4 ms·

I surely can't be the only one who sees open down to the hardware replacements as the only solution to this type of problems.

• wmf 7y ago
  For most enterprise IT products there is no "open down to the hardware" replacement and there never will be because there isn't a business model to create it.
  • travbrack 7y ago
    The Facebook open compute network gear is, and is equivalent to the Cisco Nexus series
• bmalehorn 7y ago
  As a former Cisco employee, I can tell you why companies never want to open source their security-sensitive products: Pros of open sourcing a product: - fewer total number of vulnerabilities Cons of open sourcing a product: - more publicly-known vulnerabilities - less effort required to find new vulnerabilities The product might be more objectively secure, with more bug reports and more fixes. But it will be less practically secure. There will be more known vulnerabilities, and many customers can't upgrade, leaving more total vulnerable customers. And worse, now anyone on the internet can try and find new vulnerabilities for $0, while before they'd need to buy a $1,000+ piece of hardware to even get a shot at the compiled code. The real defense against this problem is security auditing. Security engineers try to hack the device while asking a bunch of questions about SSH connections and private keys. This is the technique most companies employ, often combined with bug bounties.
  • neilv 7y ago
    Auditor: "Question 1. Did you manage to add backdoor keys to your production build?" Auditor: "Big surprise. We once again recommend that you use a build system. Question 2. ..."
  • dngray 7y ago
    Really what you're saying is that if you open source your product the degree of shittyness will be then obvious to everyone, and that security by obscurity keeps the managers happy because they think there is less work.