• CameronDev@programming.dev
    3·
    2 years ago

    To be fair, we only know of this one. There may well be other open source backdoors floating around with no detection. Was heartbleed really an accident?

    • lemmyreader@lemmy.mlOPEnglish
      3·
      2 years ago

      True. And the “given enough eyeballs, all bugs are shallow” is a neat sounding thing from the past when the amount of code lines was not as much as now. Sometimes it is scary to see how long a vulnerability in the Linux kernel had been there for years, “waiting” to be exploited.

      • RecluseRamble@lemmy.dbzer0.com
        2·
        2 years ago

        Still far better than a proprietary kernel made by a tech corp, carried hardly changed from release to release, even fewer people maintain, and if they do they might well be adding a backdoor themselves for their government agency friends.

  • Codex@lemmy.world
    3·
    2 years ago

    I’ve gotten back into tinkering on a little Rust game project, it has about a dozen dependencies on various math and gamedev libraries. When I go to build (just like with npm in my JavaScript projects) cargo needs to download and build just over 200 projects. 3 of them build and run “install scripts” which are just also rust programs. I know this because my anti-virus flagged each of them and I had to allow them through so my little roguelike would build.

    Like, what are we even suppose to tell “normal people” about security? “Yeah, don’t download files from people you don’t trust and never run executables from the web. How do I install this programming utility? Blindly run code from over 300 people and hope none of them wanted to sneak something malicious in there.”

    I don’t want to go back to the days of hand chisling every routine into bare silicon by hand, but i feel l like there must be a better system we just haven’t devised yet.

  • mariusafa@lemmy.sdf.org
    1·
    2 years ago

    I love free software community. This is one of the things free software was created. The community defends its users.

    • tired_n_bored@lemmy.world
      1·
      2 years ago

      I second this. I love to feel part of a community even tho I could have never found the backdoor, let alone fix it.