Coverity famously helps open source projects audit their code and eliminate security holes and other bugs, and earns its corporate income by selling software that does the same thing to proprietary software companies. Few seem to realize, though, that Coverity started doing free open source code audits because it got a grant from the US Department of Homeland Security.

What is the most popular programming language used by open source developers? The answer depends on how you define popularity. According to a new study from Black Duck, a software-license code analysis vendor, C represents more than 40 percent of all code written for open source software. Black Duck made its determination by counting the actual lines of code.

Security, the experts like to tell us, is a process, not a product. With open source that can be a very good thing since when security problems are found they can be fixed quickly. That's the case over this last weekend, Feb. 9-10, when a security problem was found, and given a hot fix

The code analysis tools vendor, Coverity, has released the 2009 edition of the Coverity Scan Open Source ReportPDF. The survey, which was originally initiated by the U.S. Department of Homeland Security in 2006, examines the integrity and quality of open source software.

The first update to PHP 5.3 is now available providing 5 security fixes in addition a long list of bug fixes to the popular open source dynamic language.

The most overlooked open source security vulnerabilities, according to Palamida researchers, occur in Apache Geronimo, JBoss Application Server, Libtiff, Net-SNMP and ZLIB. "The most popular projects appear in every test. This always surprises companies. There is from three to 10 times the use of open source code [in software enterprise uses] than companies realize," said Theresa Bui-Friday, cofounder of Palamida.

Linux developers fix kernel security holes out in the open. Is a bug a bug, or do security-related fixes deserve special treatment?

Some quarters in the software industry still carry a bias against the credibility of open source security applications. Open source network gateway developer Untangle did not expect to find its request for certified testing of the popular open source virus security product ClamAV shunned. When it was, Untangle decided to do its own test.

The cloud isn't just for network administrators looking for scale, it's also a key development area for developers building applications with open source dynamic languages.