4 ms·

Which people?

by nonrandomstring 2y ago

Which people?

thfuran 2y ago
Customers, though they usually aren't finding security vulnerabilities.
- nonrandomstring 2y ago
  > Customers Ah I see what you mean. Problem of language then. "Finding bugs", to me as a coder, means something different from observing the effects of bugs. Sure, I can see incorrect behaviours in lots of proprietary software. And I can guess what might cause it. But without the source code that's not the same as "finding bugs".
  - xyzzy_plugh 2y ago
    "finding a bug" in source code implies there's a mistake there. A bug can be that the implementation doesn't match the spec, or that the spec changed, with respect to the user (customer). Reporting bugs vs finding them is perhaps what you're looking for, but I'd argue finding is overloaded. It's perfectly valid to kick the tires on some software and find some bugs. I've found thousands of bugs in closed source software before, and subsequently reported those bugs.
    - nonrandomstring 2y ago
      > "finding a bug" in source code implies there's a mistake there. This is a good point of course. Implementation, protocol and runtime bugs are indeed invisible from the source POV. As are lower level Ken Thompson "trusting trust" [0,1] bugs in your tool chain. Most of all though, many "bugs" are just malicious functions the coders meant to put in there. [0] https://cybershow.uk/episodes.php?id=2 https://cybershow.uk/episodes.php?id=2 [1] www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf
- prmoustache 2y ago
  In this very blogpost, we are very much in a situation where users (github + the author) found the bug. They however didn't find the cause of the bug. And in many software, open source or proprietary, there are a lot of bugs sitting out in issues tracker for days, weeks, months or even years.
hobs 2y ago
https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/ immediately comes to mind (though its not a good example of an anyone set of people)
myself248 2y ago
Three letter agencies, and blackhats, who have the code even though it's not "open". They then use those vulnerabilities without disclosing them or fixing them, for as long as they're able.
- nonrandomstring 2y ago
  Amen to that. Damn right proprietary code is a double danger in that regard. Officially illegal to inspect, except to a few criminals. Isn't the entirety of Microsoft's Windows code now "out there"? It has been for years, right?

Which people?

thfuran 2y ago

Customers, though they usually aren't finding security vulnerabilities.

nonrandomstring 2y ago
> Customers Ah I see what you mean. Problem of language then. "Finding bugs", to me as a coder, means something different from observing the effects of bugs. Sure, I can see incorrect behaviours in lots of proprietary software. And I can guess what might cause it. But without the source code that's not the same as "finding bugs".
- xyzzy_plugh 2y ago
  "finding a bug" in source code implies there's a mistake there. A bug can be that the implementation doesn't match the spec, or that the spec changed, with respect to the user (customer). Reporting bugs vs finding them is perhaps what you're looking for, but I'd argue finding is overloaded. It's perfectly valid to kick the tires on some software and find some bugs. I've found thousands of bugs in closed source software before, and subsequently reported those bugs.
  - nonrandomstring 2y ago
    > "finding a bug" in source code implies there's a mistake there. This is a good point of course. Implementation, protocol and runtime bugs are indeed invisible from the source POV. As are lower level Ken Thompson "trusting trust" [0,1] bugs in your tool chain. Most of all though, many "bugs" are just malicious functions the coders meant to put in there. [0] https://cybershow.uk/episodes.php?id=2 https://cybershow.uk/episodes.php?id=2 [1] www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf
prmoustache 2y ago
In this very blogpost, we are very much in a situation where users (github + the author) found the bug. They however didn't find the cause of the bug. And in many software, open source or proprietary, there are a lot of bugs sitting out in issues tracker for days, weeks, months or even years.

hobs 2y ago

https://googleprojectzero.blogspot.com/ https://googleprojectzero.blogspot.com/ immediately comes to mind (though its not a good example of an anyone set of people)

myself248 2y ago

Three letter agencies, and blackhats, who have the code even though it's not "open". They then use those vulnerabilities without disclosing them or fixing them, for as long as they're able.

nonrandomstring 2y ago
Amen to that. Damn right proprietary code is a double danger in that regard. Officially illegal to inspect, except to a few criminals. Isn't the entirety of Microsoft's Windows code now "out there"? It has been for years, right?