Hacker News Reader

If a company is based in an "X eyes" nation", but the product is A) self-hosted and B) open source, does it matter that the organization the develops it is based in an "X eyes" nation?

View on HN

The risk is much lesser, but there's the possibility of poisoning the binaries or release package.

There's also the whole "just because open source allows people to review code doesn't mean that they do" problem, but I don't expect that attack vector to be used by state actors because it would make the beneficiary of the attack too obvious to the public.

I don't think it matters if the product is selfhosted and opensource. That said, in my circles, people are wary about deploying software from specific countries even if they are selfhosted and opensource. I think part of the issue is that docker is the preferred more of deployment these days and sometimes it's not clear what does into the docker image (i.e when you don't build your own images, which you always should)

Reply on news.ycombinator.com