4 ms·

And kids, this is why security by obscurity is such an awful, awful idea. If it's true their products' security "doesn’t depend on the secrecy of our source co

And kids, this is why security by obscurity is such an awful, awful idea. If it's true their products' security "doesn’t depend on the secrecy of our source code" then there shouldn't be any issues in open-sourcing it already. Open source, not making it free software, which I suspect they'd never do anyway. Even having some form of assurance they're not doing anything nefarious behind the scenes and a proper bug bounty program would be plenty.

colejohnson66 9y ago
I was with you up until the second “paragraph.” Just because something doesn’t depend on security through obscurity doesn’t mean it can’t be closed source
tzs 9y ago
> And kids, this is why security by obscurity is such an awful, awful idea. This is probably the most misunderstood security concept on the net. What it is supposed to mean is that security should not depend on obscurity. For some reason people seem to take at as meaning obscurity should not be part of your defense at all. In real life, obscurity is useful in many cases because it slows down attackers. For example, lets say you want to get to my credit card database. What you need to do is: 1. Break into one of my public facing servers. 2. From that server, find a way through the firewall that separates the network the credit card handling system is on from the rest of my company's networks. 3. One through the firewall, find an exploitable flaw in the design or implementation of the credit card storage system. If you can get a copy of the source code and configuration of everything except for passwords (i.e., there is no obscurity in my system), then you can set up a clone of my system in your lab and work on finding all the holes you need at your leisure and without drawing my attention. Once you've got exploits for a public facing server, the firewall, and the credit card storage system, you might be able to do a quick attack and get in and get the credit cards before I can do anything. If I've included obscurity it is much less likely that you can do a quick raid like that. You'll have to plod through the layers of my system step by step, working ON my systems, giving me a much better chance of noticing your attack and stopping it before you get to and find a hole in the final layer where the credit cards are stored.

colejohnson66 9y ago

I was with you up until the second “paragraph.” Just because something doesn’t depend on security through obscurity doesn’t mean it can’t be closed source

tzs 9y ago

> And kids, this is why security by obscurity is such an awful, awful idea. This is probably the most misunderstood security concept on the net. What it is supposed to mean is that security should not depend on obscurity. For some reason people seem to take at as meaning obscurity should not be part of your defense at all. In real life, obscurity is useful in many cases because it slows down attackers. For example, lets say you want to get to my credit card database. What you need to do is: 1. Break into one of my public facing servers. 2. From that server, find a way through the firewall that separates the network the credit card handling system is on from the rest of my company's networks. 3. One through the firewall, find an exploitable flaw in the design or implementation of the credit card storage system. If you can get a copy of the source code and configuration of everything except for passwords (i.e., there is no obscurity in my system), then you can set up a clone of my system in your lab and work on finding all the holes you need at your leisure and without drawing my attention. Once you've got exploits for a public facing server, the firewall, and the credit card storage system, you might be able to do a quick attack and get in and get the credit cards before I can do anything. If I've included obscurity it is much less likely that you can do a quick raid like that. You'll have to plod through the layers of my system step by step, working ON my systems, giving me a much better chance of noticing your attack and stopping it before you get to and find a hole in the final layer where the credit cards are stored.