3 ms·
It's a question of information asymmetry. It's always easier to be on the attacking side of cyber security. If the attackers have good intel, and the defense i
by tovej 5y ago
It's a question of information asymmetry.
It's always easier to be on the attacking side of cyber security. If the attackers have good intel, and the defense isn't organized, their work is much easier.
With (popular) open source projects, there are hundreds of eyeballs looking at the source and trying to fix security issues before they can be exploited.
The closed source project is typically less secure, but attackers also have less information to work with. Open source is typically more secure, but attackers have more information. Leaked closed source is the worst of both worlds.
- jart 5y agoThe logical conclusion of your statement is that the strongest software would be projects that are collaboratively maintained by a large number of people, similar to an open source project, except behind the veil of confidentiality at a big company.
- tovej 5y agoIt has potential. But it is better than open source only if you trust all the maintainers in the organization. And previous maintainers who have now left the org. And only if the codebase is routinely looked over and tested, no part of the codebase gets forgotten and becomes unmaintainable because somebody left the company. Open source has the added benefit that maintainers typically don't disappear complete from the project overnight because they got a new job/were fired.