Ars TechnicaOne-click remote code exploit in CD cue files affects most GNOME-based Linux distros
Yet another tiny, crucial piece of volunteer software begets a big problem.
Theneilcave@arstechnica I really dislike the implication that if this were closed source/developed by a company for profit it would be less susceptible
JoeP@Theneilcace @arstechnica
Re the "vast amounts of technological infrastructure underpinned by tiny, unpaid projects", I don't see any mention of closed source being better - which is good, because closed source is logically less secure. I think the point is that larger, well-funded projects - and it's quite possible for them to be free and open source - are less risky.
(ctd...)
...
The article doesn't make it clear, but I think this is true to the extent that there is a larger pool of people to fix, test, build, integrate and ship the package. Not that such code is magically safer to start to start with, because bugs exist everywhere.
@JoeP @arstechnica it was the phrasing “yet again” and “volunteer software”. I’m not saying it’s not technically true, but i think the wording has a connotation that is not presenting the position in the most fair way.
I’m not an open source fanatic. The phrasing just really tweaked me.
I’m not an open source fanatic. The phrasing just really tweaked me.
@Theneilcace @arstechnica True, "volunteer" is not really representative of most such developers.