2 ms·

The folly of closed source strikes again

• jqpabc123 2y ago
  The folly of Open Source strikes again --- with a highly biased, opportunistic and uninspired comparison of Crowdstrike and the XZ incident. "Because all that code was open-source and could be audited, somebody caught it in time, before it could escape on to the net and do real damage." - "Because all that code was open-source" is what created the opportunity to inject the back door in the first place. - Lack of due diligence in the Open Source distribution chain is what allowed a bad actor to gain commit rights. - Sheer luck and a careful eye; not source code availability, is what allowed a "closed source" software engineer to uncover the XZ backdoor before it could do real damage. - In both cases, the people involved failed to conduct due diligence on the product they were delivering. And no "distribution model" is immune from these shortcomings. - The suggestion that an Open Source distribution model offers some such immunity is denied by the facts in the XZ case and is pure folly.
  • Bluestein 2y ago
    > no "distribution model" is immune from these shortcomings. No. It indeed is not.-