5 ms·
it's also still standard practice in most companies to either read the source code of open-source stuff before deploying it to production Eh, no.
by rockdoe 12y ago
it's also still standard practice in most companies to either read the source code of open-source stuff before deploying it to production
Eh, no.
- empressplay 12y agoI'd love a specific example? Because in many countries if they're publicly-traded or subject to other regulations (such as Basel, etc.) any company that didn't would be breaking the law.
- antientropic 12y agoI'd love a specific counter-example. I've never in my life encountered a sysadmin who read all or even part of the source code of any major package before deploying it. I mean, do you read the source code of the Linux kernel, PostgreSQL, nginx, OpenSSL, ... before installing it? If Basel requires that level of auditing, I'd love to see a cite. There are some pretty heavy-handed regulations out there, but this would be clearly unworkable.
- Nursie 12y agoI've worked in the USA, UK and Australia. I've never seen what you describe. And one of the companies is a huge multinational.
- rockdoe 12y agoGiven the context, it's probably a bad idea to name employers, but I've literally never seen this happen at any company I worked for, and I did consulting, so that's quite a few. I wonder what laws you're referring to that requires companies to have read the innards of products they deploy. Even the "getting a support contract from someone who does". Do you think for example Red Hat has read every single line of code shipped in RHEL?
- pjc50 12y agoWhich laws are you referring to? Is this a strange interpretation of Sarbanes-Oxley or HIPAA?
- raesene4 12y agoI'd be interested to hear if you have an example of a company that did read the source code of apps. used? Also which law do you think they would be breaking by not reading the source code of products used?
- deleted 12y ago[deleted]