4 ms·
Isn't that then an argument against using free software? If the best way to have secure software without being a security expert is to use proprietary software,
by jiggy2011 12y ago
Isn't that then an argument against using free software? If the best way to have secure software without being a security expert is to use proprietary software, then that is what we should encourage. FOSS advocates make the opposite argument that FOSS is more secure because there are more eyes on the code.
- XorNot 12y agoProprietary software gets compromised all the time. In serious ways. A simple example is the sheer number of bank websites which get taken down, and then we all yell at the guy who discovered it to absolutely not disclose it for fear of prosecution. The point is, when FOSS software has a bug, there's no small set of developers who are responsible. It's, in some small way, collectively all our faults. Like in the case of Bash - apparently for 20 years, we never actually checked if environment variables were executable.
- jiggy2011 12y agoMost people are incapable of taking any responsibility for issues in bash or openssl, in fact people who rely on them might not even know they exist , let alone be able to fix them. If you buy something from Microsoft you are paying them to take care of everything from the kernel upwards so that you don't need to worry about the details.
- gggmaster 12y agoYou can pay someone to improve open source tools, too.
- jiggy2011 12y agoThere are hundreds, maybe thousands of programs that make up a full open source system and frequently they are maintained by different groups of people with very different situations as regards to motivations and funding. There's no reasonable way that anyone outside of a few big tech companies can possibly review all of these and ensure that funding is distributed appropriately.
- lukeschlather 12y agoWe are talking about bash here. There is no mystery about who to donate to. GNU has a pretty good approach to the problem you describe.
- jiggy2011 12y agoIt was bash this time, who knows what it will be next time?
- XorNot 12y agoBut relatively few of them are internet/user-facing in any given deployment. You only need to secure/audit the attack surface, not the whole stack.
- jiggy2011 12y agoUntil a few days ago , I would not have called bash "internet facing".
- zak_mc_kracken 12y ago> Proprietary software gets compromised all the time. All software gets compromised, all the time. Compromise rate has a lot more to do with the number of users than whether that software is open or proprietary.
- hobs 12y agoI think its more an argument for supporting software, free or proprietary and making sure it is good via transparency and continuous improvement. I do agree that code should be able to be critiqued, but criticism is generally taken poorly by an individual when your critique is hyperbolic. Anyone who has the ability to critique it should have spent the time it took to write an outraged blogpost and try to contribute back to the project, it would both make you feel better and look better.
- jiggy2011 12y agoThe time commitment for open source contribution and for writing blogposts isn't even in the same ballpark.
- hobs 12y agoCompletely fair response. You are absolutely right that contributing (even in a minor way) to OSS is difficult. However, compared to a few "me too!" comments on your blog, and a few minutes of feeling superior to someone who actually did something, the feeling of actually contributing something real to a project (even of small value) is incomparable.