Linked by Thom Holwerda on Tue 22nd Jan 2013 21:28 UTC, submitted by lemur2
Permalink for comment 550286
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
Features
Linked by Thom Holwerda on 05/21/13 21:38 UTC
Linked by Thom Holwerda on 05/20/13 11:29 UTC
Linked by Thom Holwerda on 05/18/13 21:33 UTC
Linked by David Adams on 05/16/13 4:23 UTC
Linked by Thom Holwerda on 05/11/13 21:41 UTC
Linked by Thom Holwerda on 05/08/13 14:22 UTC
Linked by Thom Holwerda on 05/02/13 15:28 UTC
Linked by Thom Holwerda on 04/29/13 21:06 UTC
Linked by Thom Holwerda on 04/24/13 22:24 UTC
Linked by Thom Holwerda on 04/18/13 11:21 UTC
More Features »
Sponsored Links



Member since:
2007-02-17
Actually, it doesn't apply to Linux. Linux distributions do solve this issue. It is entirely possible to run a fully functional Linux desktop system wherein every single package that you use on the system is covered by the Linux package management software.
You see, when developers collaborate to develop open source code, they vet each other. They pour over one another's code constantly. It is effectively impossible for one of them to slip in malicious code because the other developers will simply reject it.
Here is the development team for VLC:
http://www.videolan.org/videolan/team/
The development team is made up of developers from all over the world. You can rest assured that their collaborative output is free of malware.
Now large and popular Linux distributions such as Ubuntu have an extensive and public, transparent, auditable system of compiling such code, placing it in repositories, and allowing it to be securely downloaded (yes, it is signed code) and installed on end users systems. These signed-code package management systems for the major distributions have been in use for decades, for tens of thousands of packages, for millions of users making hundreds to thousands of downloads each, with never a failure.
Here is the comparable situation for Windows, which lacks effective system-wide package management:
http://www.osnews.com/story/24934/VLC_Suffers_from_Companies_Spread...
Malware can get in to a Windows system via a trojan horse package, even though there is no malware at all in the original source code of VLC made by the FOSS development team.
Furthermore, once VLC is in the repositories of a major Linux distribution with signed package management ... if the VLC project discover (or is made aware of) a security vulnerability, the VLC team will fix the source code with a security update. The Linux distributions will recompile VLC from the fixed source code, and place the updated binary in their security updates repository. Linux systems worldwide will run scheduled updates of their package management software (say every two days), and automatically detect that a security update for VLC is available, and notify the users of the system.
Since VLC is not Microsoft software, there is no equivalent process for VLC on Windows. Windows update won't cover security updates for VLC for Windows.
Edited 2013-01-24 08:13 UTC