3 ms·
> Also, you don't have to audit apps yourself if there's an entire community of volunteers doing it for you, and perhaps even writing alternative FOSS apps. Di
by colejohnson66 6y ago
> Also, you don't have to audit apps yourself if there's an entire community of volunteers doing it for you, and perhaps even writing alternative FOSS apps.
Didn’t OpenSSL with Heartbleed show that the “many eyes” argument for FOSS doesn’t hold water?
- amelius 6y agoImho it only showed that many eyes cannot find all bugs, just like corporations cannot guarantee their software is 100% free from security bugs.
- colejohnson66 6y agoThat is true. The big problem is that employees are paid to find and fix bugs, but unpaid volunteers aren’t. The flip side is that there may be more volunteers than a corporation would hire as employees. The best of both worlds would be being paid to work on open source software (such as Linux).
- jolux 6y agoThere were almost no eyes on the OpenSSL codebase, and it was a giant pile of spaghetti for many years with nobody batting an eyelash.
- amelius 6y agoThere's an entire infosec community with white hat hackers that would love to find holes in openssl and talk about them at conferences. Perhaps they gave up on openssl because it has been impenetrable for so long?
- jolux 6y agoAs far as I know it was mostly just conventional neglect like you’d expect. Everyone assumed someone else was dealing with it until it was too late to fix. It’s much improved since then though. Huge portions audited and rewritten.