open source doesn't necessarily mean "anyone can edit it and improve it".
patches and added features need to be reviewed by project owners.
open source mostly mean "you can read the source and modify your version, but that doesn't mean you can make a change that will go into the official release."
There are some very sensitive implementations of software which should be thoroughly examined by experts and criticized if they're not good enough. If there is no resources available to maintain a particular open source software, don't bother use it, ESPECIALLY if it's sensitive like openssl.
Open source allows software companies and other programmers to easily work together to solve a problem. Developer's time is precious so it's often time-saving to use somebody's else work, but that doesn't mean you should use it blindly.
You are correct, of course. But what the Heartbleed showed us is that even at the scale of OpenSSL (millions of users), almost all were using it blindly. People often care more about the free in pricing aspect more than the freedom to inspect, modify and contribute - because as you say, dev time is precious.
open source doesn't necessarily mean "anyone can edit it and improve it".
I think you missed the point in the article - it was about how anyone can create or contribute to open-source. Not about submitting patches to existing projects and have them pulled upstream without any review process.
Proprietary code is subject to a market value, companies can actually invest in a codebase to improve it and add features, whereas open source is subject to common interests or volunteering. I agree that open source can increase quality thanks to the "community", but unless there is a community, nothing gets done. "there is no such thing as a free meal".
If you don't have the source code, it's actually a little harder to find a vulnerability since all you have is a big blob of binary assembly. Hackers can still find vulnerabilities with enough time on their hand, but it's still much discouraging.
I just think that invisible hand of the market is an equally virtual limit effect as the many eyes ensemble. The stream of closed-source vulnerabilities is also substantial and a time-to-fix is much larger there, what effectively pays for the additional effort required to identify a flaw.
No free lunch in security rather hides in the trade-off with convenience.
Comments
open source doesn't necessarily mean "anyone can edit it and improve it".
patches and added features need to be reviewed by project owners.
open source mostly mean "you can read the source and modify your version, but that doesn't mean you can make a change that will go into the official release."
There are some very sensitive implementations of software which should be thoroughly examined by experts and criticized if they're not good enough. If there is no resources available to maintain a particular open source software, don't bother use it, ESPECIALLY if it's sensitive like openssl.
Open source allows software companies and other programmers to easily work together to solve a problem. Developer's time is precious so it's often time-saving to use somebody's else work, but that doesn't mean you should use it blindly.
You are correct, of course. But what the Heartbleed showed us is that even at the scale of OpenSSL (millions of users), almost all were using it blindly. People often care more about the free in pricing aspect more than the freedom to inspect, modify and contribute - because as you say, dev time is precious.
I think you missed the point in the article - it was about how anyone can create or contribute to open-source. Not about submitting patches to existing projects and have them pulled upstream without any review process.
Many of them do use Microsoft Windows, but they are deliberately blinded by a few people who are centered at power.
You can look at the frequency of patches between proprietary and open source software, which shows a lot.
Note that while open source can be used blindly, closed source have to be used blindly.
Proprietary code is subject to a market value, companies can actually invest in a codebase to improve it and add features, whereas open source is subject to common interests or volunteering. I agree that open source can increase quality thanks to the "community", but unless there is a community, nothing gets done. "there is no such thing as a free meal".
If you don't have the source code, it's actually a little harder to find a vulnerability since all you have is a big blob of binary assembly. Hackers can still find vulnerabilities with enough time on their hand, but it's still much discouraging.
I just think that invisible hand of the market is an equally virtual limit effect as the many eyes ensemble. The stream of closed-source vulnerabilities is also substantial and a time-to-fix is much larger there, what effectively pays for the additional effort required to identify a flaw.
No free lunch in security rather hides in the trade-off with convenience.