1
vote
2answers
171 views

Fixing a security exploit - but then everyone knows about it

Earlier, I was messaged about a potential security risk in one of my projects. I checked it and found that it allows for "arbitrary code execution". (Quotes because it is running in a VM, but the ...
6
votes
6answers
603 views

What are the cases where keeping source code secret is justified?

When I worked as a freelancer, I encountered lots of cases where customers were protecting their ideas and source code of their projects (such as web applications) as much as possible, no matter how ...
2
votes
2answers
301 views

typical way to share database connection for open-source project, without revealing too much

I have an open source project for mydomain.com which requires connections to a database (...as is tradition). What is the standard practice for allowing others to work on the site, without giving them ...
3
votes
5answers
1k views

Security issue about making my code public in GitHub

I'm developing a big community/forum website and I'd like to upload my code to GitHub to have at least some sort of version control over it (because I have nothing other than a .rar file as a backup, ...
14
votes
4answers
443 views

Should internal code be shared with non-developers in an organisation?

Where I work, we have a lot of developers and an awful lot of code running our proprietary applications used by staff & customers alike. We also have a lot of smart support staff that like to ...
8
votes
4answers
363 views

How do you go about checking your open source libraries for keystroke loggers?

A random person on the internet told me that a technology was secure(1), safe to use and didn't contain keyloggers because it is open source. While I can trivially detect the key stroke logger in ...
4
votes
4answers
295 views

Small projects using the cathedral model: does open-source lower security?

We know of Linus' law: With enough eyeballs all bugs are shallow In general, people seem to say that open-source software is more secure because of that very thing, but... There are many small ...
5
votes
9answers
426 views

In what situations would it be technically 'impossible' to release a system as open source?

While there are certainly many economic, social and practical decisions to be made when deciding whether a system should be open source, are there any situations in which it is impossible, purely from ...
4
votes
4answers
260 views

Keeping a connection string secure when working with others

Say you've started an open source project and are posting it on a public repository. (like I have, using Codeplex.) One of the key files just makes the connection to the database, contains the ...
5
votes
4answers
146 views

How do I report software vulnerabilities found in an open source library that are widely used but have a dilapidated team structure?

For most open source project, there is a well-founded project team and corporate sponsorship, and a lot of active contributors. The procedure for filing bug reports are clearly documented. However, ...