3 ms·

There are valid reasons not to release the source code that have nothing to do with “security by obscurity”: legal, various notions of “control”, and more

• harperlee 4y ago
  And I’d add that security by obscurity is also a valid reason. It’s bad as a standalone strategy, but good as a complementary strategy. Related: https://news.ycombinator.com/item?id=24444497 https://news.ycombinator.com/item?id=24444497
  • xpe 4y ago
    Nubank’s goal to keep the Datomic source code private remains secret is based primarily on IP law and internal security controls (on employees, contractors, and possibly obfuscating compilation). Disagree?
    • deleted 4y ago
      [deleted]
    • harperlee 4y ago
      > Disagree? No idea! Just speculating…
  • xpe 4y ago
    > And I’d add that security by obscurity is also a valid reason. It’s bad as a standalone strategy, but good as a complementary strategy. As the thread you link mentions, the phrase “security by obscurity” historically means (more of less) “security primarily by obscurity”. But sometimes this point gets lost. The thread you mention is interesting. Wikipedia: > Security through obscurity (or security by obscurity) is the reliance in security engineering on design or implementation secrecy as the main method of providing security to a system or component. Summary: Layers of security (which can include a wide range of techniques, including obfuscation, etc): useful, because delaying attacks and/or making them less likely is useful. Obscurity as a main method: theatre, because it often leads to self-deception about the true risks involved
    • harperlee 4y ago
      Sorry, we’re both editing at the same time :) I added a related link to the parent comment.
      • xpe 4y ago
        Yep :) That’s a great thread, thank you!