3 ms·

Why is software like this allowed to be closed? We don't allow our plumbing, structure wiring, welding, or any other physical construction method to be closed

by sqeaky 9y ago

Why is software like this allowed to be closed? We don't allow our plumbing, structure wiring, welding, or any other physical construction method to be closed away and hidden from view. Rather we demand these things be inspected, certified, documented and generally adhere to demonstrable codes and rules. Keeping you source hidden is saying "I have something to hide". Why should someone have something to hide in Pacemaker software, software driving vehicles or safety system on nuclear power plants or anything else where life could be lost?

hanbura 9y ago
I don't think I have any right to see the blueprint of every building I enter. Ensured certification is very different from open source
- sqeaky 9y ago
  I think in some municipalities you can walk down to the planning and get most the blueprints you would like. Where you can't it is partially because the analogy breaks down physical is slightly reduced by openness, its allows attackers of all kinds to plan better. More manpower can be focused to overcome and issue and a map is force multiplier. Security in information systems is strictly increased, because the flaws exist open or close, but when exposed in the open they are closed forever to all attacker regardless of manpower.
bluGill 9y ago
We also have a concept of how to inspect plumbing. I could put all rules on a checklist and teach you how to check the plumbing in your house. (I'd have to look the rules up, but conceptually I could). Of course houses are all the same: a few toilets, sinks, tubs and showers. The differences are easy to handle in the rules. You could imagine something different: instead of water we have a special hand cleaner in this sink. My checklists cover the potable water system and the non-potable water drain system, this special cleaning fluid isn't covered and your cannot inspect it. We have a simple exception for those cases: a professional engineer can legally stamp it saying "I have thought of everything, this will work if installed according to these specs." Then the checklist is make sure that everything is up to those specs. I honestly do not know how to create a checklist for source code. Sure I can create some starts, but https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest needs to be considered: can someone pass your checklist and still win?

by sqeaky 9y ago

hanbura 9y ago

I don't think I have any right to see the blueprint of every building I enter. Ensured certification is very different from open source

sqeaky 9y ago
I think in some municipalities you can walk down to the planning and get most the blueprints you would like. Where you can't it is partially because the analogy breaks down physical is slightly reduced by openness, its allows attackers of all kinds to plan better. More manpower can be focused to overcome and issue and a map is force multiplier. Security in information systems is strictly increased, because the flaws exist open or close, but when exposed in the open they are closed forever to all attacker regardless of manpower.

bluGill 9y ago

We also have a concept of how to inspect plumbing. I could put all rules on a checklist and teach you how to check the plumbing in your house. (I'd have to look the rules up, but conceptually I could). Of course houses are all the same: a few toilets, sinks, tubs and showers. The differences are easy to handle in the rules. You could imagine something different: instead of water we have a special hand cleaner in this sink. My checklists cover the potable water system and the non-potable water drain system, this special cleaning fluid isn't covered and your cannot inspect it. We have a simple exception for those cases: a professional engineer can legally stamp it saying "I have thought of everything, this will work if installed according to these specs." Then the checklist is make sure that everything is up to those specs. I honestly do not know how to create a checklist for source code. Sure I can create some starts, but https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest needs to be considered: can someone pass your checklist and still win?