Asklemmy

43733 readers

1389 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

Open-ended question
Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
Not ad nauseam inducing: please make sure it is a question that would be new to most members
An actual topic of discussion

Looking for support?

Looking for a community?

Lemmyverse: community search
sub.rehab: maps old subreddits to fediverse options, marks official as such
[email protected]: a community for finding communities

~Icon~ ~by~ ~@Double_[email protected]~

founded 5 years ago

MODERATORS

[email protected]

Did the recent Linux drama change your views on how you perceived Open Source projects? (lemmy.ml)

submitted 6 days ago by [email protected] to c/[email protected]

120 comments fedilink hide all child comments

I for one am going through quite a culture shock. I always assumed the nature of FOSS software made it immune to be confined within the policies of nations; I guess if one day the government of USA starts to think that its a security concers for china to use and contribute to core opensource software created by its citizens or based in their boundaries, they might strongarm FOSS communities and projects to make their software exclude them in someway or worse declare GPL software a threat to national security.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 7 points 5 days ago (2 children)

One of the big weaknesses of open source is the same as democracy. Nobody has time to review every piece of code (or research and hold accountable every politician) which leads to risks.

[–] [email protected] 4 points 5 days ago (1 children)

How is that weakness different to installing closed source software?

[–] [email protected] 1 points 3 days ago* (last edited 3 days ago) (1 children)

It's a different risk vector. While companies want your information to sell, they don't want to take over your computer to use it in a bot net or steal your bank information and clean out your account.

Open source by it's very nature relies on a lot of people having good intentions, free time, and knowledge for it to work well and safely.

[–] [email protected] 2 points 3 days ago

Actually - a lot of closed source programs are still vulnerable to the supply chain attacks you mention where a bad actor has got access to their codebase. This has happened and been reported on, plus I'm sure, plenty of occasions where it was hushed up for reputational reasons. And - much commercial software still uses FOSS dependencies, so is also vulnerable to the same situation you describe for that. Worst of both worlds.

I don't think either system is inherantly better than the other in terms of computer security. Each has different and overlapping vulnerabilities.

[–] [email protected] 1 points 4 days ago (1 children)

And it's why people stress to death that documenting is important. Even if you may not have time to review every single code, it wouldn't hurt to leave footnotes as to where someone could take said code to pick up from where it left off.

If you leave somebody with nothing then it's dead code.

[–] [email protected] 1 points 3 days ago

Absolutely that's always good. I was talking more about someone intentionally adding malicious code though.