0
votes
1answer
36 views

Legality of adding malice to an open source software? [closed]

With the heartbleed bug in the news recently and after reading Bruce Schneier's commentary on the issue I started wondering if there would be any legal implications for intentionally adding malice to ...
6
votes
3answers
301 views

I work on an open source project. Is there a “standard” to reporting security vulnerabilities that we can use?

I work on an (intentionally undisclosed) open source project. To the best of my knowledge, we do not have a discoverable policy on reporting security vulnerabilities. Rails has their own policy ...
4
votes
2answers
285 views

Drupal Disputed CVE Five Year Tempest – Open Source Security Shortfall?

Can someone add context to the subject issue? At first glance it appears to me this issue represents a fundamental shortfall in the forces encouraging secure coding in open source development. Is ...