3 ms·

I generally don't trust open-source. Too many people have access; and therefore I assume anything open-source has zero security. It's a related to the Prisoner

by Endy 10y ago

I generally don't trust open-source. Too many people have access; and therefore I assume anything open-source has zero security. It's a related to the Prisoner's Dilemma - it's most advantageous to those who find exploits to use them for their own good rather than report them and reduce them.

cholantesh 10y ago
>Too many people have access; and therefore I assume anything open-source has zero security. I don't think it's fair that you were downvoted, but this is an idea that developers and IS professionals tend to disagree with [1]. Even detractors don't feel that higher code availability correlates with lower levels of application security. 1 - https://www.schneier.com/essays/archives/2004/10/the_non-security_of.html https://www.schneier.com/essays/archives/2004/10/the_non-sec...
- Endy 10y ago
  I consider it a given that developers and IS professionals would (at least) publicly disagree with that statement. After all, if they agreed that closed-source was better, there would be fewer open-source projects, which gives them a smaller resource set. In the end, whether or not it's more secure isn't really the issue, it's what keeps the paychecks coming more effectively. Being able to use code blocks from FOSS projects makes a developer's life easier, rather than consistently reinventing the wheel. It also allows for more code to get out the door, faster. So whether they're paid on salary so they can just browse GitHub (or SourceForge, etc) for the code they're looking for, or paid by project so they want to get things out quick, it's beneficial to have many open source projects across the entire ecosystem of computing. Being able to review source makes an IS professional's life easier, because rather than testing the I/O of a black box (which is often time-consuming), they can look over "important sections" of the (often human-readable) code. With something like Notepad++, they have code indentation and highlighting, and can search for key phrases to identify those "important sections" which often show some kind of major security hazard. This means that they get more projects done, in turn being able to make more money. So when you look at the situation from a "cui bono?" ("who benefits?") perspective as a relative outsider, those two groups of people who are most strongly in favor of open source are the two groups which are most likely to benefit from it. As such, I consider their statements subject to bias, whether conscious or not!
  - cholantesh 10y ago
    There are similar arguments that have been made by tech professionals in favour of closed source software. I'm not clear as to why you disregard the potential bias here, and why you think that subject matter expertise should disqualify an arguer. Frankly, this reads as ad hominem and conspiratorial thinking to me.

by Endy 10y ago

cholantesh 10y ago

>Too many people have access; and therefore I assume anything open-source has zero security. I don't think it's fair that you were downvoted, but this is an idea that developers and IS professionals tend to disagree with [1]. Even detractors don't feel that higher code availability correlates with lower levels of application security. 1 - https://www.schneier.com/essays/archives/2004/10/the_non-security_of.html https://www.schneier.com/essays/archives/2004/10/the_non-sec...

Endy 10y ago
I consider it a given that developers and IS professionals would (at least) publicly disagree with that statement. After all, if they agreed that closed-source was better, there would be fewer open-source projects, which gives them a smaller resource set. In the end, whether or not it's more secure isn't really the issue, it's what keeps the paychecks coming more effectively. Being able to use code blocks from FOSS projects makes a developer's life easier, rather than consistently reinventing the wheel. It also allows for more code to get out the door, faster. So whether they're paid on salary so they can just browse GitHub (or SourceForge, etc) for the code they're looking for, or paid by project so they want to get things out quick, it's beneficial to have many open source projects across the entire ecosystem of computing. Being able to review source makes an IS professional's life easier, because rather than testing the I/O of a black box (which is often time-consuming), they can look over "important sections" of the (often human-readable) code. With something like Notepad++, they have code indentation and highlighting, and can search for key phrases to identify those "important sections" which often show some kind of major security hazard. This means that they get more projects done, in turn being able to make more money. So when you look at the situation from a "cui bono?" ("who benefits?") perspective as a relative outsider, those two groups of people who are most strongly in favor of open source are the two groups which are most likely to benefit from it. As such, I consider their statements subject to bias, whether conscious or not!
- cholantesh 10y ago
  There are similar arguments that have been made by tech professionals in favour of closed source software. I'm not clear as to why you disregard the potential bias here, and why you think that subject matter expertise should disqualify an arguer. Frankly, this reads as ad hominem and conspiratorial thinking to me.