4 ms·

More evidence that the OSS community needs to drop the “many eyes” theory of security

• daghamm 3y ago
  On the contrary. This was detected before it reached major distributors. The only major one hit by this was homebrew, but they have never understood security anyway.
  • FireBeyond 3y ago
    > The only major one hit by this was homebrew, but they have never understood security anyway. MacOS doesn't ship with sshd running out of the box, and vanishingly few people ever enable it.
    • daymanstep 3y ago
      That's not the issue here. The xz backdoor author could have used the same technique to hijack any application that linked to xz, not just sshd.
  • soraminazuki 3y ago
    > The only major one hit by this was homebrew, but they have never understood security anyway. Do you have any evidence that other distros wouldn't have done the same? What measures do other distros have in place that would've stopped the inclusion of the backdoor had they not been alerted at the right time?
• mhh__ 3y ago
  As opposed to? The buck has to stop at a human somewhere
• derbOac 3y ago
  I guess to me it suggested even more eyes would be even better.
  • type0 3y ago
    would 5 eyes, 9 eyes and even 14 eyes be enough?
    • lesserknowndan 3y ago
      Not really replying to you… The big difference is that everybody is able to see exactly what has changed recently by comparing old open source code to contemporary open source code. This makes for a much smaller amount of content that needs to be reviewed by those eyes.