13 ms·
Amnesia: TCP/IP Stacks Breed Critical Vulnerabilities in IoT, OT
- DyslexicAtheist 6y agoreading through this I wonder who funded this. it would be more useful to have comparisons across both FOSS and commercial stacks. instead it reads like an amped-up jab against FOSS: > One reason why open source components are so popular is that 35% of developers consider the availability of full source code to be the most important reason to choose an OS. ... > There is a wealth of literature pointing at the risks posed by third-party components on enterprise software, including opensource, ^^ here they're linking 3 studies on Springer on why "Open Source is bad for security". and > Table 1 lists the stacks that we ultimately selected for our analysis. Note that (1) most of the stacks are close to two decades old, which means that many versions of their code exist, and many devices using the stacks are probably end-of-life; and (2) we only provide examples of notable OSes using the stacks, so the list is far from being exhaustive. ... which in my book is a life-cycle problem. none of these devices were meant to be maintained once online. upstream FOSS devs were likely not asked even if they could provide commercial support. so it reads like a blame for some very deep fundamental issues (of not being able to upgrade - never mind the lack of the technical process there isn't even a business reason) that is blamed on old vulnerabilities.