Many SVP/CIOs will not use a product unless there is "someone to call". Even if that choice costs them millions of dollars.
Ask HN: Why do institutions choose buggy enterprise cms over open source ones
11–13 of 13 posts
Re: Ask HN: Why do institutions choose buggy enterprise cms over open source ones
#12All software have security flaws, in open source it is simply easier to find these, also quality of opensource varies alot. Just take Drupal as an example, it is used ALOT, but isn't really pretty to look at codewise, also it has had its share of vulnerabilities, which are very easy to find, partly because all source code is readily available.
Couldn't you then say that OSS software has more people looking for flaws to patch, so it would be more secure - not less? I suppose it does vary by project though.
Its a double edged sword of course, but for the financial sector the money saved on open source would be peanuts in the grand scheme of things.
A proprietary CMS may very well be holed like a swiss cheese, but it will not be as obvious / easy to find the holes when you can't look at the source code, you are basically left with fuzzers and manual/bruteforcing injection as your only viably point of entry.
Re: Ask HN: Why do institutions choose buggy enterprise cms over open source ones
#13Because they want a support contract and someone to sue if things go badly wrong.
This is the answer. It is about doing business while shifting risk to a 3rd party.