5 ms·

I love magic bullets! As we've recently seen with things like Heartbleed, open source has no vulnerabilities, no bugs, no errors, and is free from all the probl

I love magic bullets! As we've recently seen with things like Heartbleed, open source has no vulnerabilities, no bugs, no errors, and is free from all the problems of proprietary software.

eru 11y ago
See https://en.wikipedia.org/wiki/Heartbleed#Discovery https://en.wikipedia.org/wiki/Heartbleed#Discovery It looks like at least having the source available made it easier for the good guys to discover the bug.
Jtsummers 11y ago
One of the problems with embedded systems like this is that very few eyes ever see the code. Even in more regulated fields like avionics. The code will be examined primarily by the developers, testers, their QA and maybe the company that hired them if it's contracted out. Instead, what gets examined are the artifacts like requirements documents, the results of tests, specifications and such. This allows poor code quality to be hidden, and, to some extent, encourages sloppy development practices (especially when time is critical). Exposing the code to more people will have several effects, but the main two (from my perspective) are: * Developers won't release as much bad code, either due to pride or insistence from their management. * Bugs may be more easily discovered and diagnosed if the code is available. As it is now, it's a black box. So if I find an issue I may be able to repeat it, but I can't examine the code to see why it's actually happening or to correct it.
nkrisc 11y ago
And then it was discovered and fixed.
snowwrestler 11y ago
Heartbleed is the perfect example of why critical code should be open source. It was discovered by developers who were not the original coders, and they were able to talk about it freely, essentially marketing it to create awareness. If OpenSSL was closed-source my servers would probably still be vulnerable today.

5 ms·

I love magic bullets! As we've recently seen with things like Heartbleed, open source has no vulnerabilities, no bugs, no errors, and is free from all the probl

by hoorayimhelping 11y ago

I love magic bullets! As we've recently seen with things like Heartbleed, open source has no vulnerabilities, no bugs, no errors, and is free from all the problems of proprietary software.

eru 11y ago
See https://en.wikipedia.org/wiki/Heartbleed#Discovery https://en.wikipedia.org/wiki/Heartbleed#Discovery It looks like at least having the source available made it easier for the good guys to discover the bug.
Jtsummers 11y ago
One of the problems with embedded systems like this is that very few eyes ever see the code. Even in more regulated fields like avionics. The code will be examined primarily by the developers, testers, their QA and maybe the company that hired them if it's contracted out. Instead, what gets examined are the artifacts like requirements documents, the results of tests, specifications and such. This allows poor code quality to be hidden, and, to some extent, encourages sloppy development practices (especially when time is critical). Exposing the code to more people will have several effects, but the main two (from my perspective) are: * Developers won't release as much bad code, either due to pride or insistence from their management. * Bugs may be more easily discovered and diagnosed if the code is available. As it is now, it's a black box. So if I find an issue I may be able to repeat it, but I can't examine the code to see why it's actually happening or to correct it.
nkrisc 11y ago
And then it was discovered and fixed.
snowwrestler 11y ago
Heartbleed is the perfect example of why critical code should be open source. It was discovered by developers who were not the original coders, and they were able to talk about it freely, essentially marketing it to create awareness. If OpenSSL was closed-source my servers would probably still be vulnerable today.