2 ms·
It's not so much about the issues, but the potential for issues down the line. For tools like this the aim is always to lay low and expand to reach as far as p
by bioemerl 4y ago
It's not so much about the issues, but the potential for issues down the line.
For tools like this the aim is always to lay low and expand to reach as far as possible, then once you have a lot of control and trust you can abuse it, often you can abuse it without much loss, because once you have institutional momentum it's very hard to screw it up.
You can't operate on If there's a history of abuse of power, only if there is an incentive. I believe there's a very strong incentive in this case.
- Zababa 4y agoI don't really see how can an open source project that you can self host be abused. Do you have any example of that happening?
- bioemerl 4y agoAll you need to do is sneak in something in an update that gives people access to your server, or creates a vulnerability that allows them to get access. The fact that itself hosted is actually a really huge concern, because this thing is sitting on your local network with no firewall between it and everything else that you run. It takes very little to put a vulnerability in a piece of code, and unless you have a person combing every commit with a fine tooth comb, even the fact that it's open source cannot prevent that. No single security measure is bulletproof. Being open source does not counteract the misaligned incentives.