4 ms·

> if like me, you think the pro out weighs the con. My point is very simply that in my opinion that you're wrong to think this, and that opinion is shared by m

> if like me, you think the pro out weighs the con. My point is very simply that in my opinion that you're wrong to think this, and that opinion is shared by most of the security community. There is ample evidence that the cons FAR outweigh the pros in this particular comparison. --- Another way to visualize your comparison would be: - Closed source: -- Pros: 1 white hat can easily inspect the source -- Cons: 1000 hackers can blackbox-attack the application - Open source: -- Pros: 100 white hats can easily fix the source -- Cons: 1000 black hats can whitebox-attack the application You're arguing that 99 white hats don't trump black-vs-white. --- Even if I play devil's semi-advocate here and consider that the pros balance the cons, the statement in the article is still wildly out of place in that context.

jktogjfnn 5y ago
Why doesn't the NSA/FSB/... open source their crypto systems then so that people can search for flaws? And there would be interest, imagine the street cred...
- lucideer 5y ago
  Not too sure about the NSA - I know they subcontract a lot, so may be harder to weed out. GCHQ have some fascinating stuff out there though https://github.com/gchq/CyberChef/blob/master/src/core/operations/Numberwang.mjs https://github.com/gchq/CyberChef/blob/master/src/core/opera...
- kittywav 5y ago
  They generally do open source their crypto systems (at least the algorithms themselves), given that that is practically a requirement for any crypto system to be adopted in a widespread way (no one who is serious about security is going to use home-baked closed-source cryptosystems). Examples: https://en.wikipedia.org/wiki/Speck_(cipher) https://en.wikipedia.org/wiki/Speck_(cipher) and https://en.wikipedia.org/wiki/Simon_%28cipher%29 https://en.wikipedia.org/wiki/Simon_%28cipher%29 and https://en.wikipedia.org/wiki/GOST_(block_cipher) https://en.wikipedia.org/wiki/GOST_(block_cipher)
Ensorceled 5y ago
Again, you are COMPLETELY missing my point and also putting me on the wrong side of this argument. I AGREE open source is usually safer. In fact you QUOTE me saying that ("if like me, you think the pro out weighs the con") and then say that I'm "wrong". What I'm saying is you HAVE TO DO THE ANALYSIS, which you then went and did. You can't just delete the cons and say they don't exist YOU HAVE TO DO THE ANALYSIS. In your analysis there is the assumption that there is "100 white hats" looking that the code ... which isn't always true. How would your analysis change then? You WON'T KNOW if you just deleted that "con" from your risk analysis "because open source".
netwo233gur 5y ago
>you're wrong to think this Security engineer here. No they aren't. I'd say they are being a much more comprehensive in their security analysis by including the cons in their calculation rather than dismissing them and assuming that the pros outweigh them. >opinion is shared by most of the security community. No it isn't. Security by obscurity is a very valid defense-in-depth measure. There's a reason you disable "debug-level logging" on production webservers. >There is ample evidence that the cons FAR outweigh the pros in this particular comparison. Show said evidence, please, because there is ample evidence that open source software magically being reviewed by hordes of people is many times a myth. Heartbleed was caused because pretty much nobody cared to look at openssl's code and review it for vulnerabilities. Just because it is available to be looked at by white hats doesn't mean anyone actually is looking at it. And if something so critical to security like openssl isn't even being reviewed by security researchers, what gives you any confidence that random software like JoesCoolLoggingLibrary is reviewed with any more scrutiny? Speaking of logging, Log4shell is yet another example. The most ubiquitous libraries in use. Used everywhere by some of the largest tech companies in the world, that all have the largest and most well-budgeted security organizations. The vulnerability was present in code for years, available for anyone in the world to look at, and yet...? Instead, there is evidence that Log4shell was being exploited by black hats before any white hats discovered it. >You're arguing that 99 white hats don't trump black-vs-white. No, they're arguing that there is no guarantee that these 99 white hats are somehow better than the 1000 black hats, and I'd add to it that there is also no guarantee that these 99 white hats magically appear, anyway. In fact, I think a more realistic visualization for most software is: - Closed source: -- Pros: 1 well paid white hat can easily inspect the source -- Cons: 1000 hackers can blackbox-attack the application - Open source: -- Pros: 1-2 unpaid volunteer white hats might inspect the source if they have time -- Cons: 1000 black hats can whitebox-attack the application As a security engineer, I know which one I feel more comfortable with.
- lmm 5y ago
  > Security by obscurity is a very valid defense-in-depth measure. No it isn't. The whole notion of "defense-in-depth" generally does more harm than good IME, as it creates confusion about where the actual security boundaries are. > Speaking of logging, Log4shell is yet another example. The most ubiquitous libraries in use. Used everywhere by some of the largest tech companies in the world, that all have the largest and most well-budgeted security organizations. log4j2 was widely disliked and rarely used, IME.

jktogjfnn 5y ago

Why doesn't the NSA/FSB/... open source their crypto systems then so that people can search for flaws? And there would be interest, imagine the street cred...

lucideer 5y ago
Not too sure about the NSA - I know they subcontract a lot, so may be harder to weed out. GCHQ have some fascinating stuff out there though https://github.com/gchq/CyberChef/blob/master/src/core/operations/Numberwang.mjs https://github.com/gchq/CyberChef/blob/master/src/core/opera...
kittywav 5y ago
They generally do open source their crypto systems (at least the algorithms themselves), given that that is practically a requirement for any crypto system to be adopted in a widespread way (no one who is serious about security is going to use home-baked closed-source cryptosystems). Examples: https://en.wikipedia.org/wiki/Speck_(cipher) https://en.wikipedia.org/wiki/Speck_(cipher) and https://en.wikipedia.org/wiki/Simon_%28cipher%29 https://en.wikipedia.org/wiki/Simon_%28cipher%29 and https://en.wikipedia.org/wiki/GOST_(block_cipher) https://en.wikipedia.org/wiki/GOST_(block_cipher)

Ensorceled 5y ago

Again, you are COMPLETELY missing my point and also putting me on the wrong side of this argument. I AGREE open source is usually safer. In fact you QUOTE me saying that ("if like me, you think the pro out weighs the con") and then say that I'm "wrong". What I'm saying is you HAVE TO DO THE ANALYSIS, which you then went and did. You can't just delete the cons and say they don't exist YOU HAVE TO DO THE ANALYSIS. In your analysis there is the assumption that there is "100 white hats" looking that the code ... which isn't always true. How would your analysis change then? You WON'T KNOW if you just deleted that "con" from your risk analysis "because open source".

netwo233gur 5y ago

>you're wrong to think this Security engineer here. No they aren't. I'd say they are being a much more comprehensive in their security analysis by including the cons in their calculation rather than dismissing them and assuming that the pros outweigh them. >opinion is shared by most of the security community. No it isn't. Security by obscurity is a very valid defense-in-depth measure. There's a reason you disable "debug-level logging" on production webservers. >There is ample evidence that the cons FAR outweigh the pros in this particular comparison. Show said evidence, please, because there is ample evidence that open source software magically being reviewed by hordes of people is many times a myth. Heartbleed was caused because pretty much nobody cared to look at openssl's code and review it for vulnerabilities. Just because it is available to be looked at by white hats doesn't mean anyone actually is looking at it. And if something so critical to security like openssl isn't even being reviewed by security researchers, what gives you any confidence that random software like JoesCoolLoggingLibrary is reviewed with any more scrutiny? Speaking of logging, Log4shell is yet another example. The most ubiquitous libraries in use. Used everywhere by some of the largest tech companies in the world, that all have the largest and most well-budgeted security organizations. The vulnerability was present in code for years, available for anyone in the world to look at, and yet...? Instead, there is evidence that Log4shell was being exploited by black hats before any white hats discovered it. >You're arguing that 99 white hats don't trump black-vs-white. No, they're arguing that there is no guarantee that these 99 white hats are somehow better than the 1000 black hats, and I'd add to it that there is also no guarantee that these 99 white hats magically appear, anyway. In fact, I think a more realistic visualization for most software is: - Closed source: -- Pros: 1 well paid white hat can easily inspect the source -- Cons: 1000 hackers can blackbox-attack the application - Open source: -- Pros: 1-2 unpaid volunteer white hats might inspect the source if they have time -- Cons: 1000 black hats can whitebox-attack the application As a security engineer, I know which one I feel more comfortable with.

lmm 5y ago
> Security by obscurity is a very valid defense-in-depth measure. No it isn't. The whole notion of "defense-in-depth" generally does more harm than good IME, as it creates confusion about where the actual security boundaries are. > Speaking of logging, Log4shell is yet another example. The most ubiquitous libraries in use. Used everywhere by some of the largest tech companies in the world, that all have the largest and most well-budgeted security organizations. log4j2 was widely disliked and rarely used, IME.