0

Any intentional malware injected into open source software by the same people who are developing them may eventually get known as the source code is open to the public. However, if the code base is large, average people dont have the time and resources to go through it and hence it is possible for such malware to remain undetected for a long time. Hence it is important to develop independent agencies to regularly scrutinize changes to the software. Do such agencies exist and are they reliable?

2

There is no simple or single answer to the question.

Do individual projects get reviewed by independent agencies? Yes. Here is an instance of Mozilla hiring such an agency.

Are those agencies reliable? That's an impossible question to answer since the question has no scope.

However, there are numerous independent researchers who comb through code hoping to find errors and mistakes so that they can get recognition. It's that cloud of independent testers that really helps to shine a light on open source code.

Remember that reviewers do not need to review the entire codebase regularly. All they need to do is to review the patches as they come out, for that is the code that changes.

  • 1
    It might not always be a question of reliability. The time constraints play a major role as well. Pentesting isn't cheap and Mozilla isn't in the best financial situation, so it's very well possible that pentesters got less time than they'd like when assessing such a major software. – MechMK1 Apr 6 '20 at 8:30
  • @MechMK1 agreed. – schroeder Apr 6 '20 at 8:36
  • Who are these independent researchers? Can you give some link? – user15740 Apr 6 '20 at 10:01
  • @user15740 I mean, the world. Anyone who understands code and can review does it. Kids, students, professionals in their free time, small security companies that want to make a name for themselves. – schroeder Apr 6 '20 at 10:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.