4 ms·

On occasion, people make the same argument about all open source software, that making it public makes it insecure. Fortunately this has not turned out to be t

On occasion, people make the same argument about all open source software, that making it public makes it insecure. Fortunately this has not turned out to be the case in reality. If there are flaws in the system they will probably be easier to find and fix with more eyes on it.

airstrike 5y ago
The consumption of FOSS and the consumption of tweets are so different I don't really see the merit in comparing the two.
swores 5y ago
In open source development you're trying to prevent exploits from being possible as much as you can, and for anything new you have time to get multiple people thinking about it before a release goes live. In content moderation vs spammers, you have spammers adapting to your tools in real time while posting content in the same way real users do, and the balance between "don't want to accidentally ban real users (who post stuff very similar to the bots)" vs "does it matter if someone gets past your defences a few times an hour" is massively different too.
agentdrtran 5y ago
It's not about security bugs in this case, anti-spam needs obscurity as a layer of defense.
hooande 5y ago
This is a terrible comparison. With OSS people are looking for security flaws. With a twitter/google algorithm people are trying to exploit the system when it works as intended. If there is a secret formula for a successful tweet, people will find it and repeat that behavior ad nauseum. The problem with google search isn't that people are exploiting 0-days that the developers aren't aware of. The problem is that the majority of the internet is becoming nearly identical pages that do the bare minimum to get ranked by search engines. Making the algorithm public will only exacerbate that
- LightHugger 5y ago
  If there is a "secret formula" (exploit) then that is a flaw in the system that should be addressed, it will be discovered by the sufficiently motivated attackers, as it already is regularly. This is equivalent to security through obscurity, and it clearly is not working as you point out. You assert that more eyes on the flaws would make the issue worse rather than better, but i disagree.
falcolas 5y ago
The “many eyes” saying is a comfortably common, but untrue, saying. Were it true, heartbleed and its ilk would never have occurred, given how widely used and distributed it was.
slowmovintarget 5y ago
The ratio of risk and effort to payoff for gaming tweets vs. compromising operating systems is radically different. Further, compromise of one box typically does not render all of them running that OS useless and harmful.

airstrike 5y ago

The consumption of FOSS and the consumption of tweets are so different I don't really see the merit in comparing the two.

swores 5y ago

In open source development you're trying to prevent exploits from being possible as much as you can, and for anything new you have time to get multiple people thinking about it before a release goes live. In content moderation vs spammers, you have spammers adapting to your tools in real time while posting content in the same way real users do, and the balance between "don't want to accidentally ban real users (who post stuff very similar to the bots)" vs "does it matter if someone gets past your defences a few times an hour" is massively different too.

agentdrtran 5y ago

It's not about security bugs in this case, anti-spam needs obscurity as a layer of defense.

hooande 5y ago

This is a terrible comparison. With OSS people are looking for security flaws. With a twitter/google algorithm people are trying to exploit the system when it works as intended. If there is a secret formula for a successful tweet, people will find it and repeat that behavior ad nauseum. The problem with google search isn't that people are exploiting 0-days that the developers aren't aware of. The problem is that the majority of the internet is becoming nearly identical pages that do the bare minimum to get ranked by search engines. Making the algorithm public will only exacerbate that

LightHugger 5y ago
If there is a "secret formula" (exploit) then that is a flaw in the system that should be addressed, it will be discovered by the sufficiently motivated attackers, as it already is regularly. This is equivalent to security through obscurity, and it clearly is not working as you point out. You assert that more eyes on the flaws would make the issue worse rather than better, but i disagree.

falcolas 5y ago

The “many eyes” saying is a comfortably common, but untrue, saying. Were it true, heartbleed and its ilk would never have occurred, given how widely used and distributed it was.

slowmovintarget 5y ago

The ratio of risk and effort to payoff for gaming tweets vs. compromising operating systems is radically different. Further, compromise of one box typically does not render all of them running that OS useless and harmful.