15 ms·

How this is controversial is extremely obvious to anyone who works in security. So much so that the opposite of this tenet is literally the first thing generall

How this is controversial is extremely obvious to anyone who works in security. So much so that the opposite of this tenet is literally the first thing generally taught about security (Kerckhoffs's principle). It's well-known, and pretty uncontroversially accepted in the security community. The general idea here is that, while it can be useful to have some "security through obscurity", it's important not to rely on it, and in most cases where it is cites as a measure, it is relied on (often heavily). A good phrase I've heard used to elucidate on this is that "sunlight is the best disinfectant". For example, a more recent related discussion is Schneier's Law[0], which basically posits that any amateur can make a piece of software that they themselves can't break into. True security comes from sharing & discussing it with alternative perspectives (ideally whitebox - not black/greybox - discussions). It's telling about the audience that flock to "crypto(currency)" related posts that the comment is buried in downvotes, because I would think the typical average HN user would not be downvoting this comment. [0] https://www.schneier.com/blog/archives/2011/04/schneiers_law.html https://www.schneier.com/blog/archives/2011/04/schneiers_law... > Kerckhoffs's principle.

Ensorceled 5y ago
You are completely missing the point. Risk analysis is a balancing act: Pros: open source, white hats can easily inspect the source Cons: open source, black hats can easily inspect the source You don’t get to just delete the cons you don’t like, even, if like me, you think the pro out weighs the con.
- lucideer 5y ago
  > if like me, you think the pro out weighs the con. My point is very simply that in my opinion that you're wrong to think this, and that opinion is shared by most of the security community. There is ample evidence that the cons FAR outweigh the pros in this particular comparison. --- Another way to visualize your comparison would be: - Closed source: -- Pros: 1 white hat can easily inspect the source -- Cons: 1000 hackers can blackbox-attack the application - Open source: -- Pros: 100 white hats can easily fix the source -- Cons: 1000 black hats can whitebox-attack the application You're arguing that 99 white hats don't trump black-vs-white. --- Even if I play devil's semi-advocate here and consider that the pros balance the cons, the statement in the article is still wildly out of place in that context.
  - jktogjfnn 5y ago
    Why doesn't the NSA/FSB/... open source their crypto systems then so that people can search for flaws? And there would be interest, imagine the street cred...
    - lucideer 5y ago
      Not too sure about the NSA - I know they subcontract a lot, so may be harder to weed out. GCHQ have some fascinating stuff out there though https://github.com/gchq/CyberChef/blob/master/src/core/operations/Numberwang.mjs https://github.com/gchq/CyberChef/blob/master/src/core/opera...
    - kittywav 5y ago
      They generally do open source their crypto systems (at least the algorithms themselves), given that that is practically a requirement for any crypto system to be adopted in a widespread way (no one who is serious about security is going to use home-baked closed-source cryptosystems). Examples: https://en.wikipedia.org/wiki/Speck_(cipher) https://en.wikipedia.org/wiki/Speck_(cipher) and https://en.wikipedia.org/wiki/Simon_%28cipher%29 https://en.wikipedia.org/wiki/Simon_%28cipher%29 and https://en.wikipedia.org/wiki/GOST_(block_cipher) https://en.wikipedia.org/wiki/GOST_(block_cipher)
  - Ensorceled 5y ago
    Again, you are COMPLETELY missing my point and also putting me on the wrong side of this argument. I AGREE open source is usually safer. In fact you QUOTE me saying that ("if like me, you think the pro out weighs the con") and then say that I'm "wrong". What I'm saying is you HAVE TO DO THE ANALYSIS, which you then went and did. You can't just delete the cons and say they don't exist YOU HAVE TO DO THE ANALYSIS. In your analysis there is the assumption that there is "100 white hats" looking that the code ... which isn't always true. How would your analysis change then? You WON'T KNOW if you just deleted that "con" from your risk analysis "because open source".
  - netwo233gur 5y ago
    >you're wrong to think this Security engineer here. No they aren't. I'd say they are being a much more comprehensive in their security analysis by including the cons in their calculation rather than dismissing them and assuming that the pros outweigh them. >opinion is shared by most of the security community. No it isn't. Security by obscurity is a very valid defense-in-depth measure. There's a reason you disable "debug-level logging" on production webservers. >There is ample evidence that the cons FAR outweigh the pros in this particular comparison. Show said evidence, please, because there is ample evidence that open source software magically being reviewed by hordes of people is many times a myth. Heartbleed was caused because pretty much nobody cared to look at openssl's code and review it for vulnerabilities. Just because it is available to be looked at by white hats doesn't mean anyone actually is looking at it. And if something so critical to security like openssl isn't even being reviewed by security researchers, what gives you any confidence that random software like JoesCoolLoggingLibrary is reviewed with any more scrutiny? Speaking of logging, Log4shell is yet another example. The most ubiquitous libraries in use. Used everywhere by some of the largest tech companies in the world, that all have the largest and most well-budgeted security organizations. The vulnerability was present in code for years, available for anyone in the world to look at, and yet...? Instead, there is evidence that Log4shell was being exploited by black hats before any white hats discovered it. >You're arguing that 99 white hats don't trump black-vs-white. No, they're arguing that there is no guarantee that these 99 white hats are somehow better than the 1000 black hats, and I'd add to it that there is also no guarantee that these 99 white hats magically appear, anyway. In fact, I think a more realistic visualization for most software is: - Closed source: -- Pros: 1 well paid white hat can easily inspect the source -- Cons: 1000 hackers can blackbox-attack the application - Open source: -- Pros: 1-2 unpaid volunteer white hats might inspect the source if they have time -- Cons: 1000 black hats can whitebox-attack the application As a security engineer, I know which one I feel more comfortable with.

Ensorceled 5y ago

You are completely missing the point. Risk analysis is a balancing act: Pros: open source, white hats can easily inspect the source Cons: open source, black hats can easily inspect the source You don’t get to just delete the cons you don’t like, even, if like me, you think the pro out weighs the con.

lucideer 5y ago
> if like me, you think the pro out weighs the con. My point is very simply that in my opinion that you're wrong to think this, and that opinion is shared by most of the security community. There is ample evidence that the cons FAR outweigh the pros in this particular comparison. --- Another way to visualize your comparison would be: - Closed source: -- Pros: 1 white hat can easily inspect the source -- Cons: 1000 hackers can blackbox-attack the application - Open source: -- Pros: 100 white hats can easily fix the source -- Cons: 1000 black hats can whitebox-attack the application You're arguing that 99 white hats don't trump black-vs-white. --- Even if I play devil's semi-advocate here and consider that the pros balance the cons, the statement in the article is still wildly out of place in that context.
- jktogjfnn 5y ago
  Why doesn't the NSA/FSB/... open source their crypto systems then so that people can search for flaws? And there would be interest, imagine the street cred...
  - lucideer 5y ago
    Not too sure about the NSA - I know they subcontract a lot, so may be harder to weed out. GCHQ have some fascinating stuff out there though https://github.com/gchq/CyberChef/blob/master/src/core/operations/Numberwang.mjs https://github.com/gchq/CyberChef/blob/master/src/core/opera...
  - kittywav 5y ago
    They generally do open source their crypto systems (at least the algorithms themselves), given that that is practically a requirement for any crypto system to be adopted in a widespread way (no one who is serious about security is going to use home-baked closed-source cryptosystems). Examples: https://en.wikipedia.org/wiki/Speck_(cipher) https://en.wikipedia.org/wiki/Speck_(cipher) and https://en.wikipedia.org/wiki/Simon_%28cipher%29 https://en.wikipedia.org/wiki/Simon_%28cipher%29 and https://en.wikipedia.org/wiki/GOST_(block_cipher) https://en.wikipedia.org/wiki/GOST_(block_cipher)
- Ensorceled 5y ago
  Again, you are COMPLETELY missing my point and also putting me on the wrong side of this argument. I AGREE open source is usually safer. In fact you QUOTE me saying that ("if like me, you think the pro out weighs the con") and then say that I'm "wrong". What I'm saying is you HAVE TO DO THE ANALYSIS, which you then went and did. You can't just delete the cons and say they don't exist YOU HAVE TO DO THE ANALYSIS. In your analysis there is the assumption that there is "100 white hats" looking that the code ... which isn't always true. How would your analysis change then? You WON'T KNOW if you just deleted that "con" from your risk analysis "because open source".
- netwo233gur 5y ago
  >you're wrong to think this Security engineer here. No they aren't. I'd say they are being a much more comprehensive in their security analysis by including the cons in their calculation rather than dismissing them and assuming that the pros outweigh them. >opinion is shared by most of the security community. No it isn't. Security by obscurity is a very valid defense-in-depth measure. There's a reason you disable "debug-level logging" on production webservers. >There is ample evidence that the cons FAR outweigh the pros in this particular comparison. Show said evidence, please, because there is ample evidence that open source software magically being reviewed by hordes of people is many times a myth. Heartbleed was caused because pretty much nobody cared to look at openssl's code and review it for vulnerabilities. Just because it is available to be looked at by white hats doesn't mean anyone actually is looking at it. And if something so critical to security like openssl isn't even being reviewed by security researchers, what gives you any confidence that random software like JoesCoolLoggingLibrary is reviewed with any more scrutiny? Speaking of logging, Log4shell is yet another example. The most ubiquitous libraries in use. Used everywhere by some of the largest tech companies in the world, that all have the largest and most well-budgeted security organizations. The vulnerability was present in code for years, available for anyone in the world to look at, and yet...? Instead, there is evidence that Log4shell was being exploited by black hats before any white hats discovered it. >You're arguing that 99 white hats don't trump black-vs-white. No, they're arguing that there is no guarantee that these 99 white hats are somehow better than the 1000 black hats, and I'd add to it that there is also no guarantee that these 99 white hats magically appear, anyway. In fact, I think a more realistic visualization for most software is: - Closed source: -- Pros: 1 well paid white hat can easily inspect the source -- Cons: 1000 hackers can blackbox-attack the application - Open source: -- Pros: 1-2 unpaid volunteer white hats might inspect the source if they have time -- Cons: 1000 black hats can whitebox-attack the application As a security engineer, I know which one I feel more comfortable with.