure' and then build and install it manually world, where most endusers aren't and don't want to be.
Yes, there are companies like Redhat which will sell you the support services that we Windows users receive. The notification emails, the binary patch updates, etc. But at that point, Linux no longer has a cost advantage over Windows. Redhat Linux with these support options is a $200/year subscription. Last I checked I purchased Windows XP in 2001 for $150 and I haven't been hit up since for any support charges.
But the thing is, this "you're on your own baby" attitude is what appeals to many Linux zealots. Changing that would make Linux less appealing to them. It's a catch-22.
|