GnuCash is safe. Was re: How safe is GnuCash?

[Mike or Penny Novack]

On 1/14/2017 6:05 PM, GWB wrote:
> Robert,
>
> Yes, exactly, d'accord.  I have no hesitation using GnuCash for most
> environments. But the questions raised by the original poster, as you point
> out, lead me to believe he should avoid it unless his organisation and
> potential auditors certify it has the necessary feature set. From the other
> posts by the OP it appears it does not.
>
> Without knowing the specific software the OP mentions initially, the
> question becomes solipcistic (but perhaps still interesting) for most users
> of gnucash. Unless a developer wants to implement that kind of feature set,
> I would hesitate to ask for it, even though it would be great to have.  I
> am very grateful for all the work they have done so far.
>
> But who knows. If Kaj can give us the titles of the software he mentions in
> his first post, that might be specific enough to inspire this develpment in
> gnucash.
>
> Gordon
The accountant is unlikely to be thinking like a "systems auditor". 
These "other products" are considered safe by the accountant because 
they a LABELED safe (they claim to be safe) and that claim makes sense 
with the proviso that "safe" is understood to mean "safe against all but 
attacks by a very experienced software person who has full access to the 
system".

The gnucash developers COULD affix such a label. They are choosing not 
to because they themselves ARE very experienced software persons. Do you 
understand? It is the executives of that "other software" who make the 
marketing decision "label it safe" not the systems analysts who designed 
that software << and who could figure out ways around the safeguards >>

Maybe this is a matter of gnucash coming out with a QUALIFIED statement 
of safety that would be acceptable both to accountants and their own 
consciences. People (including accountants) generally accept the notion 
"if it is software, it can be hacked" and consider "safe" to mean "safe 
unless changed by hacking". That's really what these "other products" 
are claiming.

Michael D Novack
<< when I completely altered both the structure and data contents of an 
SQL database I was in effect "hacking" the backup of that database and 
then reloading from the altered backup >>