5 ms·
I don't think that OpenSSL is a great example of OSS, there are several areas where they don't follow bad practices for no reason and you can just look at their
by istvan__ 11y ago
I don't think that OpenSSL is a great example of OSS, there are several areas where they don't follow bad practices for no reason and you can just look at their history of serious security flaws. Why would you want to integrate with that? In this case it is better and cleaner to implement the functionality in your code (in this case Go).
- 0xdeadbeefbabe 11y agoHaving a history of security flaws is better than having a future of security flaws.
- schmichael 11y agoArguably OpenSSL has both.
- istvan__ 11y agothere are the same amount of security bugs in almost any software, and the number shows some correlation with the lines of code count. Strictly from the code point of view you can follow best practices and actively training the stuff on security. This cost money and time and nobody really wants to do it. The companies started to do this invested serious amount of money into the project and it shows in the statistics. http://www.gfi.com/blog/most-vulnerable-operating-systems-and-applications-in-2014/ http://www.gfi.com/blog/most-vulnerable-operating-systems-an... In open source this is more of a community thing with little discipline, the nature of the software development is less tight, this yields to mediocre results. I guess the at Apple security is as far is from design as something can be, probably not a high priority. Knowing the historical flaws is only useful if invest into mining it and act on the results.
- baby 11y agoOSS?
- jsprogrammer 11y agohttp://en.wikipedia.org/wiki/Open-source_software http://en.wikipedia.org/wiki/Open-source_software