3 ms·
I'm surprised it doesn't say anything about security concerns with depending on a single individual to develop a kernel module without any ability to audit the
by thayne 7y ago
I'm surprised it doesn't say anything about security concerns with depending on a single individual to develop a kernel module without any ability to audit the code.
- pacifika 7y agoLet’s assume that is because when commercial companies contact him they pay for being able to audit the source?
- tonyedgecombe 7y agoDoes that even happen with these small projects. Having the ability to audit is pointless if it never happens.
- thayne 7y agoWell, I'd be surprised if companies like Dropbox and Google didn't audit it. And if it is used as much the article says, it would also be a decent target for security researchers, if for no other reason than they could send a bounty request to the big companies that rely on it.
- newhouseb 7y agoDropbox doesn't use FUSE -- in large part because I was terrified of adopting 60k LoC in the kernel (from FUSE) that we weren't experts on versus 1k LoC that we actually needed (and had audited by third parties).