671
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 29 Mar 2024
671 points (99.0% liked)
Technology
60047 readers
1975 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
The answer is the same as closed source software: sometimes.
But that's beside the point, a security audit is not perfect. Plenty of audited codebases are the source of security vulnerabilities in the wild. We know based on analysis that the malicious actor's approach would have a high chance of successfully hiding from a typical security audit.
Oh I know security audits are not perfect, I'm just wondering if they actually get done, or everyone just assumes they get done because of "Open Source", but they don't.
There are security researchers looking for vulnerabilities constantly, but they're inconsistent and informal. Issues usually get caught eventually, but sometimes that's after a vulnerability in the wild.