5 ms·
It wouldn't happen if all it was open source to begin with.
by xvilka 4y ago
It wouldn't happen if all it was open source to begin with.
- mulmen 4y agoThat’s not how it works. Open source software has vulnerabilities all the time. The code being open just makes detection easier, or so the theory goes. It’s actually an open question. Linus’ law only applies to the number of eyes relative to lines of code. In a world where one unappreciated person in Nebraska owns a critical part of an open codebase, including dependencies, closed software may be more secure by nature of owning the supply chain and assigning eyes to the critical components.
- xvilka 4y ago> closed software may be more secure by nature of owning the supply chain and assigning eyes to the critical components. In theory, in practice it's not better, if not worse.
- mulmen 4y ago> In a world where one unappreciated person in Nebraska owns a critical part of an open codebase, including dependencies Is the portion of that sentence you didn’t quote. It changes the meaning significantly.
- fhars 4y agoThey are probably depending on the same person in Nebraska, though.
- deleted 4y ago[deleted]
- DarkmSparks 4y agosecurity by obscurity is no security. Either it is secure by design and nothing security critical can be learned from looking at the source code, or any vulnerabilities will only be known and available to groups willing to decompile it - which, btw, is usually only the bad actors.
- mulmen 4y agoThis isn’t security by obscurity and that’s not how vulnerabilities work. There's no such thing as "secure by design" unless you make pies by first inventing the universe. Last time I checked all our hardware is proprietary. I certainly don't write all my compilers personally. The "design" of open software is that we accept what others have done, and the value comes from our inability to audit all of it. If we could, it wouldn't need to be open. We could just write it all ourselves, perfectly. In theory. Linus’ law assumes someone actually looks. With closed software people are paid to look. With free (as in beer) software nobody is incentivized to look. In this way the openness of software doesn’t incentivize security, even if it is morally superior.
- DarkmSparks 4y agoI was responding specifically to: >closed software may be more secure by nature of There is simply no security benefit offered by requiring access and knowledge of decompilers and reverse engineering to see the source code and recompile the software, and numerous security disadvantages.
- mulmen 4y agoYou are replying to a small part of one sentence? In context I am clearly not saying what you suggest. The very next words are “assigning eyes to the critical components”. The benefit of closed software in this context is that someone is paid to look. That’s not unique to closed software but having someone look isn’t guaranteed with open software either.
- DarkmSparks 4y agoThat would only be a benefit if it was impossible for open source software to have people paid to look....
- MereInterest 4y ago> With closed software people are paid to look. Or they are paid to look the other way. Or it’s just not in the budget this year. > With free (as in beer) software nobody is incentivized to look. Only in the sense that there is no external incentive to look. Users of the open source library, however, have an intrinsic incentive not to open themselves up to vulnerability. For example, companies paying for audits for libraries they use, where the audit is cheaper than reproducing the library in total. Making code doesn’t change that incentive. It just prevents people from acting according to it.
- nailer 4y agoOne can assign eyes to critical components in open source. I think you’re equating non-open Source software with commercial software. There are many commercial open source projects.
- mulmen 4y agoExactly. The license isn't the motivator of eyeballs. Funding is. But the comment I replied to is literally: > It wouldn't happen if all it was open source to begin with. Which is untrue, given the existence of open source vulnerabilities.
- AshamedCaptain 4y agoHow on earth would a source leak happen if the source was open to begin with ?
- jacquesm 4y agoWhat does 'Nebraska' add here?