4 ms·
> Open source code is much more likely to already have been audited better. Worth keeping in mind this isn’t a silver bullet. OpenSSL with Heartbleed comes to
by colejohnson66 7y ago
> Open source code is much more likely to already have been audited better.
Worth keeping in mind this isn’t a silver bullet. OpenSSL with Heartbleed comes to mind.
- MaxBarraclough 7y agoVery true, but OpenSSL in particular is rather infamous. Unfortunate given that so much relies on it. https://news.ycombinator.com/item?id=7556407 https://news.ycombinator.com/item?id=7556407
- rmdashrfstar 7y agoThis is why the assumption that “open source code is more likely to be closely audited for vulnerabilities” is not true (even for incredibly core/important projects with a wide scope) and is potentially dangerous to rely on.
- ngcc_hk 7y agoIt is not 100% and always. But practically. Especially unexpected leak.
- tal8d 7y ago> This is why the assumption that “open source code is more likely to be closely audited for vulnerabilities” is not true... That is a safe assumption, otherwise you'd have to believe that non-open source code is more closely audited - at greater expense, because businesses secretly prioritize security.
- chupasaurus 7y agoShellshock still outperforms any security issue of OpenSSL in terms of time in the wild.