Mailing-List: contact java-dev-help@lucene.apache.org; run by ezmlm
Precedence: bulk
Reply-To: java-dev@lucene.apache.org
Received-SPF: neutral (herse.apache.org: local policy)
Date: Tue, 19 Dec 2006 12:03:09 -0800 (PST)
From: Chris Hostetter <hossman_lucene@fucit.org>
To: java-dev@lucene.apache.org
Subject: Re: access policy for Java Open Review Project
In-Reply-To: <231EE688-0077-4D9E-8D40-CE6E373536DE@apache.org>
Message-ID: <Pine.LNX.4.58.0612191158000.21925@hal.rescomp.berkeley.edu>
References: <C1ACB596.226B8%brian@fortifysoftware.com>
 <231EE688-0077-4D9E-8D40-CE6E373536DE@apache.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII


: application vulnerable or is really just a "ruckus" issue?  Part of
: me thinks that b/c the code is freely available, people could find
: the security issues anyway, so we aren't really protecting ourselves
: anyway by denying access.

Personally I agree ... if the source is free, all exposing vulnerabilities
to the public can do is give more people the power to submit patches.

Anyone truely nefarious can run FindBugs (or purchase copies of the
Fortify commercial analysis applications) on the source code directly and
get the same information.

Then again: my involvement with "high profile" open source projects is
relatively short lived ... there may very well be a lot of 'old timers'
with horror stories of past experiences that demonstrate why some aspects
of Open Source projects need to be less open then others to protect the
user base.


-Hoss


---------------------------------------------------------------------
To unsubscribe, e-mail: java-dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: java-dev-help@lucene.apache.org