Re:Bug finding is slow in spite of many eyeballs
by iwwr on Monday February 23, 2015 @05:42AM
(#9093571)
>You have to trust the vendor's interest in making a profit. Nothing wrong with that :-)
Sometimes there are conflicts of interest. We have documented cases of 3-letter agencies paying companies to leave bugs or unsafe options in code. Sometimes the backdoors may be more valuable than the product itself.
I suspect many corporate clients found out these days that their SSL MITM software they used made their infrastructure vulnerable.
Re:Bug finding is slow in spite of many eyeballs
by ukigumo on Monday February 23, 2015 @06:29AM
(#9093722)
This is very true. However trusting that open source does not include such vulnerabilities is a leap of faith we cannot make which is why auditing and quality control process are needed.
Sometimes there are conflicts of interest. We have documented cases of 3-letter agencies paying companies to leave bugs or unsafe options in code. Sometimes the backdoors may be more valuable than the product itself.
I suspect many corporate clients found out these days that their SSL MITM software they used made their infrastructure vulnerable.