3 ms·

This is one of the main reasons for libre/free/open/choose_your_term software. Even when malice is not to be checked for, genuine error, incompetence, forgetfu

This is one of the main reasons for libre/free/open/choose_your_term software. Even when malice is not to be checked for, genuine error, incompetence, forgetfulness or plain indifference must be checked for.

krylon 9y ago
As much as I love Free Software, there have been plenty of examples of bugs (security-relevant and otherwise) in FLOSS code that were just as problematic. Source code being open for inspection only helps if people actually take the time to look at the code. OpenBSD deserves an honorable mention.
- mikegerwitz 9y ago
  Proprietary software developers have little incentive aside from the possibility of discovery to not take advantage of users. It's sometimes difficult to determine whether it's malicious or not, and there's a greater chance for plausible deniable---we don't know the story behind that code. If an anti-feature is discovered in free software, it can be promptly removed and replaced, regardless of whether the developers of the software consider it to be an anti-feature. What if HP wants this to remain for debugging/diagnostic purposes? There's little you can do about that. (I'm not saying they do.) The fact that free software can have bugs is an open source argument that falls apart when the argument becomes "open source is better because of technical advantage X".[0] There are frequent arguments that the freedom of drivers isn't important---mainly because it's inconvenient to use a system without non-free drivers and requires purchasing replacement hardware to work around. This is an example that maybe can help counter that point. [0]: https://www.gnu.org/philosophy/open-source-misses-the-point.html https://www.gnu.org/philosophy/open-source-misses-the-point....
  - krylon 9y ago
    I do agree - wholeheartedly - with you that Free Software gives users control over what their devices do. This is important. Control and trust that your devices do what they are supposed to do - no more, no less - are pretty much impossible to establish without free software My point was that if nobody bothers to look at the code, the bug will go undetected. Think of how long the Heartbleed bug had been in OpenSSL before it was discovered.
    - mikegerwitz 9y ago
      > My point was that if nobody bothers to look at the code, the bug will go undetected. Think of how long the Heartbleed bug had been in OpenSSL before it was discovered. Yes, I agree. "Linus's Law", while it has some truth, is a flawed (and open source) reasoning if considered absolute.
    - mannykannot 9y ago
      Furthermore, security bugs are a special case, because of the motivation for the bad guys to find them first. One might argue that the rest of us have just as much motivation, but you know how that works in practice.
- BEEdwards 9y ago
  Okay... I'm not sure what your point is. Yes, there can be issues with open source software, but unlike closed software it can actually be fixed.

krylon 9y ago

As much as I love Free Software, there have been plenty of examples of bugs (security-relevant and otherwise) in FLOSS code that were just as problematic. Source code being open for inspection only helps if people actually take the time to look at the code. OpenBSD deserves an honorable mention.

mikegerwitz 9y ago
Proprietary software developers have little incentive aside from the possibility of discovery to not take advantage of users. It's sometimes difficult to determine whether it's malicious or not, and there's a greater chance for plausible deniable---we don't know the story behind that code. If an anti-feature is discovered in free software, it can be promptly removed and replaced, regardless of whether the developers of the software consider it to be an anti-feature. What if HP wants this to remain for debugging/diagnostic purposes? There's little you can do about that. (I'm not saying they do.) The fact that free software can have bugs is an open source argument that falls apart when the argument becomes "open source is better because of technical advantage X".[0] There are frequent arguments that the freedom of drivers isn't important---mainly because it's inconvenient to use a system without non-free drivers and requires purchasing replacement hardware to work around. This is an example that maybe can help counter that point. [0]: https://www.gnu.org/philosophy/open-source-misses-the-point.html https://www.gnu.org/philosophy/open-source-misses-the-point....
- krylon 9y ago
  I do agree - wholeheartedly - with you that Free Software gives users control over what their devices do. This is important. Control and trust that your devices do what they are supposed to do - no more, no less - are pretty much impossible to establish without free software My point was that if nobody bothers to look at the code, the bug will go undetected. Think of how long the Heartbleed bug had been in OpenSSL before it was discovered.
  - mikegerwitz 9y ago
    > My point was that if nobody bothers to look at the code, the bug will go undetected. Think of how long the Heartbleed bug had been in OpenSSL before it was discovered. Yes, I agree. "Linus's Law", while it has some truth, is a flawed (and open source) reasoning if considered absolute.
  - mannykannot 9y ago
    Furthermore, security bugs are a special case, because of the motivation for the bad guys to find them first. One might argue that the rest of us have just as much motivation, but you know how that works in practice.
BEEdwards 9y ago
Okay... I'm not sure what your point is. Yes, there can be issues with open source software, but unlike closed software it can actually be fixed.