3 ms·
I'm familiar with the sentiment but there are numerous high profile CVE's in the past decade that persisted in FOSS for long periods despite wide use and many e
by pmorici 9y ago
I'm familiar with the sentiment but there are numerous high profile CVE's in the past decade that persisted in FOSS for long periods despite wide use and many eyes. The only hardware one I'm aware of is the YubiKey.
- spudlyo 9y agoI think we agree that the many eyes maxim isn't as big of a factor as some might make it out to be, perhaps it's more of a "the devil you know" situation. With hardware there isn't a lot of transparency around the implementations that are used, so it just makes me feel uncertain. I'd rather throw my lot in with OpenSSL and GPG than unknown library X. Also, it wasn't just Yubico products that were impacted by the vulnerability. It was estimated that 25% of all TPM devices globally were impacted, which adds up to millions of smartcards.