4 ms·
That's how the theory goes, but how often does this really happen though? See: OpenSSL
by efdee 9y ago
That's how the theory goes, but how often does this really happen though? See: OpenSSL
- tptacek 9y agoThe simple reality is that when it comes to vulnerability research, Microsoft : Windows :: Google : Open Source.
- bitmapbrother 9y agoGoogle's Project Zero has found quite a number of Microsoft bugs. Unfortunately, Microsoft has not reciprocated the favor.
- lawnchair_larry 9y agoHehe, "favor"
- skrebbel 9y agoOn the other side, e.g. Egor Homakov hacked GitHub a few times through vulnerabilities in Rails. GitHub paid him bounties anyway. I'm no expert, but it appears to me that at times it does work, just not always.
- sand500 9y agoIs github itself open source tho?
- jtl999 9y agoWell I think the source code is included (since it's Ruby, but encrypted) with the Github Enterprise image. But that's "source code available", not "open source" (ie, under a copyleft license)
- Gaelan 9y agoEncrypted with a widely known (people have blogged it) key.
- cyphar 9y ago> But that's "source code available", not "open source" (ie, under a copyleft license) It's proprietary. Also, there are many free software (or "open source" if you prefer) licenses that are not copyleft. MIT, Apache, Revised BSD, zlib, etc are all examples.
- skrebbel 9y agoNo, but a company paid a bounty for a leak in Rails, which is open source. Isn't that what this topic was about?
- sliverstorm 9y agoWell, the kernel, right? Many many major corporate contributors. Kind of the opposite of OpenSSL, I guess, which everyone uses and no one seems to maintain.
- groby_b 9y agoSee: BoringSSL
- fragmede 9y agoYou say that like Heartbleed was the end of the story. Since then, "the Linux Foundation launched the Core Infrastructure Initiative (CII) as a way of getting resources to those projects. That has helped OpenSSL, among others, to get back into a healthy state." which includes a ton of funding from many companies that depend on OpenSSL like AWS, Google, Intel, Microsoft. https://lwn.net/Articles/702751/ https://lwn.net/Articles/702751/