Members of the security community tend to audit software either for a business interest, or for their own private use. Some of them do, indeed, disclose the issues they discover to mailing lists, winning reputations as Kung Fu masters. But many sit on their findings, because kudos on a mailing list or a software auditing website can never compare to the reward of unauthorized access to a high-profile system. Sardonix had nothing to offer either variety of auditor. And any chance the project might have had at recruiting a third kind of researcher was thwarted by its own obscurity: the project leaders simply did not do enough to get the Sardonix name out and advertise to the security community. . . .
Sardonix has conceded that the project has largely been a failure, putting open-source security auditing back on the drawing board.

The Sardonix project was born from the successes and eventual failure of the Linux Security Auditing Project (LSAP). Through it's design Sardonix encouraged the use of an OpenBSD-style software auditing process. This process involves researchers auditing software packages on a file-by-file basis. The purpose of the audit is to look for and locate basic programming errors that may or may not have software security implications. When the audit by one researcher has been completed, the next researcher initiates an audit of the software using the same process.

Sardonix's innovation was to create a hall of fame for security researchers, acting as a long-lasting and credible forum from which members could prove that they do in fact possess security auditing skills. The proof would come in the form of a rating system that gives the auditor a higher rating if subsequent audits proved he or she located all the bugs in the code reviewed, and gives the auditor a lower rating if other audits located bugs the researcher had overlooked.

The project aimed at finally making real the nebulous claim that open-source software is more secure than closed-source, because anybody can audit the source code of the program for security issues.

As I've said before, open-source software has an advantage in that anybody can audit the code. However, auditing for security issues happens infrequently at best. When software is developed, the focus is on just making sure it actually builds and runs. If security were a priority, production software would never have vulnerabilities, and we'd never worry about holes in software packages like Apache, Sendmail, or basically anything written in PHP.

The link for this article located at SecurityFocus is no longer available.