243
Lemmy 0.18.2 Security Release (join-lemmy.org)
submitted 3 years ago by [M] to c/announcements@lemmy.ml
22 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] [S] 70 points 3 years ago (1 child)

All the code is open source, everyone is welcome to look through it for potential problems and report/fix them. we dont have any money to pay for a professional audit. Maybe there are some organizations which would do audits of open source projects for free, might be worth searching for.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 25 points 3 years ago (2 children)

    We use sonarqube for code analysis that is pretty nice and has a community edition. It isn't a bullet proof solution, but it is pretty convenient for maintainers and reviewers of PRs. The only thing missing from the enterprise edition are useless flashy dashboards to show to people who don't understand computers

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 10 points 3 years ago (3 children)

    I do have a Sonarqube server somewhere around. Is it considered an annoying behavior to scan an open source project and open issues for others to fix?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] [S] 23 points 3 years ago (1 child)

    That depends, it would be annoying if you open lots of issues for minor, unimportant issues. But if you find a few major problems its good to report them. Of course its always ideal if you submit fixes as well, because there are never enough devs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •