3 ms·

> In closed-source designs, the lack of access to information acts as a barrier for adversaries ROFL. Acts as a barrier for script kiddies, until the tool is r

> In closed-source designs, the lack of access to information acts as a barrier for adversaries ROFL. Acts as a barrier for script kiddies, until the tool is released on Reddit, then you're just screwt.

cassonmars 3y ago
They further elaborate that security by obscurity is a poor approach though
- galangalalgol 3y ago
  We see time and again that more eyes on open source doesn't count for a ton either. We had a relatively simple use after free in the kernel just a couple months ago that had been there for a long time. The benefit of open source is that we could demand and verify good testing and analysis for foundational bits of code, but we don't.
  - deleted 3y ago
    [deleted]
  - doesnt_know 3y ago
    > we could demand and verify good testing and analysis for foundational bits of code, but we don't. Who would you take these demands to? Most foss software is written and managed by volunteer maintainers, if you start demanding things from them they will rightfully tell you to jog on. Even when they are not volunteers, they are likely employees of companies that fund this development largely because they require and rely on the software. In which case, they likely have priorities set that are aligned with that company and the needs of other users are low priority at best, but more likely largely irreverent.
    - galangalalgol 3y ago
      The people who donthe testing and analysis don't have to be the authors. If I do something for fun, and a faang makes a double digit percentage of the world gdp depend on it's security, then I would hope we demand the company who benefits ensure that security in an open way or choose other software. But that would cost more.
halayli 3y ago
> RISC-V benefits from a lack of obscurity in this sense since there is more visibility into the system design, resulting in more known and addressed vulnerabilities and hence a more robust system.
ngneer 3y ago
Ditto. What a terrible statement to open with. Not instilling me with a lot of confidence. Shannon's Maxim states that the enemy knows the system...
userbinator 3y ago
As the cracking and modding scene says: "Source code? We don't need no stinkin' source code!"
deleted 3y ago
[deleted]

cassonmars 3y ago

They further elaborate that security by obscurity is a poor approach though

galangalalgol 3y ago
We see time and again that more eyes on open source doesn't count for a ton either. We had a relatively simple use after free in the kernel just a couple months ago that had been there for a long time. The benefit of open source is that we could demand and verify good testing and analysis for foundational bits of code, but we don't.
- deleted 3y ago
  [deleted]
- doesnt_know 3y ago
  > we could demand and verify good testing and analysis for foundational bits of code, but we don't. Who would you take these demands to? Most foss software is written and managed by volunteer maintainers, if you start demanding things from them they will rightfully tell you to jog on. Even when they are not volunteers, they are likely employees of companies that fund this development largely because they require and rely on the software. In which case, they likely have priorities set that are aligned with that company and the needs of other users are low priority at best, but more likely largely irreverent.
  - galangalalgol 3y ago
    The people who donthe testing and analysis don't have to be the authors. If I do something for fun, and a faang makes a double digit percentage of the world gdp depend on it's security, then I would hope we demand the company who benefits ensure that security in an open way or choose other software. But that would cost more.

halayli 3y ago

> RISC-V benefits from a lack of obscurity in this sense since there is more visibility into the system design, resulting in more known and addressed vulnerabilities and hence a more robust system.

ngneer 3y ago

Ditto. What a terrible statement to open with. Not instilling me with a lot of confidence. Shannon's Maxim states that the enemy knows the system...

userbinator 3y ago

As the cracking and modding scene says: "Source code? We don't need no stinkin' source code!"

deleted 3y ago

[deleted]