this post was submitted on 07 Jul 2023
1679 points (92.9% liked)

Memes

45997 readers
1765 users here now

Rules:

  1. Be civil and nice.
  2. Try not to excessively repost, as a rule of thumb, wait at least 2 months to do it if you have to.

founded 5 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
1679
It's Open Source! (lemmy.dbzer0.com)
submitted 2 years ago* (last edited 2 years ago) by [email protected] to c/[email protected]
215 comments fedilink hide all child comments
 

Not discrediting Open Source Software, but nothing is 100% safe.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 45 points 2 years ago* (last edited 2 years ago) (1 children)

And to a large extent, there is automatic software that can audit things like dependencies. This software is also largely open source because hey, nobody's perfect. But this only works when your source is available.

[–] damnthefilibuster 6 points 2 years ago (1 children)

Except when people pull off shit like Heartbleed.

[–] [email protected] 11 points 2 years ago (1 children)

See my comment below for more of my thoughts on why I think heartbleed was an overwhelming success.

And you help make my point because openssl is a dependency which is easily discovered by software like dependabot and renovate. So when the next heartbleed happens, we can spread the fixes even more quickly.

[–] [email protected] 3 points 2 years ago

Enterprise software inventory can unfortunately be quite chaotic, and understanding the exposure to this kind of vulnerability can take weeks if not longer.