this post was submitted on 29 Mar 2024
665 points (99.0% liked)
Technology
59438 readers
2955 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
And that's why you cannot trust open source software blindly.
And yet with closed-source software you have no choice but to trust it blindly. At least open source software has people looking at the code.
You are an idiot. It's not blind. That's how it was found.
Not having world accessible SSH is the real fix here.
Yeah I nearly panicked for a second there, then I remember noone's getting near that anyway. Back to my relaxing weekend.
From the article...
The fact that it was discovered early due to bad actor sloppiness does not imply that it could not have also been caught prior to wide spread usage via security audits that take place for many enterprise grade Linux distributions.
I think it does though. They call it sloppy, I call it sophisticated. Same reason they major distro is running checking shit out right now.
Opensource = fast detection
Opensource + sloppiness = faster detection
Closedsource = never detected
Closedsource + sloppiness = maybe detected
You can put the pom-poms/rifle down, I'm not attacking open source, not in the slightest. I'm a big believer open source.
But I also know that volunteer work is not always as rigorous as when paid for work is being done.
The only point I'm trying to make in this conversation is getting confirmation if security audits are actually done, or if everyone just thinks they're done because of "Open Source" reasons.
As opposed to what? If you said "thats why you cannot trust any software blindly" it would have been not that wrong.
Imagine trying to make a helpdesk of a proprietary company take your "it's taking 0.5 seconds longer to login" complaint seriously...
So many vulnerabilities were found due to time to login that one of the security features was to take longer to respond to a bad login so they couldn't tell what part failed. Here's an article I found about one such vulnerability.
This is one hell of a take.
Certainly one of the takes of all time.
s/open source software/anything/
Reflections on Trusting Trust
- paper by Ken Tompson, 1984(not that one)
You can trust blindly whatever software you like. Most of us, even those that can code, trust blindly whatever software we use because we have other priorities. But what you can do only with open source software, is open your eyes if you choose.
Ftfy: And that's why you cannot trust people blindly.
Just because we cant observe the code of proprietary software and is sold legally doesn’t mean its all safe. Genuinely I distrust anything with a profit incentive.
What an oblivious attitude
Yep, you're not wrong.