3 ms·
Some ideas for that $10B, that I won't charge for: - Fewer lines of code in production, to reduce attack surface (subtractive problem solving[1]) - Free and o
by jka 5y ago
Some ideas for that $10B, that I won't charge for:
- Fewer lines of code in production, to reduce attack surface (subtractive problem solving[1])
- Free and open source by default, to help defenders to inspect components before they use them and get outside expert assistance more easily when required
- Free and open source by default, to aid vulnerability researchers find and report problems in code at all layers
- Free and open source by default, so that vendors and developers can learn to work with an awareness that their output may receive (and in many cases may deserve) scrutiny
- Free and open source by default, so that the next generation of software developers and security professionals can learn from and contribute to a variety of widely-used codebases, rather than certifications that apply largely within the preferred and understood contexts of their corporate sponsors
Allowing end-users (for example, app store users) to see code would also be a nice side-benefit of some of that. I'm certain that 98%+ of consumers won't want to view or inspect app code, but for the small number that do, it could be important. Viewing HTML and JS source is no doubt how a large number of web developers begin their career journey.
[1] - https://www.nature.com/articles/d41586-021-00592-0 https://www.nature.com/articles/d41586-021-00592-0