4 ms·
In that case, of course you get into mitigation options. Depending on your contract, proprietary vendors offer few choices about getting a vulnerability patche
by imglorp 11y ago
In that case, of course you get into mitigation options.
Depending on your contract, proprietary vendors offer few choices about getting a vulnerability patched, if ever. If you're in the riffraff section (ie, most router owners only have a few), you might wait a very long time. One [1] from netgear that languished for months. And what about the Juniper backdoor: won't fix?
With open source, you can take the code to whomever you wish, fix it in house, offer a bounty, etc etc. There are plenty of houses that give away code and sell support. If GPL'ed, this model also accelerates fixes because everyone gets immediate benefit of everyone else's fixes.
http://betanews.com/2015/10/10/hackers-exploit-serious-unpatched-netgear-router-dns-vulnerability http://betanews.com/2015/10/10/hackers-exploit-serious-unpat...
- nickpsecurity 11y agoHmm. I'm probably going to have to rewrite or supplement the essay to account for these other dimensions. So, what do you think of it's primary intent to show that belief in security or no subversion come down to trusting a reviewer and methods put in rather than source access? In general rather than for, say, a project whose source you personally would review in full for every kind of security issue, etc.