3 ms·
nginx is open source. I tend to use the distribution provided packages which in case of debian are reproducible builds. (yeah, i know there's a pro version of
by kiney 7y ago
nginx is open source.
I tend to use the distribution provided packages which in case of debian are reproducible builds.
(yeah, i know there's a pro version of nginx. never used it)
- iforgotpassword 7y ago"It's open source, someone surely is doing regular thorough security audits."
- stjohnswarts 7y agoAuditing one of the world's most used pieces of internet facing software that also isn't "a huge codebase"? Yes I do think nginx will be just fine. Security experts are constantly combing through that sort of software looking for holes, as well as AI tools. duh. It ups your brand to find holes.
- nxc18 7y agoCounterpoint: https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed - 2 years is a long time
- kiney 7y agothe thing is: you have to introduce very subtle bugs when the code is open. And if you exploit it in the millions someone is going to notice.
- iforgotpassword 7y agoIndeed. If, as suggested, a backdoor is planted by something like a three letter agency they're not going for mass surveillance or "hacking all the things". It's a very valuable asset that you use wisely, maybe even just once if the target is worth being discovered afterwards.
- ajross 7y agoSomeone surely is doing regular thorough security audits of nginx, yes. Even at maximal cynicism, discovering a backdoor in its source code would get someone niche fame and a job at Project Zero (or a nice windfall on the black market, I guess).