Hacker News Reader

> it's not possible to review it all much less to catch subtle exploits that might have been introduced by security agencies - we can't even catch many unintentional exploits

Precisely. In the wake of Shellshock and Heartbleed the sneering tone of the passage you've cited should profoundly embarrass the author. It does not accord well with the facts.

View on HN

People tend to cite heartbleed as an example of how "open source" has no intrinsic security value. While I agree that something being "open source" does not automatically make it secure, I think that it does allow us to gauge the security of the project.

In the case of heartbleed, anyone who has ever spent more than 30 seconds looking at OpenSSL can tell you that it is not secure software and never will be. We can't identify and remedy every possible vulnerability, but we do have enough information to know that events like heartbleed will happen again and again.

People that claim open source has no security value seem to believe that just because you can't catch every vulnerability through public review, you may as well not bother at all. That logic is obviously faulty, I can't imagine they would apply the same rationale to cancer screening.

> People that claim open source has no security value

Nice strawman you got there.

Reply on news.ycombinator.com