4 ms·

security by obscurity is no security. Either it is secure by design and nothing security critical can be learned from looking at the source code, or any vulner

security by obscurity is no security. Either it is secure by design and nothing security critical can be learned from looking at the source code, or any vulnerabilities will only be known and available to groups willing to decompile it - which, btw, is usually only the bad actors.

mulmen 4y ago
This isn’t security by obscurity and that’s not how vulnerabilities work. There's no such thing as "secure by design" unless you make pies by first inventing the universe. Last time I checked all our hardware is proprietary. I certainly don't write all my compilers personally. The "design" of open software is that we accept what others have done, and the value comes from our inability to audit all of it. If we could, it wouldn't need to be open. We could just write it all ourselves, perfectly. In theory. Linus’ law assumes someone actually looks. With closed software people are paid to look. With free (as in beer) software nobody is incentivized to look. In this way the openness of software doesn’t incentivize security, even if it is morally superior.
- DarkmSparks 4y ago
  I was responding specifically to: >closed software may be more secure by nature of There is simply no security benefit offered by requiring access and knowledge of decompilers and reverse engineering to see the source code and recompile the software, and numerous security disadvantages.
  - mulmen 4y ago
    You are replying to a small part of one sentence? In context I am clearly not saying what you suggest. The very next words are “assigning eyes to the critical components”. The benefit of closed software in this context is that someone is paid to look. That’s not unique to closed software but having someone look isn’t guaranteed with open software either.
    - DarkmSparks 4y ago
      That would only be a benefit if it was impossible for open source software to have people paid to look....
- MereInterest 4y ago
  > With closed software people are paid to look. Or they are paid to look the other way. Or it’s just not in the budget this year. > With free (as in beer) software nobody is incentivized to look. Only in the sense that there is no external incentive to look. Users of the open source library, however, have an intrinsic incentive not to open themselves up to vulnerability. For example, companies paying for audits for libraries they use, where the audit is cheaper than reproducing the library in total. Making code doesn’t change that incentive. It just prevents people from acting according to it.

mulmen 4y ago

This isn’t security by obscurity and that’s not how vulnerabilities work. There's no such thing as "secure by design" unless you make pies by first inventing the universe. Last time I checked all our hardware is proprietary. I certainly don't write all my compilers personally. The "design" of open software is that we accept what others have done, and the value comes from our inability to audit all of it. If we could, it wouldn't need to be open. We could just write it all ourselves, perfectly. In theory. Linus’ law assumes someone actually looks. With closed software people are paid to look. With free (as in beer) software nobody is incentivized to look. In this way the openness of software doesn’t incentivize security, even if it is morally superior.

DarkmSparks 4y ago
I was responding specifically to: >closed software may be more secure by nature of There is simply no security benefit offered by requiring access and knowledge of decompilers and reverse engineering to see the source code and recompile the software, and numerous security disadvantages.
- mulmen 4y ago
  You are replying to a small part of one sentence? In context I am clearly not saying what you suggest. The very next words are “assigning eyes to the critical components”. The benefit of closed software in this context is that someone is paid to look. That’s not unique to closed software but having someone look isn’t guaranteed with open software either.
  - DarkmSparks 4y ago
    That would only be a benefit if it was impossible for open source software to have people paid to look....
MereInterest 4y ago
> With closed software people are paid to look. Or they are paid to look the other way. Or it’s just not in the budget this year. > With free (as in beer) software nobody is incentivized to look. Only in the sense that there is no external incentive to look. Users of the open source library, however, have an intrinsic incentive not to open themselves up to vulnerability. For example, companies paying for audits for libraries they use, where the audit is cheaper than reproducing the library in total. Making code doesn’t change that incentive. It just prevents people from acting according to it.