7 ms·
Similar behaviors likely exists in OSS they are just called different things. For example, ACME Co uses open source project XYZ. Acme Co uses resources to make
by jklein11 9y ago
Similar behaviors likely exists in OSS they are just called different things.
For example, ACME Co uses open source project XYZ. Acme Co uses resources to make sure that XYZ is secure and bug free. Acme Co is then incentivized to contribute any changes they have found, because they would like to stay in sync with the master branch of XYZ so they can get any updates the community pushes.
In the case of OSS, the pool of resources is likely far bigger than with closed source software.
- efdee 9y agoThat's how the theory goes, but how often does this really happen though? See: OpenSSL
- tptacek 9y agoThe simple reality is that when it comes to vulnerability research, Microsoft : Windows :: Google : Open Source.
- bitmapbrother 9y agoGoogle's Project Zero has found quite a number of Microsoft bugs. Unfortunately, Microsoft has not reciprocated the favor.
- lawnchair_larry 9y agoHehe, "favor"
- skrebbel 9y agoOn the other side, e.g. Egor Homakov hacked GitHub a few times through vulnerabilities in Rails. GitHub paid him bounties anyway. I'm no expert, but it appears to me that at times it does work, just not always.
- sand500 9y agoIs github itself open source tho?
- jtl999 9y agoWell I think the source code is included (since it's Ruby, but encrypted) with the Github Enterprise image. But that's "source code available", not "open source" (ie, under a copyleft license)
- Gaelan 9y agoEncrypted with a widely known (people have blogged it) key.
- cyphar 9y ago> But that's "source code available", not "open source" (ie, under a copyleft license) It's proprietary. Also, there are many free software (or "open source" if you prefer) licenses that are not copyleft. MIT, Apache, Revised BSD, zlib, etc are all examples.
- skrebbel 9y agoNo, but a company paid a bounty for a leak in Rails, which is open source. Isn't that what this topic was about?
- sliverstorm 9y agoWell, the kernel, right? Many many major corporate contributors. Kind of the opposite of OpenSSL, I guess, which everyone uses and no one seems to maintain.
- groby_b 9y agoSee: BoringSSL
- fragmede 9y agoYou say that like Heartbleed was the end of the story. Since then, "the Linux Foundation launched the Core Infrastructure Initiative (CII) as a way of getting resources to those projects. That has helped OpenSSL, among others, to get back into a healthy state." which includes a ton of funding from many companies that depend on OpenSSL like AWS, Google, Intel, Microsoft. https://lwn.net/Articles/702751/ https://lwn.net/Articles/702751/