3 ms·

The interesting thing in this argument is that the first person is positing axiomatically that closed source is more secure, the second person is positing that

The interesting thing in this argument is that the first person is positing axiomatically that closed source is more secure, the second person is positing that open/closed largely doesn’t matter and finally your position axiomatically is that open is more secured. We’ve known since the 70s that you (provably) can’t trust source code. We know experientially that it’s easier to diagnose code than programs. We also know experientially that the teams involved have a dramatic effect on the security of the outcomes. How will we ever decide which of our three contestants will win?

benatkin 5y ago
Not quite. tptacek says "Most people would say that reducing the threshold to discover security bugs is a good thing." I think that restating what tptacek said earlier, "mostly orthoganal", to "largely doesn't matter", loses some of the meaning. One way of seeing it is that it's mostly orthaganal at a level of all software out there, but that for those who make a serious effort to be secure, there is a lot of benefit to being open source. There's Linus's Law, "given enough eyeballs, all bugs are shallow". I think if the maintainers of Linux didn't meaningfully address security concerns, it would just mean they were doing a bit better at whack-a-mole. You see this in popular open source projects like WordPress. So I think that's why a reader might think tptacek's two comments don't jibe with each other. If you are given a choice between an open source and a closed source application, you wouldn't just assume one is more secure than another. However, if you were starting off to make a secure system, it would be a good idea to make it open source.