Hacker News Reader

> Open source code is much more likely to already have been audited better.

Worth keeping in mind this isn’t a silver bullet. OpenSSL with Heartbleed comes to mind.

Very true, but OpenSSL in particular is rather infamous. Unfortunate given that so much relies on it. https://news.ycombinator.com/item?id=7556407

This is why the assumption that “open source code is more likely to be closely audited for vulnerabilities” is not true (even for incredibly core/important projects with a wide scope) and is potentially dangerous to rely on.

> This is why the assumption that “open source code is more likely to be closely audited for vulnerabilities” is not true...

That is a safe assumption, otherwise you'd have to believe that non-open source code is more closely audited - at greater expense, because businesses secretly prioritize security.

It is not 100% and always. But practically. Especially unexpected leak.

Shellshock still outperforms any security issue of OpenSSL in terms of time in the wild.

Reply on news.ycombinator.com