In Part 2 of our Q&A with Frank Kardel, we find out how the NTP community handles code security and dive into the long-fought debate over the merits of opens source vs. proprietary software. Beyond that, Kardel addresses where the two can potentially learn from each other to improve software security.

A U.S. Department of Homeland Security-sponsored project has not only discovered that the quality of open source software code has improved significantly over the past two years, it has debunked a widely held assumption that longer function strings within source code are associated with an increased number of code defects.

Wietse Venema created the open source Postfix mail system in 1997 and still maintains most the system himself. Venema talks to us about the unique structure of Postfix that gives it a leg up on security, “open” vs. “closed” code and thoughts for an advanced Scan project.

There are dark areas of the kernel where only the bravest hackers dare to tread. Places where the code is twisted, the requirements are complex, and everything depends on ancient code which has seen little change over the years because even the most qualified developers fear the consequences. Arguably, no part of the kernel is darker and scarier than the serial terminal (TTY) code.

Having many more eyes watching the code and a community of developers backing up users, open source security applications provide a wide range of options and made-to-order uses. Here's a list of 10 serious open source security applications, gathered via the word-of-mouth of the CSOs who use them.

orporations hold a ton of open source code behind their firewalls, and Jim Whitehurst wants to extract it. The Red Hat CEO knows whereof he speaks. Before joining the company he was at Delta Air Lines. In introducing the subject Matt Asay called this code waste. Which gave me a clever idea. Don’t think of these as corporate code contributions. Think of it as code recycling.

If you have coding skills and want to use them to develop open source software you have several options. You can start a new project by yourself or with some friends, or you can join an existing project. The advantage of the former is that you get to make the rules and there is a pretty good (i.e., 100%) chance that your code will be accepted.

IBM has announced that it is joining the OpenOffice.org development community, with an initial involvement concerning code contributions it has been developing as part of its Lotus Notes product. The code includes accessibility enhancements, and IBM is expected to make ongoing contributions to the feature richness and code quality of OpenOffice.org.

The code analysis tools vendor, Coverity, has released the 2009 edition of the Coverity Scan Open Source ReportPDF. The survey, which was originally initiated by the U.S. Department of Homeland Security in 2006, examines the integrity and quality of open source software.