4 ms·

I've seen security problems sit in open-source code for years because no one was interested enough in going through it. If you are talking emacs, or the kernel

I've seen security problems sit in open-source code for years because no one was interested enough in going through it. If you are talking emacs, or the kernel, or gcc, there is probably enough interest there (and strong personalities in charge of the projects) to keep things safe. I don't know where the cutoff is. At thousands of users you probably can't count on someone else having looked through it. At millions you can.

mpyne 13y ago
That's certainty true. I can tell you as an OSS dev that that are simply not enough eyeballs for all bugs to be shallow. However you don't have even the possibility with closed-source products. That means you must instead rely on the process used to create the software. So something by MS might actually be pretty trustworthy from a "security issues not accidentally introduced" standpoint at this point after years of improvement on secure coding practices. But they still operate by a profit motive, and there's still the possibility of deliberate introduction of security issues when it suits business purposes or for legal compliance. Unfortunately there's no great way to tell that an OSS project from RANDOM_DEV is well-coded without looking at the code and it may be that a well-intentioned but junior dev introduces a relative swath of security bugs by accident. I don't know where the cutoff is either. It may depend more on your threat model than anything else.