4 ms·

This is what I was thinking: it seems like any security and reliability vulnerabilities from OSS are at least as bad, if not worse, in paid software or closed-s

This is what I was thinking: it seems like any security and reliability vulnerabilities from OSS are at least as bad, if not worse, in paid software or closed-source. You can pay someone a lot to make a product and they can do a shitty job. You can have a company install a backdoor in a closed-source software for whatever reason. You can have a well-trusted organization with competent developers mess up a single line of code, creating a huge bug or exploit. OSS actually gives you a benefit that you can see the code and technically discover any bugs or exploits (even though of course nobody will). There are plenty of open-source libraries where contributions are seriously reviewed for any accidental or intentional errors. Serious hard-to-patch exploits are discovered in closed-source software every day. They might be harder to discover and easier to reveal without revealing how to trigger, because you can't directly see the source code. But this isn't a fundamental problem of OSS, it's something OSS users and maintainers need to look out for.

indymike 5y ago
> This is what I was thinking: it seems like any security and reliability vulnerabilities from OSS are at least as bad, if not worse, in paid software or closed-source. This is wrong: it's better in open source land. Closed source means you, the user have to wait for the vendor to ship a fix. With closed source, the answer sometimes is the version you are on is no longer maintained, and you must buy a new licenses to fix the vulnerability in your closed-source product. Other times, the answer is, sorry, we discontinued that product and will not be patching it. With open source, you have options when a maintainer says the version is too old: fix yourself, use a patched fork, or migrate. Any way you go, the situation is substantially better than closed source. > OSS actually gives you a benefit that you can see the code and technically discover any bugs or exploits (even though of course nobody will). People can and do find and report bugs and exploits in OSS all the time. It's what makes open source work so well.

indymike 5y ago

> This is what I was thinking: it seems like any security and reliability vulnerabilities from OSS are at least as bad, if not worse, in paid software or closed-source. This is wrong: it's better in open source land. Closed source means you, the user have to wait for the vendor to ship a fix. With closed source, the answer sometimes is the version you are on is no longer maintained, and you must buy a new licenses to fix the vulnerability in your closed-source product. Other times, the answer is, sorry, we discontinued that product and will not be patching it. With open source, you have options when a maintainer says the version is too old: fix yourself, use a patched fork, or migrate. Any way you go, the situation is substantially better than closed source. > OSS actually gives you a benefit that you can see the code and technically discover any bugs or exploits (even though of course nobody will). People can and do find and report bugs and exploits in OSS all the time. It's what makes open source work so well.