• 0 Posts
  • 45 Comments
Joined 2 years ago
cake
Cake day: March 25th, 2022

help-circle











  • I wonder what sort of mitigations we can take to prevent such kind of attacks, wherein someone contributes to an open-source project to gain trust and to ultimately work towards making users of that software vulnerable. Besides analyzing with bigger scrutiny other people’s contributions (as the article mentioned), I don’t see what else one could do. There are many ways vulnerabilities can be introduced and a lot of them are hard to spot (especially in C with stuff like undefined behavior and lack of modern safety features) , so I don’t think “being more careful” is going to be enough.

    I imagine such attacks will become more common now, and that these kind of attacks could become very appealing for governments.






  • Faresh@lemmy.mltoProgramming@programming.devRedis is no longer OSS
    link
    fedilink
    English
    arrow-up
    27
    arrow-down
    1
    ·
    edit-2
    4 months ago

    Weirdly OSI doesn’t classify the SSPL as an open-source license because it doesn’t guarantee “the right to make use of the program for any field of endeavor”, calling it a fauxpen license. I don’t think the FSF has commented on the license, though I would be curious what they say about it.

    I imagine they consider it to not give the right to make use of the program for any field of endeavor, because providing the source of the entire stack needed to run the service you provide makes it impossible for users to host their service on stuff like AWS, since it is proprietary.