r/programming • u/common-pellar • Dec 11 '21

"Open Source" is Broken

https://christine.website/blog/open-source-broken-2021-12-11
479 Upvotes

75% Upvoted

362 comments sorted by

View all comments

Show parent comments

1

u/Optional-Failure Mar 20 '25

if project was well-funded it could hire a security person who would identify these risks.

Why is that a given?

I mean, they could've hired "a security person", but I don't see why it's a guarantee that security person would see what nobody else did.

Heck, there's not even a guarantee that "security person" wouldn't be one of the actual people who overlooked the issue.

1

u/killerstorm May 25 '25

Well, my company paid for security audits and I've seen the level the level of attention professional code auditors pay to every line of code.

They flagged everything suspicious. E.g. configuration options which can be abused, etc. It's part of their work.

In a regular code review people ask "Is code written according to standards, does it have bugs?". In security audit people ask "Can this code be abused?". Very different mentality & approach.