Hacker News new | ask | show | jobs
by 1970-01-01 246 days ago
>Can we trust open source software? Yes — and I would argue that we can only trust open source software.

But should we trust it? No!! That's why we're here!

I'm not satisfied with the author's double-standard-conclusion. Trust, but verify does not have some kind of hall pass for OSS "because open-source is clearly better."

Trust, but verify is independent of the license the coders choose.
1 comments
rcxdude 246 days ago
Yes, I would say that being able to view the source code and build it yourself is a necessary but not sufficient condition of properly trusting the software. (which is not quite the same thing as it being open source, but it's relatively rare outside of being a very big customer that you can do this for non-open-source code).
link
1970-01-01 245 days ago
What does it matter if you are able to build it all by yourself if you still don't catch the compromised code? That's what is happening here in reality. OSS is now a layer of safety that is being leveraged into a layer of compromise. Caveat emptor!
link
normie3000 245 days ago
> I would say that being able to view the source code and build it yourself is a necessary but not sufficient condition of properly trusting the software.

And certainly a condition of the "verify" step?

With closed-source software, you can (almost) _only_ trust.

link
1718627440 246 days ago
When you get the source code as a big costumer, that is open source. It might even be free software.
link
johnny22 246 days ago
many folks make a distinction between source available and open source.
link
1718627440 246 days ago
The latter meaning: accepts patches, or what?
link
NekkoDroid 246 days ago
"Open Source" meaning the license is OSI approved (or at least meets the definition for "Open Source" by the OSI[1]) and source available is anything to which you can get the source to, but the license doesn't meet the above criteria.

[1]: https://opensource.org/osd

link
rcxdude 245 days ago
Accepting patches isn't a requirement, but it roughly means that you can make your own changes, publish those changes, and use the software for whatever you want. These don't automatically come with being allowed to view the source code.
link
lmm 246 days ago
The latter meaning the four freedoms or something equivalent (e.g. complying with the OSD and/or the the DFSG). They don't have to accept patches upstream but they do have to permit sharing your patches with other users one way or another.
link