5 ms·

It seems that they give the binaries for free but they won't release the source code. Can somebody explain to me what's the point of keeping the source closed i

It seems that they give the binaries for free but they won't release the source code. Can somebody explain to me what's the point of keeping the source closed in this case? I really can't think of any reason

harperlee 3y ago
Perhaps security by obscurity, it being now a proprietary component of a bank?
- xpe 3y ago
  There are valid reasons not to release the source code that have nothing to do with “security by obscurity”: legal, various notions of “control”, and more
  - harperlee 3y ago
    And I’d add that security by obscurity is also a valid reason. It’s bad as a standalone strategy, but good as a complementary strategy. Related: https://news.ycombinator.com/item?id=24444497 https://news.ycombinator.com/item?id=24444497
    - xpe 3y ago
      Nubank’s goal to keep the Datomic source code private remains secret is based primarily on IP law and internal security controls (on employees, contractors, and possibly obfuscating compilation). Disagree?
      - deleted 3y ago
        [deleted]
      - harperlee 3y ago
        > Disagree? No idea! Just speculating…
    - xpe 3y ago
      > And I’d add that security by obscurity is also a valid reason. It’s bad as a standalone strategy, but good as a complementary strategy. As the thread you link mentions, the phrase “security by obscurity” historically means (more of less) “security primarily by obscurity”. But sometimes this point gets lost. The thread you mention is interesting. Wikipedia: > Security through obscurity (or security by obscurity) is the reliance in security engineering on design or implementation secrecy as the main method of providing security to a system or component. Summary: Layers of security (which can include a wide range of techniques, including obfuscation, etc): useful, because delaying attacks and/or making them less likely is useful. Obscurity as a main method: theatre, because it often leads to self-deception about the true risks involved
      - harperlee 3y ago
        Sorry, we’re both editing at the same time :) I added a related link to the parent comment.
        xpe 3y ago
        Yep :) That’s a great thread, thank you!
stefncb 3y ago
Licensing issues, keeping the door open to making it not free again, greed, lack of understanding from management/lawyers/whatever, not wanting to deal with contributions (though here you can do what SQLite does), false sense of security, etc.
xpe 3y ago
> I really can't think of any reason What have you thought about or read so far?

harperlee 3y ago

Perhaps security by obscurity, it being now a proprietary component of a bank?

xpe 3y ago
There are valid reasons not to release the source code that have nothing to do with “security by obscurity”: legal, various notions of “control”, and more
- harperlee 3y ago
  And I’d add that security by obscurity is also a valid reason. It’s bad as a standalone strategy, but good as a complementary strategy. Related: https://news.ycombinator.com/item?id=24444497 https://news.ycombinator.com/item?id=24444497
  - xpe 3y ago
    Nubank’s goal to keep the Datomic source code private remains secret is based primarily on IP law and internal security controls (on employees, contractors, and possibly obfuscating compilation). Disagree?
    - deleted 3y ago
      [deleted]
    - harperlee 3y ago
      > Disagree? No idea! Just speculating…
  - xpe 3y ago
    > And I’d add that security by obscurity is also a valid reason. It’s bad as a standalone strategy, but good as a complementary strategy. As the thread you link mentions, the phrase “security by obscurity” historically means (more of less) “security primarily by obscurity”. But sometimes this point gets lost. The thread you mention is interesting. Wikipedia: > Security through obscurity (or security by obscurity) is the reliance in security engineering on design or implementation secrecy as the main method of providing security to a system or component. Summary: Layers of security (which can include a wide range of techniques, including obfuscation, etc): useful, because delaying attacks and/or making them less likely is useful. Obscurity as a main method: theatre, because it often leads to self-deception about the true risks involved
    - harperlee 3y ago
      Sorry, we’re both editing at the same time :) I added a related link to the parent comment.
      - xpe 3y ago
        Yep :) That’s a great thread, thank you!

stefncb 3y ago

Licensing issues, keeping the door open to making it not free again, greed, lack of understanding from management/lawyers/whatever, not wanting to deal with contributions (though here you can do what SQLite does), false sense of security, etc.

xpe 3y ago

> I really can't think of any reason What have you thought about or read so far?