3 ms·
I think the message would more likely be "don't use open source and pay for closed source" than "give money to open source and cross your fingers that it does s
by bongodongobob 3y ago
I think the message would more likely be "don't use open source and pay for closed source" than "give money to open source and cross your fingers that it does something".
- markus_zhang 3y agoEither way, it gives more jobs and $$$ to software developers in general. I'm fine with both :) Just imagine how many more jobs will be created if every large company decides to roll their own stuffs. A lot are actually doing this, but not enough.
- bongodongobob 3y agoThat just sounds like the broken window fallacy then. "It's good we have broken windows so the window makers have jobs".
- markus_zhang 3y agoSince that already happened, let's drink from the half-full bottle.
- pkulak 3y agoIt absolutely is. But we're all window makers, so our perspective is slightly different from general econ. ;)
- sargun 3y agoTo be fair, you also need software engineers to break the windows. It is in our best interest to break the windows.
- treyd 3y agoThat is a tremendous amount of duplicated effort and it would be nice to be able to go and do something else with our skills and lives.
- rmbyrro 3y agoYou should have more discretion with those ideas or disclose irony clearly, which I hope is the case here.
- jerf 3y agoIf that is the takeaway the industry takes from this, it will be a huge mistake. We are talking about this at all precisely because it was open source. Commercial closed source software can simply be assumed to be compromised. We know of enough instances of it happening that if you still have a knee-jerk "oh that sounds like a conspiracy theory" reaction to that claim, you need to recalibrate your conspiracy theory meter, quickly.
- dartos 3y agoI mean Okta has shown us that paying for closed source does not imply higher quality or more secure software.
- bongodongobob 3y agoYeah I'm not implying that's the way to go, but thinking since something open source was compromised that it will encourage businesses to donate is wishful thinking.
- acdha 3y agoAlso F5 or Citrix: some of their core security products had 90s-style C exploits and other signs of development practices well behind the times - roughly at the level of going to surgery and seeing your surgeon not washing their hands in the bathroom. https://www.cisa.gov/guidance-addressing-citrix-netscaler-adc-and-gateway-vulnerability-cve-2023-4966-citrix-bleed https://www.cisa.gov/guidance-addressing-citrix-netscaler-ad... https://www.mandiant.com/resources/blog/session-hijacking-citrix-cve-2023-4966 https://www.mandiant.com/resources/blog/session-hijacking-ci... https://www.fortinet.com/blog/threat-research/defending-against-critical-f5-vulnerabilities https://www.fortinet.com/blog/threat-research/defending-agai... https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-138a https://www.cisa.gov/news-events/cybersecurity-advisories/aa...
- pxc 3y agoIt might be riskier (because you'd have to identify yourself with government documents) to plant a backdoor in a similar way at a large, proprietary software vendor like Microsoft. But I don't know that it would be harder. And in the case of proprietary software there would not be nearly as much public scrutiny, and the scrutinizing public would have fewer resources for inspecting it.
- sliken 3y agoLike Ivanti's Pulse VPN? Who hid a CentOS 6 in an appliance, unpatched, way past EoL?
- fransje26 3y agoYou mean going for safe companies, like Microsoft? That were infiltrated for ages with solarwind, "without any changes to their source code"?
- bongodongobob 3y agoYes, good example, a company they are likely already doing business with.