The Sound of Silence: Mining Security Vulnerabilities from Secret Integration Channels in Open-Source Projects · HackerPapers discussions

The Sound of Silence: Mining Security Vulnerabilities from Secret Integration Channels in Open-Source Projects — HN submission

Mon, 07 Sep 2020 03:06:56 GMT

Mining Security Vulnerabities from Secret Integration Channels

11 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

The Sound of Silence: Mining Security Vulnerabilities from Secret Integration Channels in Open-Source Projects — mentioned by vii

Sat, 05 Sep 2020 18:50:19 GMT

From the underlying paper there are several interesting snippets https://arxiv.org/pdf/2009.01694.pdf > while maintainers are aware of that they sometimes intentionally bypass the process, they were surprised of the magnitude of unreviewed patches Would love to see an analysis of these changes - are they just simple merge style fixes or rearrangements, or more significant? And then there is the hard to define distinction between a security bug and a normal bug, which is then mixed into the the incredible productivity and pace of kernel development: > Koah-Hartman argues that only a small…

Paper and discussion history. A mention is not an endorsement.

The Sound of Silence: Mining Security Vulnerabilities from Secret Integration Channels in Open-Source Projects — HN submission

Fri, 04 Sep 2020 15:40:05 GMT

The Sound of Silence: Mining Security Vulns from Secret Integration Channels

2 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.