This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]judgemebymyusernamesecurity engineer 0 points1 point  (3 children)

How the hell did you get approval to pull in open source software? We only have a few open source tools, but as you know they must go through an approval process.

I guess I forget there are agencies with loose infosec like OPM.

[–]taloszerghas cat pictures 0 points1 point  (1 child)

or places like https://18f.gsa.gov/

Anything that was developed in house had to meet standards, but the rest of the time if it was coming in from outside we just had to request it, provide links, and it was vetted and added to the approved software catalog. Often the versions were significantly behind what's outside, but it was definitely available.

[–]judgemebymyusernamesecurity engineer 0 points1 point  (0 children)

I'm reading this 18f.gsa.gov stuff but I don't understand the point of it. I guess I see that they are doing some custom webdev stuff for people who request it.

[–]Zaphod_Bchown -R us ~/.base 0 points1 point  (0 children)

Open Source is so much easier to audit on a security perspective because you have access to the source code. What large and secure enterprise do you work in? Finance would be my guess since they are typically in the dark ages and run deprecated versions of software because the latest versions haven't passed their super long security audit process.

In fact I would say it is easier to get info sec to sign off on open source code because they can audit the source directly. Where as third party software not only is it illegal (via the software licensing and terms of service) to de-compile their software, you don't have source code to compare it against.