3 ms·

Hypothetically speaking, because you can get a better support contract with a closed (or semi-closed) source software vendor. Alternatively because closed sourc

Hypothetically speaking, because you can get a better support contract with a closed (or semi-closed) source software vendor. Alternatively because closed source software is easier to monetize and likely has better resources to direct to feature development. But in practice almost all cryptography is deployed via open source software. Large tech companies like Google and Apple can develop reliable and safe closed source cryptography. But most companies don't because that's expensive and usually unnecessary.

phkahler 8y ago
>> Hypothetically speaking, because you can get a better support contract with a closed (or semi-closed) source software vendor. I knew a guy who worked at a medium size company (few thousand people). They tried to drag him back into an old product he worked on years ago to help because.... They still had one customer paying support on it, but someone realized they couldn't find the source code. This guy couldn't help and fortunately the customer hadn't asked for any changes to the software in several years. So no, paying for software doesn't necessarily mean it's supported in any meaningful way.
- throwawaymath 8y ago
  I have to be honest, I don't think that one example can tell us anything meaningful about whether or not closed source software is typically better supported. Note that I used the word "can", not the word (which you used) "necessarily."
  - phkahler 8y ago
    Agreed. My point was simply that the level of "support" you get by paying for software can actually be zero. I don't claim to know what's typical. My estimation is that typical support consists of listening to customer complaints and suggestions and prioritizing development around that and available resources. I doubt many companies do extensive analysis or hire consultants to do security audits or much of anything that isn't directly customer driven. The company I mentioned previously actually does extensive design, testing and regression testing on most of their products but the smaller side project just didn't get that attention. YMMV even within one company.
- noidea_ 8y ago
  The parent obviously didn't mean that ALL TIMES UNDER ALL CIRCUMSTANCES DO YOU GET PERFECT SUPPORT. It's simply a data point in the overall calculus. Support vs internal maintainability vs cost vs ability to find supporting talent vs license provisions vs IP concerns vs regulatory requirements vs a million other reasons.

phkahler 8y ago

>> Hypothetically speaking, because you can get a better support contract with a closed (or semi-closed) source software vendor. I knew a guy who worked at a medium size company (few thousand people). They tried to drag him back into an old product he worked on years ago to help because.... They still had one customer paying support on it, but someone realized they couldn't find the source code. This guy couldn't help and fortunately the customer hadn't asked for any changes to the software in several years. So no, paying for software doesn't necessarily mean it's supported in any meaningful way.

throwawaymath 8y ago
I have to be honest, I don't think that one example can tell us anything meaningful about whether or not closed source software is typically better supported. Note that I used the word "can", not the word (which you used) "necessarily."
- phkahler 8y ago
  Agreed. My point was simply that the level of "support" you get by paying for software can actually be zero. I don't claim to know what's typical. My estimation is that typical support consists of listening to customer complaints and suggestions and prioritizing development around that and available resources. I doubt many companies do extensive analysis or hire consultants to do security audits or much of anything that isn't directly customer driven. The company I mentioned previously actually does extensive design, testing and regression testing on most of their products but the smaller side project just didn't get that attention. YMMV even within one company.
noidea_ 8y ago
The parent obviously didn't mean that ALL TIMES UNDER ALL CIRCUMSTANCES DO YOU GET PERFECT SUPPORT. It's simply a data point in the overall calculus. Support vs internal maintainability vs cost vs ability to find supporting talent vs license provisions vs IP concerns vs regulatory requirements vs a million other reasons.