In the excellent article Why Information Security is Hard - An Economic Perspective, Ross Anderson poses that:... you can make the security critical part of the system small enough that the bugs can be found. This was understood, in an empirical way, by the early 1970s. However, the discussion in the above section should have made clear that a minimal TCB is unlikely to be available anytime soon, as it would make applications harder to develop and thus impair the platform vendors appeal to developers.The above section mentions:The huge first-mover advantages that can arise in economic systems with strong positive feedback are the origin of the so-called Microsoft philosophy of  'we'll ship it on Tuesday and get it right by version 3'. Although sometimes attributed by cynics to a personal moral failing on the part of Bill Gates, this is perfectly rational behaviour in many markets where network economics apply.I would like to understand if this also applies to an open-source kernels such as Linux, BSD, Hurd. Intuitively I would think that it only applies to a lesser extent, but that this pressure is not altogether non-existent. My main question is therefore:Is the TBC in an open-source system quantifiably smaller?If so, is this the consequence of:UNIX modular designcontinuous scrutiny of open-source codelesser pressure to get to market fastlesser pressure to court developersother ...Apologies if I got the terminology or something else wrong. Feel free to edit, or comment so that I can edit.
Is information security less hard in an open source system?
kernel;security;source code