3 ms·

Just to be clear, 7zip, gzip, bzip2 and others all have their own CVE's with arbitrary code execution. Open source software is not immune from these flaws. You

by Strom 3y ago

Just to be clear, 7zip, gzip, bzip2 and others all have their own CVE's with arbitrary code execution. Open source software is not immune from these flaws. You can argue for your political beliefs, sure, but let's be honest and not claim that there are any security benefits.

gorenb 3y ago
Open source does have some security benefits. If billions of (mostly) good people who want to help can read the code, they can find vulnerabilities more easily. Having so many contributors does help.
- Strom 3y ago
  That is a popular fantasy story. The reality of almost all open source software is that nobody reads the code and the primary author is struggling to find the time to keep up with maintenance. What's more, doing security review is very hard. You can't just casually read a bit of code. You need to deeply understand the surrounding context. People who have the capability to do that aren't going around providing that service for free. -- More reading for the curious: https://www.explainxkcd.com/wiki/index.php/2347:_Dependency https://www.explainxkcd.com/wiki/index.php/2347:_Dependency
  - arboles 3y ago
    Well I'm quite motivated to fix this vulnerability in WinRAR, but I can't.
    - Strom 3y ago
      You can, just download the latest version.
      - arboles 3y ago
        What if the software is abandoned or badly maintained? It took the company until August to fix it, there's the possibility it would be faster if it was Free software.