3 ms·

> As far as I know, it's also still standard practice in > most companies to either read the source code of open- > source stuff before deploying it to

> As far as I know, it's also still standard practice in > most companies to either read the source code of open- > source stuff before deploying it to production (binary > or build) or get a support contract from someone else > who has I'm afraid I have no better, more cogent response for this than 'lol'.

empressplay 12y ago
This is an interesting read: http://www.bearingpoint.com/en-no/download/Open_Source_Governance_In_Highly_Regulated_Companies.pdf http://www.bearingpoint.com/en-no/download/Open_Source_Gover...
- ckozlowski 12y ago
  Thanks for the share. =) I'll queue this to read later, but just reading the executive statement, it seems to jive with a lot of the discussion here. The issue isn't that code review /shouldn't/ be taking place, or even that there aren't directives stating that it should be done. It's that it isn't being done, and that's a problem.
empressplay 12y ago
At the risk of my karma I'll have to maintain that for companies who are subject to regulation (publicly-traded companies, banks, etc.) what I said is still standard. Unless you have any specific instances to the contrary you're willing to offer?
- ckozlowski 12y ago
  Coming from my background (DoD, don't laugh.), code review of anything other than in-house developed applications never occurs. In any instance open source is used, it is mandated that it come with a support contract (per DISA STIG) which provides the support and accountability the organization is looking for. So, with regards to your assertion, the second clause (support contract)? Definitely. the first (code review), never. That's the view from my side of the fence, anyways.
- peteretep 12y ago
  > for companies who are subject to regulation (publicly- > traded companies, banks, etc.) Well for starters, that's not most companies, or even that many companies as a percentage of the whole. The only place I've ever seen (or even heard of this) being done is banks and defense. It ain't in ISO27001, and so nobody cares.
  - ckozlowski 12y ago
    In defense, it's too expensive to do in house. However, security software and some operating systems, either closed source or open, are evaluated under Common Criteria (https://www.commoncriteriaportal.org/ https://www.commoncriteriaportal.org/) But the evaluation process is rather long and often lags behind the current version by a year or more in some cases.
- Nursie 12y ago
  I've never worked in a place that insisted on source code being read for FOSS components. I've worked in places where there's a restricted list of 'approved' open source stuff, but that's been more to do with licensing.

empressplay 12y ago

This is an interesting read: http://www.bearingpoint.com/en-no/download/Open_Source_Governance_In_Highly_Regulated_Companies.pdf http://www.bearingpoint.com/en-no/download/Open_Source_Gover...

ckozlowski 12y ago
Thanks for the share. =) I'll queue this to read later, but just reading the executive statement, it seems to jive with a lot of the discussion here. The issue isn't that code review /shouldn't/ be taking place, or even that there aren't directives stating that it should be done. It's that it isn't being done, and that's a problem.

empressplay 12y ago

At the risk of my karma I'll have to maintain that for companies who are subject to regulation (publicly-traded companies, banks, etc.) what I said is still standard. Unless you have any specific instances to the contrary you're willing to offer?

ckozlowski 12y ago
Coming from my background (DoD, don't laugh.), code review of anything other than in-house developed applications never occurs. In any instance open source is used, it is mandated that it come with a support contract (per DISA STIG) which provides the support and accountability the organization is looking for. So, with regards to your assertion, the second clause (support contract)? Definitely. the first (code review), never. That's the view from my side of the fence, anyways.
peteretep 12y ago
> for companies who are subject to regulation (publicly- > traded companies, banks, etc.) Well for starters, that's not most companies, or even that many companies as a percentage of the whole. The only place I've ever seen (or even heard of this) being done is banks and defense. It ain't in ISO27001, and so nobody cares.
- ckozlowski 12y ago
  In defense, it's too expensive to do in house. However, security software and some operating systems, either closed source or open, are evaluated under Common Criteria (https://www.commoncriteriaportal.org/ https://www.commoncriteriaportal.org/) But the evaluation process is rather long and often lags behind the current version by a year or more in some cases.
Nursie 12y ago
I've never worked in a place that insisted on source code being read for FOSS components. I've worked in places where there's a restricted list of 'approved' open source stuff, but that's been more to do with licensing.