4 ms·
An open-source project is actually worse for security because the attacker can just read your source and find the exploits. Assembly is a pain to understand ev
by MagicMoonlight 3y ago
An open-source project is actually worse for security because the attacker can just read your source and find the exploits.
Assembly is a pain to understand even with the latest disassemblers. Cut that out and you’re cutting out 90% of the work.
Now sure in theory having it open source means good people will find the exploit. But have you ever found an exploit and reported it? Of course not. Only attackers are motivated to put thousands of hours of work into looking for vulnerabilities. Unless you pay someone to actually put the same work in, it being open source is meaningless.
- basique 3y agoNot publishing source code demotivates the white hats and "good people" more than the bad actors, IMHO. There's a reason a lot of cryptography-related libraries have open/available source code > But have you ever found an exploit and reported it? Yes, actually. It was for a project I had already contributed to, so I was just reading source code and stumbled upon a somewhat critical bug. The main problem there was figuring out how to fix it without breaking API, really.