4 ms·

Source availability helps in crafting successful exploits in the real world. Providing the source of a closed source project to an adversary so that they can b

Source availability helps in crafting successful exploits in the real world. Providing the source of a closed source project to an adversary so that they can break your software is nefarious. If the author's justification was... "My crypto implementation is perfect. There are no bugs in my code, so providing source code (which the user community does not have) to an adversary does not have any effect on any user's security." ...then the author is simply incompetent, not malicious. But I am not inclined to accuse the author of such incompetence.

MichaelBurge 7y ago
Your argument is that withholding source code raises the cost of attack for the NSA. They'll have to buy expensive decompilers, hire competent assembly/C programmers, it'll take longer, etc. Seems like it would similarly be unethical for a local bakery to give the NSA a discount on cheesecake.
- LocalH 7y ago
  NSA buying a decompiler? When Ghidra exists?
- rcoveson 7y ago
  The NSA does a lot of things. A lot of them are good. Some of them are bad. When the NSA asks you to help them do bad things, you say no. If you feel inspired to give them a cheesecake discount because of the good things they do, that is fine.
selykg 7y ago
So you’re saying open source projects are less secure than closed source. You might be the only person around here to ever try that argument in public.
- rcoveson 7y ago
  That's not what I'm saying at all. Most people who argue that open source is equally or more secure than close source software do not argue that access to source code provides zero benefit to attackers. Instead, they argue that the benefit gained by the many additional sets of eyes belonging to researchers and other "good guys" outweighs the detrimental effect of letting the "bad guys" see as well. The question in this instance is not whether the closed-source-superior or open-source-superior security camps is correct. The only related question is: "Does access to source code provide any benefit whatsoever to an attacker?" I don't think I'm the "only person around here" who would argue that yes, it does. And that if you're taking the closed-source route, like this project's author, you can't provide copies of your source code to one specific attacker when they ask. If you do that, you're _definitely_ worse off (from a security perspective) than the people in the open source camp. I'm sure the closed-source-superiority people would agree.
- thomaslord 7y ago
  Not necessarily - the normal argument for open source being secure is that the source code can be reviewed by the community and any security issues will be noticed and patched. In this case the parent specifically mentions source code the community doesn't have access to.

MichaelBurge 7y ago

Your argument is that withholding source code raises the cost of attack for the NSA. They'll have to buy expensive decompilers, hire competent assembly/C programmers, it'll take longer, etc. Seems like it would similarly be unethical for a local bakery to give the NSA a discount on cheesecake.

LocalH 7y ago
NSA buying a decompiler? When Ghidra exists?
rcoveson 7y ago
The NSA does a lot of things. A lot of them are good. Some of them are bad. When the NSA asks you to help them do bad things, you say no. If you feel inspired to give them a cheesecake discount because of the good things they do, that is fine.

selykg 7y ago

So you’re saying open source projects are less secure than closed source. You might be the only person around here to ever try that argument in public.

rcoveson 7y ago
That's not what I'm saying at all. Most people who argue that open source is equally or more secure than close source software do not argue that access to source code provides zero benefit to attackers. Instead, they argue that the benefit gained by the many additional sets of eyes belonging to researchers and other "good guys" outweighs the detrimental effect of letting the "bad guys" see as well. The question in this instance is not whether the closed-source-superior or open-source-superior security camps is correct. The only related question is: "Does access to source code provide any benefit whatsoever to an attacker?" I don't think I'm the "only person around here" who would argue that yes, it does. And that if you're taking the closed-source route, like this project's author, you can't provide copies of your source code to one specific attacker when they ask. If you do that, you're _definitely_ worse off (from a security perspective) than the people in the open source camp. I'm sure the closed-source-superiority people would agree.
thomaslord 7y ago
Not necessarily - the normal argument for open source being secure is that the source code can be reviewed by the community and any security issues will be noticed and patched. In this case the parent specifically mentions source code the community doesn't have access to.