3 ms·
Or maybe security through, you know, actual security. Closed source does not mean obscurity–– and open source does not mean clarity (see OpenSSL, that one Linu
by PeCaN 10y ago
Or maybe security through, you know, actual security.
Closed source does not mean obscurity–– and open source does not mean clarity (see OpenSSL, that one Linux 2.6 thing¹, etc).
It's not like being proprietary suddenly means the only security is through obscurity. Why do you think that? Are you just a zealot? Did you not consider that closed source software could be well-engineered and secure? You're welcome to read about some of the security features in Windows NT² (that article is a bit old but still relevant), which are considerably more thorough than (non-SE)Linux (I think SELinux has auditing now, so it's at least comparable to NT).
Now, don't get me wrong, I generally prefer open-source tools (for a variety of reasons) and tend to trust them more, but saying stupid stuff like you are just gives open source a bad name.
On top of that, obscurity is a perfectly valid layer of security. To use a mediocre analogy, of course you want your safe to be strong enough that nobody could break in even if it's in plain sight—but it's certainly not a bad idea to hide the safe as well.
¹ https://lwn.net/Articles/341773/ https://lwn.net/Articles/341773/
² https://www.microsoft.com/resources/documentation/windowsnt/4/workstation/reskit/en-us/security.mspx https://www.microsoft.com/resources/documentation/windowsnt/...
- jrowley 10y agoI wasn't saying it was only secure due to obscurity. I should asked more clearly - "So the idea is to enhance security through obscurity?" For mission critical secure systems, I can see a case being made that software should be closed source, as it allows fewer people to be aware of potential attack vectors. Especially, if you know the software you are creating won't be used externally much or audited.