Hacker News Reader

Comment by knallfrosch | Hacker News Reader

Imagine getting 10,000 pull requests and 7 originate from KGB hackers that solve a real problem but contain a vulnerability.

View on HN

Imagine contracting a company and their programmer is a KGB hacker and nobody is ever allowed to see the source code.

that's true, but, to be fair, it might be easier to order an anti-hacker CIA background check for a contracted company of 100+ employees, than for a 10,000 pseudo-anonymous github users.

Yeah, but how often do you perfom that check? In the end it is all about the code and whether it can be checked.

And I have to say my personal confidence in the quality of governmental code is higher if it is open source than if it wasn't — because I know some pretty paranoid people who would for sure check that could better than any contractor ever would.

Why bother when KGB hackers can already find a dozen of vulnerabilities just by looking sideways at a closed source project built by the most well-meaning team?

Wow, even using "Russians under the bed" to attack FOSS now.

even worse, we know for a fact all the shit the NSA did to our software, but muh spoopy russians instead

Valid risk [0], but that shouldn't keep the gov from making the code public. Open source / free software has its unique challenges, but it's a more fair model to people, and also it doesn't have challenges that arise from the code being "secret".

[0] example with the Linux kernel: https://www.theverge.com/2021/4/22/22398156/university-minne...

So I guess the solution is to not use open source, and force the KGB to have their agents hired as regular employees instead?

It's risk management. close 10,000 quick wins and hypothetically introduce 7?

many bug fixes open new bugs anyway due to poor architecture, this is what we should focus on

the prc is a greater threat than Russia anyway

Reply on news.ycombinator.com