3 ms·
> it's not possible to review it all much less to catch subtle exploits that might have been introduced by security agencies - we can't even catch many unintent
by rodgerd 11y ago
> it's not possible to review it all much less to catch subtle exploits that might have been introduced by security agencies - we can't even catch many unintentional exploits
Precisely. In the wake of Shellshock and Heartbleed the sneering tone of the passage you've cited should profoundly embarrass the author. It does not accord well with the facts.
- moxie 11y agoPeople tend to cite heartbleed as an example of how "open source" has no intrinsic security value. While I agree that something being "open source" does not automatically make it secure, I think that it does allow us to gauge the security of the project. In the case of heartbleed, anyone who has ever spent more than 30 seconds looking at OpenSSL can tell you that it is not secure software and never will be. We can't identify and remedy every possible vulnerability, but we do have enough information to know that events like heartbleed will happen again and again.
- leohutson 11y agoPeople that claim open source has no security value seem to believe that just because you can't catch every vulnerability through public review, you may as well not bother at all. That logic is obviously faulty, I can't imagine they would apply the same rationale to cancer screening.
- rodgerd 11y ago> People that claim open source has no security value Nice strawman you got there.