3 ms·

Imagine getting 10,000 pull requests and 7 originate from KGB hackers that solve a real problem but contain a vulnerability.

nagisa 3y ago
Why bother when KGB hackers can already find a dozen of vulnerabilities just by looking sideways at a closed source project built by the most well-meaning team?
deleted 3y ago
[deleted]
nivenkos 3y ago
Wow, even using "Russians under the bed" to attack FOSS now.
- heywhatupboys 3y ago
  even worse, we know for a fact all the shit the NSA did to our software, but muh spoopy russians instead
atoav 3y ago
Imagine contracting a company and their programmer is a KGB hacker and nobody is ever allowed to see the source code.
- Lex-2008 3y ago
  that's true, but, to be fair, it might be easier to order an anti-hacker CIA background check for a contracted company of 100+ employees, than for a 10,000 pseudo-anonymous github users.
  - atoav 3y ago
    Yeah, but how often do you perfom that check? In the end it is all about the code and whether it can be checked. And I have to say my personal confidence in the quality of governmental code is higher if it is open source than if it wasn't — because I know some pretty paranoid people who would for sure check that could better than any contractor ever would.
wongarsu 3y ago
So I guess the solution is to not use open source, and force the KGB to have their agents hired as regular employees instead?
npteljes 3y ago
Valid risk [0], but that shouldn't keep the gov from making the code public. Open source / free software has its unique challenges, but it's a more fair model to people, and also it doesn't have challenges that arise from the code being "secret". [0] example with the Linux kernel: https://www.theverge.com/2021/4/22/22398156/university-minnesota-linux-kernal-ban-research https://www.theverge.com/2021/4/22/22398156/university-minne...
mozman 3y ago
It's risk management. close 10,000 quick wins and hypothetically introduce 7? many bug fixes open new bugs anyway due to poor architecture, this is what we should focus on the prc is a greater threat than Russia anyway

nagisa 3y ago

Why bother when KGB hackers can already find a dozen of vulnerabilities just by looking sideways at a closed source project built by the most well-meaning team?

deleted 3y ago

[deleted]

nivenkos 3y ago

Wow, even using "Russians under the bed" to attack FOSS now.

heywhatupboys 3y ago
even worse, we know for a fact all the shit the NSA did to our software, but muh spoopy russians instead

atoav 3y ago

Imagine contracting a company and their programmer is a KGB hacker and nobody is ever allowed to see the source code.

Lex-2008 3y ago
that's true, but, to be fair, it might be easier to order an anti-hacker CIA background check for a contracted company of 100+ employees, than for a 10,000 pseudo-anonymous github users.
- atoav 3y ago
  Yeah, but how often do you perfom that check? In the end it is all about the code and whether it can be checked. And I have to say my personal confidence in the quality of governmental code is higher if it is open source than if it wasn't — because I know some pretty paranoid people who would for sure check that could better than any contractor ever would.

wongarsu 3y ago

So I guess the solution is to not use open source, and force the KGB to have their agents hired as regular employees instead?

npteljes 3y ago

Valid risk [0], but that shouldn't keep the gov from making the code public. Open source / free software has its unique challenges, but it's a more fair model to people, and also it doesn't have challenges that arise from the code being "secret". [0] example with the Linux kernel: https://www.theverge.com/2021/4/22/22398156/university-minnesota-linux-kernal-ban-research https://www.theverge.com/2021/4/22/22398156/university-minne...

mozman 3y ago

It's risk management. close 10,000 quick wins and hypothetically introduce 7? many bug fixes open new bugs anyway due to poor architecture, this is what we should focus on the prc is a greater threat than Russia anyway