18

I have a question about my Stack Overflow post: How can the WSO2 open-source offering be used securely?

I posted this question last week, and have since tried to iterate on it in hopes that it would be re-opened for answers. Unfortunately, it seems to be continuously rejected. Since I am new to posting questions on SO, I didn't realize how difficult it would be to phrase the question in such a way as to keep it from being closed so quickly. I was hoping that someone might be able to help guide me a bit more as to what I'm doing wrong so that I can correct it and get responses from the community if possible.

I feel as though answers to this question would be useful to others in the future as well, as the topic does not appear to be well / concisely documented elsewhere. In addition, if this is a security concern as seems to be the case, being able to quickly find this out seems like it may save others from introducing unnecessary vulnerabilities into their environment.

16
  • 5
    What other answers would you expect for the current question, other than the comment made by Mark Rotteveel: Pay for a WSO2 subscription? If that truly is the answer, wouldn't this be more of a product support type question? And if that is not the answer, then the question could be considered unfocused, although I'm not expert enough in this field to know for sure. Commented Sep 25, 2023 at 19:52
  • The generic answer "discover or learn about the vulnerability yourself, apply a fix similar or identical to the one provided by the org yourself" would be overly broad, and other options about hardening the system with some external tech stack are basically recommendations for other software, which is inherently opinion based Commented Sep 25, 2023 at 19:56
  • 7
    At a glance, I don't think this is salvageable: For one, the question fundamentally isn't about programming or something uniquely related to it. Even disregarding that, the question is what you consider secure enough - since they make money by offering security updates, the non-paid version will never be as secure as the paid one. Commented Sep 25, 2023 at 19:59
  • Thanks everyone for the quick responses. Since WSO2 is an integration platform, it is designed to sit on the boundary between a private and public network. My main goal here was to understand if the open-source offering can be used free of known vulnerabilities which have been patched. I asked the question in the WSO2 collective, which I was hoping would mean that experts would see it. We did actually speak to the company and they were not very straightforward in their response, so I thought I would try and get a more direct answer from those who have more experience with the product.
    – gp-michael
    Commented Sep 25, 2023 at 20:30
  • 3
    Ah, you might have been bit by a misunderstanding then. Collectives aren't a sub-area of the site that is separate from the overall site, questions asked "within a collective" are asked within the site as a whole, not just within the collective, and thus need to follow site guidelines.
    – Kevin B
    Commented Sep 25, 2023 at 20:32
  • One would hope that if a truly bad vulnerability was discovered a company would quickly update all of their offerings, freeware included, rather than making a part of your community wait 6 months with vulnerabilities they've already solved for the update that fixes them just because they decided to use the free offering.
    – Kevin B
    Commented Sep 25, 2023 at 20:35
  • @KevinB So, if I understand correctly, asking questions about how to program WSO2 are in scope, but configuring the application and understanding its lifecycle and architecture may be out of scope. Is this right?
    – gp-michael
    Commented Sep 25, 2023 at 20:44
  • @KevinB One would hope, yes. Unfortunately, all of my research so far has led me to the understanding that this is not the case. I'm concerned that those using the open-source offering are unwittingly making their environments less secure. I was hoping that someone with more experience might be able to tell me otherwise.
    – gp-michael
    Commented Sep 25, 2023 at 20:44
  • @gp-michael I'm not familiar enough with wso2 to really delve into the specifics of what is and isn't accepted here, outside of it needs to be primarily programming based as described in the help center. What you asked is more related to the company's reputation/practices than anything actually related to programming, that's why it's not a good fit.
    – Kevin B
    Commented Sep 25, 2023 at 20:50
  • @KevinB That makes sense, thanks for taking the time to talk it through with me!
    – gp-michael
    Commented Sep 25, 2023 at 20:57
  • 1
    This is essentially not tied to WSO2 specifically. In general if a product has a paid and an "open source" or a free variant, the free variant is essentially more like a good will demo version that you can use indefinitely. If it is a mission critical product to you, pay for it. It is a business model; put stuff out there for free and generate good will, make sure people use it, get feedback on it, but don't update the free version frequently so people have a need to pay for support or more features. I've seen products only put out major versions and no patch versions.
    – Gimby
    Commented Sep 27, 2023 at 10:09
  • 1
    I'll throw this on here since my question was deleted... I do feel like there are some fairly serious ethical implications to intentionally withholding security updates to a product that is released publicly, and intended for use on the public internet. I do wish that this question could help warn people of this issue. I'll try and find another forum for that. My organization was caught off guard by this, and based on what I've heard we are not the first.
    – gp-michael
    Commented Sep 27, 2023 at 17:55
  • I researched this a bit, and according to security.docs.wso2.com/en/latest/security-processes/… I don't see anything regarding delayed security updates for community users. All it says is If the latest version of any WSO2 product is not affected by the issue, public security advisory will be issued advising community users to update to the latest product version Your question, if phrased properly,...[1/2]
    – TheMaster
    Commented Sep 28, 2023 at 2:27
  • 1
    .... maybe ontopic for Information Security (their help specifically allows "policies" related questions, but they also recommend Law). Maybe Philosophy for ethics may interest you. If you want to open a discussion though, reddit/x(twitter)/mastadon would be a better place.[2/2]
    – TheMaster
    Commented Sep 28, 2023 at 2:36
  • 1
    @TheMaster THANK YOU SO MUCH! This is what I've been looking for. I failed to realize that the security advisories contained links to pull requests that could be used to manually apply the fixes and rebuild / patch. I have yet to determine the complexity of doing this, but this points me in the right direction. Plus it resolves some of my concerns about the ethics. Thanks also for the suggestions on other places to post. I may do that to further explore the topic.
    – gp-michael
    Commented Sep 29, 2023 at 14:53

2 Answers 2

28

This question is effectively asking how users of an open source product can rely on a company to update their free product with security updates as quickly as they update their paid product. At minimum, it's not programming related and never will be as long as it's still asking something that relies entirely on whether or not the company updates their product.

Now, if you wanted to instead focus your question on how to fix a very specific, known, vulnerability that is expected to not be resolved by the company for n months, that's probably something you could work into an acceptable question. But it needs to be real, not hypothetical.

5
  • 3
    There might be other exchanges where such questions might be ontopic. Maybe softwareengineering.stackexchange.com Commented Sep 26, 2023 at 9:05
  • 5
    Maybe. But to be honest there is only one answer to that question. The obvious one. Pay the subscription, or live with the risk of an unpatched security flaw. (And if that's not acceptable, look for another product.) So even if the OP posts the question somewhere where it is on-topic, they are not going to get an answer different to what the original comments told him. In other words, it would be a waste of the OP's time.
    – Stephen C
    Commented Sep 26, 2023 at 12:35
  • @NoDataDumpNoContribution I may do this, thanks for the suggestion. I'm mainly looking for feedback from someone who has more experience with WSO2 than me, most likely to confirm that there is no viable solution other than to purchase a subscription.
    – gp-michael
    Commented Sep 26, 2023 at 16:48
  • 6
    @gp-michael Solution to what problem exactly? What level of security do you desire? The whole thing is not binary, with the paid subscription you do not have absolutely safety and without you do not have absolute vulnerability. You probably are asking yourself how much security you need and which of these products does deliver it and if its worth it. For these questions, better not ask at softwareengineering.stackexchange, better ask at a WSO2 community. I thought you may have a general question, but you simply need a WSO2 expert to advice you on a buying decision. Find that advice elsewhere. Commented Sep 26, 2023 at 17:55
  • What we are really looking for is to be able to patch the software of all known vulnerabilities that have been addressed by WSO2. If the vulnerabilities are not patched, the system could be compromised more readily since knowledge of those vulnerabilities would be public. Based on all the conversation around this so far, and what my research and interactions with WSO2 themselves has led to, it is simply not acceptable to run the open-source version in a production environment where it will be exposed to the public internet (unless you are not concerned about security).
    – gp-michael
    Commented Sep 27, 2023 at 18:05
6

Knowing nothing of WSO2 and answering only in a context of Stack Overflow's topicality (of which I have some extensive experience on):

I would say that this question is too broad in the sentiment that

  • running something securely is a highly subjective matter, and
  • there is more than one way to do this, so there is more than one answer.

It would sound like something you'd probably pose to a sales rep or a solutions architect of the software to see what their recommendation is, but on Stack Overflow, it wouldn't make a whole lot of sense since there isn't a tacit guarantee that any one of us could fill that role, nor would we explicitly recommend that you blindly follow the advice of someone on the Internet who's not on the hook for your secure environment to make a secure environment.

3
  • I can get more precise on what I mean by security (see comment above). However, I have no way of knowing how many answers there may be here. I would imagine this is the case for many questions that are more programming focused. It sounds like I need to read through the guidelines more to better understand how to ask appropriate questions. I will definitely think twice before posting in the future.
    – gp-michael
    Commented Sep 25, 2023 at 20:39
  • 4
    @gp-michael: It's really not a programming question, though. Running a service securely is only tangentially related to programming. That is to say, there are some things you can implement to make a service or application more secure, but that doesn't mean that a programmer would know how to administer or run a secure service. I wouldn't let this discourage you too much; you're one of the very rare few people who come to Meta for an explanation and try to learn from it rather than try to tear our heads off about things like this, which I commend.
    – Makoto
    Commented Sep 25, 2023 at 20:45
  • 5
    Got it, thanks! I appreciate the words of encouragement.
    – gp-michael
    Commented Sep 25, 2023 at 20:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .