3 ms·

I was interested in Piwik until I noticed the many, many open security issues: https://github.com/piwik/piwik/issues?q=is%3Aopen+is%3Aissue+label%3A%22c%3A+Sec

I was interested in Piwik until I noticed the many, many open security issues: https://github.com/piwik/piwik/issues?q=is%3Aopen+is%3Aissue+label%3A%22c%3A+Security%22 https://github.com/piwik/piwik/issues?q=is%3Aopen+is%3Aissue... Includes an issue from January about insecure random-number-generation: https://github.com/piwik/piwik/issues/9473 https://github.com/piwik/piwik/issues/9473 and one from March claiming that it doesn't reliably use TLS to update plugins: https://github.com/piwik/piwik/issues/7582 https://github.com/piwik/piwik/issues/7582 It bothers me a lot when people advocate self-hosted services with really bad security posture to increase privacy (or "control", as the author says).

educar 10y ago
Having seen the issue trackers of many closed source SaaS products, let me tell you that this is hardly anything. If anything, it's great that all this is in the open and I can assess and prepare myself in terms of sysadministration accordingly.
- startling 10y ago
  Maybe! But for example Piwik's main competitor is Google Analytics. It's reasonable to not trust Google for privacy reasons, but Google employs one the largest security teams in the world and produces very well-regarded research. I trust Google with securing Google Analytics more than I trust Piwik's developers with securing Piwik.