3 ms·
No, I don't like this article, either. However, buried in it is a worthwhile idea, I think. In particular, he notes that publishing source code makes vulnerabi
by ggchappell 17y ago
No, I don't like this article, either. However, buried in it is a worthwhile idea, I think.
In particular, he notes that publishing source code makes vulnerabilities easier to find. True, obviously. I would note that it also makes them easier to fix. Now, we could get into a fight over whether "find" or "fix" is more important. But instead, let's observe that making software open-source, significantly changes the security dynamic.
Thus, we can ask, "What does it take to make closed-source software secure?" and "What does it take to make open-source software secure?" Whatever the answers may be, it is likely that they are different answers.
- xtho 17y agoI'd say the answer to both questions is code review. The difference is in how you get people to actually dig through the code and comment on it.