3 ms·
At the risk of my karma I'll have to maintain that for companies who are subject to regulation (publicly-traded companies, banks, etc.) what I said is still sta
by empressplay 12y ago
At the risk of my karma I'll have to maintain that for companies who are subject to regulation (publicly-traded companies, banks, etc.) what I said is still standard. Unless you have any specific instances to the contrary you're willing to offer?
- ckozlowski 12y agoComing from my background (DoD, don't laugh.), code review of anything other than in-house developed applications never occurs. In any instance open source is used, it is mandated that it come with a support contract (per DISA STIG) which provides the support and accountability the organization is looking for. So, with regards to your assertion, the second clause (support contract)? Definitely. the first (code review), never. That's the view from my side of the fence, anyways.
- peteretep 12y ago> for companies who are subject to regulation (publicly- > traded companies, banks, etc.) Well for starters, that's not most companies, or even that many companies as a percentage of the whole. The only place I've ever seen (or even heard of this) being done is banks and defense. It ain't in ISO27001, and so nobody cares.
- ckozlowski 12y agoIn defense, it's too expensive to do in house. However, security software and some operating systems, either closed source or open, are evaluated under Common Criteria (https://www.commoncriteriaportal.org/ https://www.commoncriteriaportal.org/) But the evaluation process is rather long and often lags behind the current version by a year or more in some cases.
- Nursie 12y agoI've never worked in a place that insisted on source code being read for FOSS components. I've worked in places where there's a restricted list of 'approved' open source stuff, but that's been more to do with licensing.