Bullying in Open Source Software Is a Massive Security Vulnerability

𝗧𝗼𝗮𝘀𝘁𝗲𝗿 *𝑣𝑒𝑟𝑦 𝑝𝑢𝑠ℎ𝑒𝑑 𝑑𝑜𝑤𝑛@slrpnk.net to Technology@lemmy.world – 248 points –
Bullying in Open Source Software Is a Massive Security Vulnerability
404media.co
58

You are viewing a single comment

It's probably far more common than most people realize. Open source software doesn't automatically make it secure, and in many cases can be less secure than closed source as it's just one or two people doing it for free.

Much easier to be tempted to do something wrong or to get others to help in and take the weight off.

in many cases can be less secure than closed source as it's just one or two people doing it for free.

Absurd take. How could having the source closed possibly enhance the security?

I think they mean that a lot of proprietary software (supposedly) has a large (or at least well-founded) team working on it

Weird that they would say something totally different from what they mean...

I mean, they didn't though Theoretically, well-funded teams would be able to create more secure software and fix vulnerabilities faster than some random guy who works a full-time job and codes in his free time

You say they didn't, and then go on to make a point they didn't make...

They didn't comment on funding whatsoever. Plenty of open-source software gets funding, and not all closed source software gets funding.

The issue is with bullying and burnout. Nothing to do with being closed or open source.

I'm sorry that I'm apparently not getting my point across to you

Proprietary software is often made by a corporation, who pays full-time developers. Those full-time developers are given a salary to work on that software. That salary is normally more than what open-source devs make off their software. The team who is paid to work full-time on the software will patch issues faster (theoretically)

I bet you'll find something wrong with this, but I don't care

There's nothing wrong with what you're saying, I'm not challenging the point you're making here.

I'm challenging your ability to mind-read and ascribe that point to a different commenter.

Closed source software has the exact same bullying issue, the difference is instead of the bullies being random people on the internet, they are managers with power over you. They are at least as likely to make you do something dangerous as the randoms, but they don't have to try as hard to hide it.

It's not the same, but it can be.

Bullying in closed source software is a company culture issue. Bullying in open source software can come from anywhere, and a good CoC won't necessarily fix it because outside community members can just bully from different accounts. But that also means bad company culture can't be fixed as easily as playing whack-a-mole in a FOSS project.

I mean you can see the source code. You'll know if anyone does something weird if you have two braincells.

Edit: Clown here move along.

You're manually reviewing the entire code of every open source product you use? Manually reviewing the code at every commit of every open source software you use?

I can't tell if you're joking but if you are that's hilarious

Oh shit I must've said something really dumb now.

(I wasn't joking).

It's not a dumb point so much as just naive -- and its the lesson we learned from the xz backdoor.

Sure the source code is out there for anyone to see, but are the right people actually looking?

How do you qualify the security of a closed source code when you can't verify it?