Open source software packages cannot be blindly trusted to deliver on security

guest · Jun 25, 2019

Open source software packages cannot be blindly trusted to deliver on security
June 25, 2019
https://portswigger.net/daily-swig/velocity-does-not-have-to-come-at-the-cost-of-security

That’s according to the State of the Software Supply Chain report, released by Sonatype today, which revealed that while open source (OS) components can help improve the security of software, not all are created equally.
The report, which surveyed 36,000 OS project teams, was produced in collaboration with Gene Kim, IT Revolution, and Dr Stephen Magill, Galois, to objectively examine both the OS project teams and 3.7 million OS releases.

“It has long been believed that in the realm of open source development, ‘with more eyeballs, all bugs are shallow’,” Derek Weeks, vice president at Sontaype tells The Daily Swig.
“In other words, the more popular open source components were, the fewer bugs or vulnerabilities they might have.

“Some of the most popular components may take 200 days or more, on average, to release new updates or remediate known security vulnerabilities.”
Click to expand...

Log in or Sign up

Open source software packages cannot be blindly trusted to deliver on security

guest Guest

Log in or Sign up

Open source software packages cannot be blindly trusted to deliver on security

guest Guest

Useful Searches