3 ms·
That would be a huge exploit/privacy risk.
by DrScump 9y ago
That would be a huge exploit/privacy risk.
- heartbreak 9y agoRight because that's what we say about the Linux kernel too, right? If IRS is the maintainer, they still review changes. And so do all of us. If someone slips in an exploit, we'll catch it the same way every other open source project does.
- DrScump 9y agoUnless it's an exploit-able weakness that is discovered only because the source is open to be both read and tested against, like Heartbleed.
- rbanffy 9y agoI sincerely hope that machine is not accessible from the open internet.
- occams_chainsaw 9y agoThe kernel is an entirely different beast. The systems in question have been around three times longer, and have been closed from the start. A hardware caching issue bringing the whole thing down probably means it's closely tied into the hardware, and difficult to contribute to. Obscurity isn't security, but it may not be the best idea to pop the lid off everything at once in such a case.
- danso 9y agoHow would it be a privacy risk, unless, the data files were included/embedded in the source code repo?
- DrScump 9y agoHeartbleed[0] is a perfect demonstration of such a real-world exploit risk. [0] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed
- fjsolwmv 9y agoIs that why Google's and Amazon's linux kernels are constantly being exploited?
- DrScump 9y agoHeartbleed[0], it fact, was exploitable in the wild well before Neel Mehta of Google discovered and diagnosed it. [0] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed