4 ms·
IMO just because it's open source doesn't mean it's safe. I would trust a closed source project that has been thoroughly and extensively vetted by a third-part
by criley2 7y ago
IMO just because it's open source doesn't mean it's safe.
I would trust a closed source project that has been thoroughly and extensively vetted by a third-party auditor I trust far more than an open source project that has no audit for me to reference.
As I am not a professional security auditor, my ability to understand the minutiae of developer decisions (intentional and unintentional) in some multi-million-LOC project is basically a limit approaching zero. My looking at the source code to give myself a false sense of security would only increase my risk, IMO.
It's like a restaurant tells you "yeah we have a clean kitchen, you can go take a quick look yourself!" and it's like, do you know to check that water and disinfectant buckets can't be within x feet of each other? To temp every fridge and warmer to ensure no danger zones? To monitor glove usage and hair net usage? And a thousand other things?
Being open source basically means that a nice auditor could do some audit work for free to help the community, but that's about it from my perspective.
Unless some of you are actively code reviewing the entirety of Chromium prior to launching any build of it ???
- tlb 7y agoCan you give an example of a closed-source project you trust because it has been audited by a third party?
- kbrosnan 7y agoJust about all certificate authorities are trusted by billions of people a day to encrypt their data. Almost all of CAs are privately held companies, the only way they are trusted is by being audited by a third party. For info about the inclusion process see https://www.ccadb.org/ https://www.ccadb.org/ and https://wiki.mozilla.org/CA/Information_Checklist https://wiki.mozilla.org/CA/Information_Checklist LetsEncrypt is an example of a non-profit open source based CA.