3 ms·

- http://www.gnu.org/philosophy/open-source-misses-the-point.html http://www.gnu.org/philosophy/open-source-misses-the-point.h... - http://www.gnu.org/gnu/linu

• nickpsecurity 11y ago
  GNU and links like those consistently miss the point when the discussion is about security. OSS or FOSS don't matter as much as review by qualified, trusted party with trustworthy distribution. As explained here: https://www.schneier.com/blog/archives/2014/05/friday_squid_bl_424.html#c6051639 https://www.schneier.com/blog/archives/2014/05/friday_squid_... Might explained why a few closed source products achieved high assurance security (B3/A1/EAL6/EAL7) that survived years of NSA pentesting while FOSS... see Snowden leaks. You can get those freedoms with proprietary models via contracts, esp with non-profits. Most just are about money though. Likewise, FOSS communities rarely deliver high-quality, maintained software and never deliver highly assured software. So all this philosophical crap serves nobody if we're talking about making software trustworthy. For that, we need capable people building it while utilizing every security-enhancing method we know, trustworthy people reviewing it whether closed or open, ability to know you possess what was reviewed in that configuration, and continual maintenance esp of bugfixes. That's the baseline we need to push whether FOSS or a proprietary version of open-source.