Open Source vs. Closed Source Software: Towards Measuring Security - Schryen, Guido; Kadura, Rouven (24th Annual ACM Symposium on Applied Computing)
The increasing availability and deployment of open source software in personal and commercial environments makes open source software highly appealing for hackers, and others who are interested in exploiting software vulnerabilities. This deployment has resulted in a debate ?full of religion? on the security of open source software compared to that of closed source software. However, beyond such arguments, only little quantitative analysis on this research issue has taken place. We discuss the state-of-the-art of the security debate and identify shortcomings. Based on these, we propose new metrics, which allows to answer the question to what extent the review process of open source and closed source development has helped to fix vulnerabilities. We illustrate the application of some of these metrics in a case study on OpenOffice (open source software) vs. Microsoft Office (closed source software).
Keywords: Open source software; Closed source software; Security; Metrics

A comprehensive and comparative analysis of the patching behavior of open source and closed source software vendors - Schryen, Guido (5th International Conference on IT Security Incident Management & IT Forensics)
While many theoretical arguments against or in favor of open source and closed source software development have been presented, the empirical basis for the assessment of arguments is still weak. Addressing this research gap, this paper presents a comprehensive empirical investigation of the patching behavior of software vendors/communities of widely deployed open source and closed source software packages, including operating systems, database systems, web browsers, email clients, and office systems. As the value of any empirical study relies on the quality of data available, this paper also discusses in detail data issues, explains to what extent the empirical analysis can be based on vulnerability data contained in the NIST National Vulnerability Database, and shows how data on vulnerability patches was collected by the author to support this study. The results of the analysis suggest that it is not the particular software development style that determines patching behavior, but rather the policy of the particular software vendor.

Security of open source and closed source software: An empirical comparison of published vulnerabilities - Schryen, Guido (15th Americas Conference on Information Systems)
Reviewing literature on open source and closed source security reveals that the discussion is often determined by biased attitudes toward one of these development styles. The discussion specifically lacks appropriate metrics, methodology and hard data. This paper contributes to solving this problem by analyzing and comparing published vulnerabilities of eight open source software and nine closed source software packages, all of which are widely deployed. Thereby, it provides an extensive empirical analysis of vulnerabilities in terms of mean time between vulnerability disclosures, the development of disclosure over time, and the severity of vulnerabilities, and allows for validating models provided in the literature. The investigation reveals that (a) the mean time between vulnerability disclosures was lower for open source software in half of the cases, while the other cases show no differences, (b) in contrast to literature assumption, 14 out of 17 software packages showed a significant linear or piecewise linear correlation between time and the number of published vulnerabilities, and (c) regarding the severity of vulnerabilities, no significant differences were found between open source and closed source.
Keywords: Vulnerabilities; security; open source software; closed source software; empirical comparison

Offshore measurements in the Baltic Sea - Bendfeld, Jörg; Tigges, Martin; Voss, Jürgen (World Sustainable Energy Days (WSED 2009), Wels, Austria, Februar 2009)

Effizientere Nutzung der Offshore-Windenergie durch die Kombination mit Biogaskraftwerken - Bendfeld, Jörg; Tigges, Martin; Voss, Jürgen (VDI Kongress AUTOMATION 2009, Baden-Baden, Deutschland, Juni 2009)

Effects of Offshore Wind Energy Fluctuations on the Intra-day spot-market in Germany - Bendfeld, Jörg; Splett, Michael (10th IAEE European Conference (International Association for Energy Economics): Energy, Policies and Technologies for Sustainable Economies; Wien, Österreich, September 2009)

Reduction of CO2 Emission of conventional utilities using offshore wind energy - possibilities and prospects - Bendfeld, Jörg; Splett, Michael (European Offshore Wind 2009 Conference & Exhibition (EoW))

Smoothing effects of the natural combination potential at spacious distributed offshore wind farms to reduce the input variability - Bendfeld, Jörg; Splett, Michael (Proceedings of the European Offshore Wind 2009 Conference & Exhibition (EoW))

The influcence of offshore wind energy on pricing at the intra-day spot market in Germany - Bendfeld, Jörg; Splett, Michael (Proceedings of the European Offshore Wind 2009 Conference & Exhibition (EoW))

Reducing the Feed-in Fluctuations of Offshore Wind Farms by Biogas Plants - Bendfeld, Jörg; Tigges, Martin; Splett, Michael; Voss, Jürgen (Proceedings of the WORLD ENERGY ENGINEERING CONGRESS, Washington Convention Center, Washington, DC, November 2009)