4 ms·
I don’t believe that Open Source == Less Secure. See also: Linux, Ngix, Postgres... Many many open source projects are secure. They’re not perfect but an argume
by xahrepap 6y ago
I don’t believe that Open Source == Less Secure. See also: Linux, Ngix, Postgres... Many many open source projects are secure. They’re not perfect but an argument could be made that they’re more secure BECAUSE they’re open.
Software with crosshairs on its back practicing garbage security practices will be pwnd the same regardless of it’s open-ness.
Honestly. With a lot of the tools out there these days. I question if it’s even faster to hunt security bugs by reading the source rather than just attempting common exploits via tooling.
- asabjorn 6y agoIt is way easier to find a software vulnerability in a backend you have the code for, instead of probing a black-box backend for vulnerabilities. For instance, you can use static analysis tools to discover vulnerabilities.
- industriousthou 6y agoSo way more people are able to identify those vulnerabilities and fix them?
- o_p 6y agoSure, after they stole your data already
- cm2187 6y agoThere are probably a lot more eyes on a generic tool used everywhere than on the source code of a single web service.
- FDSGSG 6y agoHow is Linux supposed to be a good example of a secure open source project? I'm not really convinced by Postgres either, software like that inherently exposes very little attack surface unless the attackers already have access. Nobody is interested in exploiting Postgres.