this post was submitted on 26 May 2024
657 points (98.5% liked)

Technology

59534 readers
3143 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] sorghum@sh.itjust.works 21 points 5 months ago (2 children)

I look at 'source available' software as the right to review the code yourself to ensure there's no malicious behavior, not for community development.

[–] solrize@lemmy.world 5 points 5 months ago

You mean if you build it yourself? I guess that is something, but it is still conceivable to sneak stuff in. Look at that xzlib backdoor from a few weeks ago.

[–] xavier666@lemm.ee 1 points 5 months ago

Is there any way to verify that the product in deployment is built from the same source? I'm guessing hash values but I still think it can be faked.