5 ms·
A New Take on Software Code Security: The Open Source Consumption Manifesto
- OhMeadhbh 3y agoThis probably should have been written 20 or 30 years ago. I mean... the reaction to the idea that things are secure because they're open sourced. I'm just disappointed it took 25 years for an organization to respond to ESR with "hey. not all bugs are shallow." How could we have known that some bugs weren't shallow? Oh... I dunno... maybe looking at history. There were PLENTY of examples of security bugs in code from before the FSF declared a new era of open source utopia. How could we have known ESR and RMS were wrong? (At least in a small, yet important, corner of the memespace.)
- pipo234 3y agoThe manifesto sure sounds like it's coming from a (security) consultant, not a developer. > Recognize the open-source code consumption's real risks. > Establish open-source software consumption policies and test them against risk tolerance and other objectives. > Adopt and refine tooling, best practices, and processes for tracking and enhancing the security of consumed OSS. Rather than writing manifesto's I recommend getting your hands dirty in the trenches. Show, don't tell. As the lobbying seems to be aimed at "software developer organizations" consuming Open Source, I was expecting a recommendation along the lines of: contribute either money or time sustaining the project you rely on.