4 ms·

> Open-sourcing code will make Twitter vulnerable and easy to be exploited by hackers. Is this how people generally think about open source code security? IME,

> Open-sourcing code will make Twitter vulnerable and easy to be exploited by hackers. Is this how people generally think about open source code security? IME, if your code is correctly written, it makes no difference whatsover whether an attacker has access to it. Consider that fact that Linux is open source, and every line change is heavily debated and described in the open. But the huge majority of internet facing machines all run that code. Linux is arguably better to run on an open server than any proprietary offerings.

Shared404 4y ago
I think the argument here is that code originated in the open is expected to be correct, or be corrected. Meanwhile, code written behind closed doors may rely on security by obscurity more than it should - especially in the cases of violation detection/spam/similar cases. I don't know that I agree with this argument, but it's plausible.
- Gigachad 4y ago
  Anti abuse stuff relies on obscurity since it isn’t possible to make bullet proof bot detection.
  - Shared404 4y ago
    Anti-abuse definitely has by far the strongest argument there. My position (on anti-abuse specifically) is that the pros may still outweigh the cons, but that there are very real and sizable cons to everyone if you open source it (as opposed to most software, where the cons are far more likely to be born by the company). Maybe there's a best of both worlds where companies settle on the same open core but do their own modifications and fine tuning.
lapcat 4y ago
Moderation is not the same thing as security. Is there such a thing as "correctly written" code for moderation? Twitter automated moderation seems to be just pattern matching that needs to be later evaluated by a human... though it's not clear that Twitter actually bothers to have a human look at it. This is especially true for spam bot detection. Bots don't need a "bug" in the code in order to "exploit" Twitter. A bot just needs to be not labeled by Twitter as a bot. So the goal wouldn't be to find a bug in Twitter's open source code but rather just see how Twitter decides what is a bot and what is a human, and then make the bot slightly more human-like. But nobody in the world has a "correct" test to decide what's a human.

Shared404 4y ago

I think the argument here is that code originated in the open is expected to be correct, or be corrected. Meanwhile, code written behind closed doors may rely on security by obscurity more than it should - especially in the cases of violation detection/spam/similar cases. I don't know that I agree with this argument, but it's plausible.

Gigachad 4y ago
Anti abuse stuff relies on obscurity since it isn’t possible to make bullet proof bot detection.
- Shared404 4y ago
  Anti-abuse definitely has by far the strongest argument there. My position (on anti-abuse specifically) is that the pros may still outweigh the cons, but that there are very real and sizable cons to everyone if you open source it (as opposed to most software, where the cons are far more likely to be born by the company). Maybe there's a best of both worlds where companies settle on the same open core but do their own modifications and fine tuning.

lapcat 4y ago

Moderation is not the same thing as security. Is there such a thing as "correctly written" code for moderation? Twitter automated moderation seems to be just pattern matching that needs to be later evaluated by a human... though it's not clear that Twitter actually bothers to have a human look at it. This is especially true for spam bot detection. Bots don't need a "bug" in the code in order to "exploit" Twitter. A bot just needs to be not labeled by Twitter as a bot. So the goal wouldn't be to find a bug in Twitter's open source code but rather just see how Twitter decides what is a bot and what is a human, and then make the bot slightly more human-like. But nobody in the world has a "correct" test to decide what's a human.