Not discrediting Open Source Software, but nothing is 100% safe.

  • @Cypher
    link
    English
    2252 years ago

    Luckily there are people who do know, and we verify things for our own security and for the community as part of keeping Open Source projects healthy.

    • @danc4498
      link
      English
      1032 years ago

      Open source software is safe because somebody knows how to audit it.

      • andrew
        link
        fedilink
        English
        45
        edit-2
        2 years ago

        And to a large extent, there is automatic software that can audit things like dependencies. This software is also largely open source because hey, nobody’s perfect. But this only works when your source is available.

          • andrew
            link
            fedilink
            English
            112 years ago

            See my comment below for more of my thoughts on why I think heartbleed was an overwhelming success.

            And you help make my point because openssl is a dependency which is easily discovered by software like dependabot and renovate. So when the next heartbleed happens, we can spread the fixes even more quickly.

            • @[email protected]
              link
              fedilink
              English
              32 years ago

              Enterprise software inventory can unfortunately be quite chaotic, and understanding the exposure to this kind of vulnerability can take weeks if not longer.

      • @[email protected]
        link
        fedilink
        English
        202 years ago

        It’s safe because there’s always a loud nerd who will make sure everyone knows if it sucks. They will make it their life mission

        • @lemminer
          link
          English
          52 years ago

          Will that nerd be heard or be buried under the scrutiny?

          • @[email protected]
            link
            fedilink
            English
            52 years ago

            I’ll listen to them because I love OSS drama. But you’re right that they may just get passed over at large

      • @[email protected]
        link
        fedilink
        English
        192 years ago

        Also because those people who can audit it don’t have a financial incentive to hide any flaws they find

      • @kbotc
        link
        English
        122 years ago

        My very obvious rebuttal: Shellshock was introduced into bash in 1989, and found in 2014. It was incredibly trivial to exploit and if you had shell, you had root perms, which is insane.

        env x=‘() { :;}; echo vulnerable’ bash -c “echo this is a test”

    • @guy
      link
      English
      122 years ago

      Though one of the major issues is that people get comfortable with that idea and assume for every open source project there is some other good Samaritan auditing it

      • 𝕽𝖔𝖔𝖙𝖎𝖊𝖘𝖙
        link
        English
        112 years ago

        I would argue that even in that scenario it’s still better to have the source available than have it closed.

        If nobody has bothered to audit it then the number of people affected by any flaws will likely be minimal anyway. And you can be proactive and audit it yourself or hire someone to before using it in anything critical.

        If nobody can audit it that’s a whole different situation though. You pretty much have to assume it is compromised in that case because you have no way of knowing.

        • @guy
          link
          English
          42 years ago

          Oh definitely, I fully agree. It’s just a lot of people need to stop approaching open source with an immediate inherent level of trust that they wouldn’t normally give to closed source. It’s only really safer once you know it’s been audited.

    • @bill_1992
      link
      English
      52 years ago

      Have you seen the dependency trees of projects in npm? I really doubt most packages are audited on a regular basis.