this post was submitted on 19 Nov 2023
703 points (90.6% liked)
linuxmemes
20762 readers
2175 users here now
I use Arch btw
Sister communities:
- LemmyMemes: Memes
- LemmyShitpost: Anything and everything goes.
- RISA: Star Trek memes and shitposts
Community rules
- Follow the site-wide rules and code of conduct
- Be civil
- Post Linux-related content
- No recent reposts
Please report posts and comments that break these rules!
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The difference is the timing.
Exploit found in closed source software:
Probably years of usage by intelligence agencies and criminals until someone notices. (with no possible way to know for anyone that there even is a exploit). And even then it might take months for them to fix it.
Exploit found in oss: Depending on the usage of the software several people are looking for security holes and they usually get fixed ASAP. Of course it is possible that there's an exploit nobody finds and a criminal uses, but it is not more likely because he can read the code. If your code must be secret to be secure your code is anything but secure
Yes, because "security through obscurity is not security".
Also there is no incentive for companies to fix an exploit quickly. They will only release the fix with some scheduled update anyway or else people might notice that there was something worth fixing and that's bad for your stock price.