3 ms·
How do you force a company who uses OSS to fix the vulnerability? Do you hold the company or the OSS organization accountable? Who do you fine? Both? I use OSS
by wil421 7y ago
How do you force a company who uses OSS to fix the vulnerability? Do you hold the company or the OSS organization accountable? Who do you fine? Both?
I use OSS all the time but I am not capable of fixing a lot of it. I’d just use something else. Companies will just buy closed software instead from companies who will do the support and fixing for them. “It’s closed source we can’t fix it.”
- bildung 7y agoWe are talking about hundreds of millions of Euros here. The resources are there, just used for propping up prices in the black market instead of securing the software. The EU could pay a bunch of security researchers to review open source software (analog to e.g. Googles project zero). Or implement bug bounty programs for the most used open source software. In general, though, I think the company using the software should be held liable. Almost every OSS license explicitly disclaims warranty and liability. That means the company has to provide this if it wishes to use the OS software.
- detaro 7y ago> EU could pay a bunch of security researchers to review open source software (analog to e.g. Googles project zero). Or implement bug bounty programs for the most used open source software. Some EU programmes have done exactly that.
- smolder 7y agoThe answer to your first question seems obvious for me. If it's open source, you contribute improvements, rather than forcing anyone else to do so.