4 ms·

> > Opensource software is, by default, non-malicious. > So is closed source software. Sorry what? 99.999999% of all the malware that exists and has existed to

> > Opensource software is, by default, non-malicious. > So is closed source software. Sorry what? 99.999999% of all the malware that exists and has existed today, is/was closed source. Compare that to the other 0.0000001% that got once or twice into opensource and was removed as soon as it got detected. > The main ones are 1. untrusted users being hosted 2. javascript off the web. I've never talked about (1), of course my comment was not targetted to server owners but by normal workstation owners that only have one user. WRT 2: that's precisely why I mentioned NoScript. Nowadays the only untrusted software that could be run in your computer if you were using opensource OS and opensource apps exclusively is javascript from the web (which is by default closed source).

zingmars 9y ago
Your stats need a citation, otherwise they mean nothing. CVE lists have plenty of entries for FOSS software, so it's definitely not '99.whatever' you're claiming.
- siwatanejo 9y ago
  Are you fucking serious? CVEs are for security vulnerabilities, not for malware. It's you who has to demonstrate to me that it isn't the case. Just find more than 3 cases in history of opensource malware, and you refute my theory.
Dylan16807 9y ago
> Sorry what? 99.999999% of all the malware that exists and has existed today, is/was closed source. Compare that to the other 0.0000001% that got once or twice into opensource and was removed as soon as it got detected. There is plenty of open-source malware, and most closed source software is not malware. You seem to be conflating "is in a trusted open source distribution, listed as non-malware" with mere "open source". Code that is openly malicious, or has never been peer-reviewed, is still perfectly capable of being open source. > I've never talked about (1), of course my comment was not targetted to server owners but by normal workstation owners that only have one user. That's cool but the workstation use case is not why people are freaking out. The workstation is the place where you don't even need this bug to take over and ruin everything, because it's all under one account anyway. Saying it's a "way to not be affected by these bugs" is pretty myopic.

zingmars 9y ago

Your stats need a citation, otherwise they mean nothing. CVE lists have plenty of entries for FOSS software, so it's definitely not '99.whatever' you're claiming.

siwatanejo 9y ago
Are you fucking serious? CVEs are for security vulnerabilities, not for malware. It's you who has to demonstrate to me that it isn't the case. Just find more than 3 cases in history of opensource malware, and you refute my theory.

Dylan16807 9y ago

> Sorry what? 99.999999% of all the malware that exists and has existed today, is/was closed source. Compare that to the other 0.0000001% that got once or twice into opensource and was removed as soon as it got detected. There is plenty of open-source malware, and most closed source software is not malware. You seem to be conflating "is in a trusted open source distribution, listed as non-malware" with mere "open source". Code that is openly malicious, or has never been peer-reviewed, is still perfectly capable of being open source. > I've never talked about (1), of course my comment was not targetted to server owners but by normal workstation owners that only have one user. That's cool but the workstation use case is not why people are freaking out. The workstation is the place where you don't even need this bug to take over and ruin everything, because it's all under one account anyway. Saying it's a "way to not be affected by these bugs" is pretty myopic.