4 ms·

The article suggests security because "all of the Tails code is open source, so it can be inspected by anyone worried about foul play." Yeah, that worked out w

The article suggests security because "all of the Tails code is open source, so it can be inspected by anyone worried about foul play." Yeah, that worked out well for openssl.

aw3c2 13y ago
Yes it did. The heartbleed bug was found during an audit of the open source of openssl.
- epo 13y ago
  The audit occurred because testing revealed the presence of a problem. Shutting the stable door after the horse has bolted is no vindication of open source.
  - infinity0 13y ago
    How would you have found the bug without it being open source? You think companies pay for these open public audits on proprietary software?
    - sp332 13y ago
      The vulnerability was first found by a fuzzer, which would have worked equally well on closed-source software. And I believe the fuzz tester (part of Codenomicon's "Defensics") is also closed-source.
      - infinity0 13y ago
        You misunderstand - how would the public have found out about the results of that audit? There is no incentive to release this information for a closed product; very much the opposite.
  - 0xdeadbeefbabe 13y ago
    This point is important. Testing came first and then auditing. In other words, black box testing and then white box testing. Why pretend you are better off just because you have millions of lines of inscrutable source?
- UweSchmidt 13y ago
  Found late, and found in a an error-prone environment. This weakens the oft-implied "proof by open-sourceness", and has brought up some criticism on how open source projects are ran and incentivized. Doesn't mean "Open Source sux", just some nuanced criticism, ok?
  - pmr_ 13y ago
    I assume that no one in its right mind would refute a nuanced criticism of Open Source, but the grandparent just didn't think it necessary to be nuanced or elaborate or make some concrete point at all. He just went for the quick pun and is being down-voted for it.
    - UweSchmidt 13y ago
      agreed
- solarc 13y ago
  Now try to do that trick on proprietary software.

The article suggests security because "all of the Tails code is open source, so it can be inspected by anyone worried about foul play." Yeah, that worked out well for openssl.

aw3c2 13y ago

Yes it did. The heartbleed bug was found during an audit of the open source of openssl.

epo 13y ago
The audit occurred because testing revealed the presence of a problem. Shutting the stable door after the horse has bolted is no vindication of open source.
- infinity0 13y ago
  How would you have found the bug without it being open source? You think companies pay for these open public audits on proprietary software?
  - sp332 13y ago
    The vulnerability was first found by a fuzzer, which would have worked equally well on closed-source software. And I believe the fuzz tester (part of Codenomicon's "Defensics") is also closed-source.
    - infinity0 13y ago
      You misunderstand - how would the public have found out about the results of that audit? There is no incentive to release this information for a closed product; very much the opposite.
- 0xdeadbeefbabe 13y ago
  This point is important. Testing came first and then auditing. In other words, black box testing and then white box testing. Why pretend you are better off just because you have millions of lines of inscrutable source?
UweSchmidt 13y ago
Found late, and found in a an error-prone environment. This weakens the oft-implied "proof by open-sourceness", and has brought up some criticism on how open source projects are ran and incentivized. Doesn't mean "Open Source sux", just some nuanced criticism, ok?
- pmr_ 13y ago
  I assume that no one in its right mind would refute a nuanced criticism of Open Source, but the grandparent just didn't think it necessary to be nuanced or elaborate or make some concrete point at all. He just went for the quick pun and is being down-voted for it.
  - UweSchmidt 13y ago
    agreed
solarc 13y ago
Now try to do that trick on proprietary software.