4 ms·
Yep. Log4Shell and Heartbleed were nasty security bugs, but imagine living in a world where every single software shop wrote their own logging libraries or SSL
by piaste 5y ago
Yep. Log4Shell and Heartbleed were nasty security bugs, but imagine living in a world where every single software shop wrote their own logging libraries or SSL libraries. 99% of them would have far worse vulnerabilities. It would be like '90s php cowboy coding.
- izacus 5y agoSee also: The state of proprietary closed hardware drivers and IoT firmwares. There's more security bugs in those than in Windows Me.
- tonyedgecombe 5y agoAbsent open source we would all be buying those libraries from small software shops just as happened in the ninieties before OS become so prevelant.
- mbrodersen 5y agoExactly. And the people maintaining it would be paid to do it. Instead of complaining about nobody paying them.
- watwut 5y agoI worked with small shop library. It was complete crap. We used, because management decided so. But no, it was not all that kuch prevalent. Instead, people wrote their own almost everything.
- mbrodersen 5y agoFunnily enough that would make the world more secure since a security problem found in one logging library might not be a security problem in another logging library. So you have thousands of firewalls instead of a single point of failure (the shared library). Making it very expensive for the attacker.