4 ms·

The fact you have access to the source code and CAN audit software and modify it (ie to remove trackers) makes it much more balanced relationship. Note you do

The fact you have access to the source code and CAN audit software and modify it (ie to remove trackers) makes it much more balanced relationship. Note you do not have to do it yourself you can rely on someone to do it for you (there is no monopoly here) If you use Oracle you have no choice you Have to trust Oracle - if you use PostgreSQL you can chose to choose to PostgreSQL Global development team or of many commercial and community vendors who provide PostgreSQL builds for you.

traceroute66 4y ago
> Note you do not have to do it yourself you can rely on someone to do it for you (there is no monopoly here) Which is why the "but but but you can access the source" argument the FOSS people put up is such bullshit. I mean: a) Let's be honest, with most FOSS projects, security is an afterthought, assuming it was ever thought of at all. Very few go to the extents of OpenBSD or, indeed, anywhere remotely near it. Most don't even have any security bods on the team to start with. b) If you're relying on someone else to audit it, then its no different to employing someone to blackbox fuzz test some closed source software and attach some monitors to your network to watch for undocumented exfiltration. c) If you're relying on someone else to audit it, then that "someone else" with sufficient skills will come with $$$ attached. d) If you're reviewing it yourself, assuming you can speak the relevant programming language in the first place, there are few people who can speak a programming language well enough for the purposes of security auditing. e) If you're relying on "the community" to review it, then well, we all know how your average open source community is ... lots of infighting, lots of egos amongst the core maintainers, and occasionally some work gets done in the middle. Don't get me wrong, I'm not suggesting closed-source is some panacea. But I am also equally enlightened enough to know that FOSS is not the panacea either. Both have their strengths, both have their weaknesses. And certainly in terms of code security, neither is perfect by any means.
- _Algernon_ 4y ago
  Most, if not all, closed source software builds on open source software at this point, if not directly then at least in the tooling around the development process (compilers/interpreters, version control, build systems, etc.). I doubt that most developers of closed source software have audited their entire tech stack. So in the end you have all the same problems with proprietary software as you describe for foss, but you don't even have the opportunity to audit the source code yourself, should you want to.

traceroute66 4y ago

> Note you do not have to do it yourself you can rely on someone to do it for you (there is no monopoly here) Which is why the "but but but you can access the source" argument the FOSS people put up is such bullshit. I mean: a) Let's be honest, with most FOSS projects, security is an afterthought, assuming it was ever thought of at all. Very few go to the extents of OpenBSD or, indeed, anywhere remotely near it. Most don't even have any security bods on the team to start with. b) If you're relying on someone else to audit it, then its no different to employing someone to blackbox fuzz test some closed source software and attach some monitors to your network to watch for undocumented exfiltration. c) If you're relying on someone else to audit it, then that "someone else" with sufficient skills will come with $$$ attached. d) If you're reviewing it yourself, assuming you can speak the relevant programming language in the first place, there are few people who can speak a programming language well enough for the purposes of security auditing. e) If you're relying on "the community" to review it, then well, we all know how your average open source community is ... lots of infighting, lots of egos amongst the core maintainers, and occasionally some work gets done in the middle. Don't get me wrong, I'm not suggesting closed-source is some panacea. But I am also equally enlightened enough to know that FOSS is not the panacea either. Both have their strengths, both have their weaknesses. And certainly in terms of code security, neither is perfect by any means.

_Algernon_ 4y ago
Most, if not all, closed source software builds on open source software at this point, if not directly then at least in the tooling around the development process (compilers/interpreters, version control, build systems, etc.). I doubt that most developers of closed source software have audited their entire tech stack. So in the end you have all the same problems with proprietary software as you describe for foss, but you don't even have the opportunity to audit the source code yourself, should you want to.