9 ms·

This is the kind of issue that causes all that government bloat... If I was a state employee and I wrote the app, and I had to release the source code, then I'

This is the kind of issue that causes all that government bloat... If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens. One might respond: "Well software shouldn't have those holes! Just because it's closed source, doesn't mean that won't happen anyway Also true, in an ideal world, the software should be free from such vulnerabilities. However security by obscurity is a layer of defense... And there might be other controls in place too to help.. e.g. a git repo behind SSO... If I accidentally check in a CSV of a data dump, or my access Keys, etc... It doesn't immediately become a data leak/issue.. I have at least some time to reconcile that.. but if the repo is publicly accessible, the moment it hits the wire someone can copy that data... One might follow up: "Well, they should not make the code if they are not competent enough to write it and host it" Would be nice as well! But sadly there is only so many developers that can do this kind of work with a very high level of security and competence... By requiring governments to make this code freely available, you could basically assume two outcomes: nothing the government has on you will be secret, including sealed records and private information. In addition, IT workers would be paid 7-figures with 5-10 years of experience, as every government project that touches software now needs 5+ highly trained workers to avoid gigantic lawsuits.. and no one could get an entry level job in government because one bad commit could cause an 8-figure lawsuit And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-)

UncleEntity 4y ago
> And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-) If they give you a tank they have one less tank to do stuff with but if they give you a copy of software they still have the ability to do stuff with the software. There’s a whole bunch of software out there that has been open sourced by government agencies like nasa and you don’t see satellites falling out of the sky on a regular basis.
- gehwartzen 4y ago
  I'm not in software so maybe my viewpoint is just different but I also wouldn't expect NASA to give me the mechanical blueprints for a rocket, or even a concrete launch pad nor would I expect the local government to give me the the electrical schematics for the stop light systems, even though doing so would in no way prevent them from continuing to use these systems/items
  - munk-a 4y ago
    Honestly, why not? It's quite likely there has been a decent amount of information passing back and forth between NASA and various private space companies - there isn't a sane reason to require everyone to make the same mistakes that you've already learned from. Additionally while releasing rocket specifications probably won't result in any at-scale replicas it's a good way to feed the hobbiest community and possibly get some neat ideas back. There are some components of rocketry that deserve careful consideration in sharing (i.e. rocket fuels) but a lot of those have mostly leaked at this point and the government has other reasons to limit their production and thus limits the supply of chemical components. Much like with software there are going to be some secret components related to communication and the like - but those can be cherry picked from the information and deliberately hidden... similar to how most software teams don't check all their private SSH keys into public repos (usually).
    - gehwartzen 4y ago
      I agree with you and would love more "real world" things to be open source. I do like the ethos within software/tech that things are open-sourced often. It doesn't exist to nearly the same degree in many other "physical world" type industries. I think government/ bureaucracy moves slowly and most people working within them don't come from a software background so a lot of the older norms of not sharing things (outside of things like data/documents) is just the way things are done. I expect to a lot of these people sharing a source code is treated exactly the same as sharing any other mechanical designs which they just often don't do. Hopefully both things will change.
  - 4y ago
6510 4y ago
> However security by obscurity is a layer of defense... In your example it would be the layer of defense. But then we still have to wonder who is the attacker? The assumption made on the web page is that the developer is the attacker. The obscurity then becomes a major issue rather than the defense. Yes, we will have to pay what it costs and we will have to add extra developers. We all know the difference? I could write any government app or software but it would be a slow process, it would be hostile to further development and the security of it would be laughable. But from the GUI you wouldn't notice the difference. Mine might actually be nicer.
- deleted 4y ago
  [deleted]
- ldoughty 4y ago
  I didn't explain possible attack vectors because it depends what the vulnerable code exploit does.. does it dump ENVs, and you have a secret there? Does it leak DB credentials? If it's infrastructure code, does it tell someone what IP addresses can attempt SSH? I hoped by saying "a layer of defense" indicated that there was more layers
  - 6510 4y ago
    The developer is the attack vector. We give him some hand money, put a gun to his head and instruct him to make a backdoor.
Kinrany 4y ago
The price increase required by the higher quality of software is roughly a fixed factor. The benefits that come from code reuse are exponential. If a government can't afford to release the sources in public right away, a gradual transition is possible: vendors that offer open source software have their prices multiplied by 0.1 during bidding. And this factor of preference for open source can be increased or decreased state-wide depending on the budget.
fsflover 4y ago
> However security by obscurity is a layer of defense... It's not: https://en.wikipedia.org/wiki/Security_through_obscurity#Criticism https://en.wikipedia.org/wiki/Security_through_obscurity#Cri.... See also: https://en.wikipedia.org/wiki/Kerckhoffs's_principle https://en.wikipedia.org/wiki/Kerckhoffs's_principle.
- xboxnolifes 4y ago
  > Security by obscurity alone is discouraged and not recommended by standards bodies A layer, not the only layer. > System security should not depend on the secrecy of the implementation or its components. It is not depending on it. It is just an additional layer to delay or reduce impact.
  - InvertedRhodium 4y ago
    This was the proposed scenario that the GP put forward: > If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens. Which doesn't seem to suggest any mitigation other than the lack of published source code.
    - ldoughty 4y ago
      My post was already very long, didn't want to tangent into possible defenses which depend heavily on what exactly is in the code base... Using log4jail as a recent example, I had a code base vulnerable to this attack, but it would not be expected that the application used a vulnerable version (we forked the popular code base), and it only was vulnerable in a specific way (which, to this day, no one has attempted to explot, as I have an alarm set up if that kind of input comes in in logs, and previously had the block at the WAF when we were vulnerable for the 4 hours it took to fix the issue. Security by obscurity is not I good defense, it's a single layer, which buys you time. You need to have multiple layers of defense, and closed source might buy your team time to fix issues.. or make it viable to release the application while a third party takes a year on a security audit.
atx42 4y ago
I find it bizarre that anyone familiar with software development would think this is a good idea. I mean if gov't creates a useful API (eg. weather), or creates some reusable useful module (eg. something like hibernate), that would be nice. But, just generally publishing everything? REALLY BAD IDEA.
- datavirtue 4y ago
  Sort of like too much information being "dangerous" and leading believers astray?
deleted 4y ago
[deleted]
dragonwriter 4y ago
> If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens. I have spent a lot of time in public sector IT and I’ve rarely seen a management or information security team that didn't subscribe to this kind of security through obscurity thinking for internal code, including the management teams that were completely behind using open source code for cost, robustness, and avoiding vendor risk.
quanticle 4y ago
I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens So that's why no governments run Linux servers, right? After all, the Linux kernel is open source. And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-) And just to throw in some silly pedantry, the M109 is a self-propelled howitzer, not a tank. :)

UncleEntity 4y ago

> And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-) If they give you a tank they have one less tank to do stuff with but if they give you a copy of software they still have the ability to do stuff with the software. There’s a whole bunch of software out there that has been open sourced by government agencies like nasa and you don’t see satellites falling out of the sky on a regular basis.

gehwartzen 4y ago
I'm not in software so maybe my viewpoint is just different but I also wouldn't expect NASA to give me the mechanical blueprints for a rocket, or even a concrete launch pad nor would I expect the local government to give me the the electrical schematics for the stop light systems, even though doing so would in no way prevent them from continuing to use these systems/items
- munk-a 4y ago
  Honestly, why not? It's quite likely there has been a decent amount of information passing back and forth between NASA and various private space companies - there isn't a sane reason to require everyone to make the same mistakes that you've already learned from. Additionally while releasing rocket specifications probably won't result in any at-scale replicas it's a good way to feed the hobbiest community and possibly get some neat ideas back. There are some components of rocketry that deserve careful consideration in sharing (i.e. rocket fuels) but a lot of those have mostly leaked at this point and the government has other reasons to limit their production and thus limits the supply of chemical components. Much like with software there are going to be some secret components related to communication and the like - but those can be cherry picked from the information and deliberately hidden... similar to how most software teams don't check all their private SSH keys into public repos (usually).
  - gehwartzen 4y ago
    I agree with you and would love more "real world" things to be open source. I do like the ethos within software/tech that things are open-sourced often. It doesn't exist to nearly the same degree in many other "physical world" type industries. I think government/ bureaucracy moves slowly and most people working within them don't come from a software background so a lot of the older norms of not sharing things (outside of things like data/documents) is just the way things are done. I expect to a lot of these people sharing a source code is treated exactly the same as sharing any other mechanical designs which they just often don't do. Hopefully both things will change.
- 4y ago

6510 4y ago

> However security by obscurity is a layer of defense... In your example it would be the layer of defense. But then we still have to wonder who is the attacker? The assumption made on the web page is that the developer is the attacker. The obscurity then becomes a major issue rather than the defense. Yes, we will have to pay what it costs and we will have to add extra developers. We all know the difference? I could write any government app or software but it would be a slow process, it would be hostile to further development and the security of it would be laughable. But from the GUI you wouldn't notice the difference. Mine might actually be nicer.

deleted 4y ago
[deleted]
ldoughty 4y ago
I didn't explain possible attack vectors because it depends what the vulnerable code exploit does.. does it dump ENVs, and you have a secret there? Does it leak DB credentials? If it's infrastructure code, does it tell someone what IP addresses can attempt SSH? I hoped by saying "a layer of defense" indicated that there was more layers
- 6510 4y ago
  The developer is the attack vector. We give him some hand money, put a gun to his head and instruct him to make a backdoor.

Kinrany 4y ago

The price increase required by the higher quality of software is roughly a fixed factor. The benefits that come from code reuse are exponential. If a government can't afford to release the sources in public right away, a gradual transition is possible: vendors that offer open source software have their prices multiplied by 0.1 during bidding. And this factor of preference for open source can be increased or decreased state-wide depending on the budget.

fsflover 4y ago

> However security by obscurity is a layer of defense... It's not: https://en.wikipedia.org/wiki/Security_through_obscurity#Criticism https://en.wikipedia.org/wiki/Security_through_obscurity#Cri.... See also: https://en.wikipedia.org/wiki/Kerckhoffs's_principle https://en.wikipedia.org/wiki/Kerckhoffs's_principle.

xboxnolifes 4y ago
> Security by obscurity alone is discouraged and not recommended by standards bodies A layer, not the only layer. > System security should not depend on the secrecy of the implementation or its components. It is not depending on it. It is just an additional layer to delay or reduce impact.
- InvertedRhodium 4y ago
  This was the proposed scenario that the GP put forward: > If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens. Which doesn't seem to suggest any mitigation other than the lack of published source code.
  - ldoughty 4y ago
    My post was already very long, didn't want to tangent into possible defenses which depend heavily on what exactly is in the code base... Using log4jail as a recent example, I had a code base vulnerable to this attack, but it would not be expected that the application used a vulnerable version (we forked the popular code base), and it only was vulnerable in a specific way (which, to this day, no one has attempted to explot, as I have an alarm set up if that kind of input comes in in logs, and previously had the block at the WAF when we were vulnerable for the 4 hours it took to fix the issue. Security by obscurity is not I good defense, it's a single layer, which buys you time. You need to have multiple layers of defense, and closed source might buy your team time to fix issues.. or make it viable to release the application while a third party takes a year on a security audit.

atx42 4y ago

I find it bizarre that anyone familiar with software development would think this is a good idea. I mean if gov't creates a useful API (eg. weather), or creates some reusable useful module (eg. something like hibernate), that would be nice. But, just generally publishing everything? REALLY BAD IDEA.

datavirtue 4y ago
Sort of like too much information being "dangerous" and leading believers astray?

deleted 4y ago

[deleted]

dragonwriter 4y ago

> If I was a state employee and I wrote the app, and I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens. I have spent a lot of time in public sector IT and I’ve rarely seen a management or information security team that didn't subscribe to this kind of security through obscurity thinking for internal code, including the management teams that were completely behind using open source code for cost, robustness, and avoiding vendor risk.

quanticle 4y ago

I had to release the source code, then I'm making it very easy for a bad actor to find a vulnerability and exploit it to leak the data of citizens So that's why no governments run Linux servers, right? After all, the Linux kernel is open source. And just to throw in a silly extrapolation... I would love an M109 Paladin tank... my tax dollars pay for them :-) And just to throw in some silly pedantry, the M109 is a self-propelled howitzer, not a tank. :)