python

[chazzy2501]

The logic is, that opensource software WITHOUT vendor support, is just random code. You don't know what it does, how it works, what it is doing. (without an independent audit) It is then up to YOU to prove those things or look the fool when a problem occurs.

 

Opensource is not some magical panacea, it doesn't mean it comes with support, auditing, verification, licence adherence, good security practice. an example is restriction is that you can't distribute some open source in a commercial environment. (there ARE restrictions) was Thonny made in a bubble are you sure it doesn't use other opensource (or closed source) code? (probably not) BUT YOU DON'T KNOW is the point. I'm the one responsible for licence adherence and I don't know, I can't prove it.

 

Opensource also has the open secret, that malicious actors can browse the code freely looking for exploits and without vendor support fixes maybe slow or never.

 

To my other point, yes Microsoft broke Microsoft software but they are obligated to fix it, if it breaks Thonny not so. (this isn't likely but you DON'T KNOW) M$ Don't care and Thonny has no support. Do they fix it, maybe, when, maybe.

[CHiLL]

To my other point, yes Microsoft broke Microsoft software but they are obligated to fix it

Not necessarily. There was a bug introduced into the Windows Recovery Environment earlier this year from a BitLocker patch that affected a large number of end users. Microsoft have stated they will not be issuing a bug fix for and instead provided instructions for a manual workaround, which could be argued is well beyond the average user's capabilities.

[chazzy2501]

Not necessarily. There was a bug introduced into the Windows Recovery Environment earlier this year from a BitLocker patch that affected a large number of end users. Microsoft have stated they will not be issuing a bug fix for and instead provided instructions for a manual workaround, which could be argued is well beyond the average user's capabilities.

 

True but this is out of the scope of things you can control. Had this been a 3rd party open source software, you'd promoted, that didn't even offer a bad work around, then you'd be the only one to blame.

[mavhc]

So your options are a) pay for something and when it breaks blame them, b) not pay for something that's free, and when it breaks blame them, or c) pay me £1000 for something that's free and when it breaks blame me

[chazzy2501]

I think, if EdExcel want to use Thonny they should fork it and pay for an independent audit. Also contribute to the project and hire a programmer who can address issues and maintain the fork for them.

[dmj]

Opensource is not some magical panacea, it doesn't mean it comes with support, auditing, verification, licence adherence, good security practice. an example is restriction is that you can't distribute some open source in a commercial environment. (there ARE restrictions) was Thonny made in a bubble are you sure it doesn't use other opensource (or closed source) code? (probably not) BUT YOU DON'T KNOW is the point. I'm the one responsible for licence adherence and I don't know, I can't prove it.

 

actually, you do know: the software dependencies are listed as they are required to build it

 

https://github.com/thonny/thonny/blob/master/requirements.txt

 

You can also prove the licenses, if you looked:

https://github.com/thonny/thonny/tree/master/licenses

 

I think, if EdExcel want to use Thonny they should fork it and pay for an independent audit. Also contribute to the project and hire a programmer who can address issues and maintain the fork for them.

 

That's not why opensource works. They would need to merge the fork to upstream, like the other companies that support it do.

 

 

BTW: how do you teach any programming without using an open source language or compiler?

[mavhc]

I think, if EdExcel want to use Thonny they should fork it and pay for an independent audit. Also contribute to the project and hire a programmer who can address issues and maintain the fork for them.

 

What issues though? 0 CVEs

 

Let's compare to: PyCharm 7 https://www.cvedetails.com/vulnerability-list/vendor_id-15146/product_id-61184/Jetbrains-Pycharm.html

 

Visual Studio 71 https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-676/Microsoft-Visual-Studio.html

 

VSCode 48 https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-50646/Microsoft-Visual-Studio-Code.html

 

Seems that the free software is more secure to me.

 

Do Edexcel want to use Thonny?