4 ms·

Certainly. It’s not like giving them the source code would increase risk significantly, if the software is designed well. I think it would actually strengthen a

Certainly. It’s not like giving them the source code would increase risk significantly, if the software is designed well. I think it would actually strengthen as more researchers would study and submit contribs. I think Linux is as or more secure than windows and it’s open source. There’s tons of sensitive systems that are open source. It’s a design fallacy that security through obscurity is good.

gray_-_wolf 3y ago
> It’s not like giving them the source code would increase risk significantly I like free software a lot, and do not know much about weapon development, but would not the software reveal a lot about capabilities of the weapon platform? The argument to keep the software private might not be motivated just by attempt to hide security holes, but also by desire to hide what the weapon can do, what are the operational limits, etc.
tester756 3y ago
>It’s a design fallacy that security through obscurity is good. Yet, still obscurity increases security. Reverse engineering is not trivial and raises the bar.
- prepend 3y ago
  > Yet, still obscurity increases security. I disagree and think obscurity decreases security. It just gives the false belief of security.
  - tester756 2y ago
    Reverse engineering is not trivial and raises the bar.
- fsflover 2y ago
  Any relevant links? I can share this: https://blog.invisiblethings.org/2008/09/02/three-approaches-to-computer-security.html https://blog.invisiblethings.org/2008/09/02/three-approaches...
  - tester756 2y ago
    What would I need link for? The point is simple - obscurity as an addition increases security. Reverse engineering is not trivial and raises the bar. Edit. Oh, your link supports that >The obvious disadvantage of this approach is that it doesn't prevent the bugs from being exploited - it only make the meaningful exploitation very hard or even impossible. But if one is concerned also about e.g. DoS attacks, then Security by Obscurity will not prevent them in most cases. The other problem with obfuscating the code is the performance (compiler cannot optimize the code for speed) and maintenance (if we got a crash dump on an "obfuscated" Windows box, we couldn't count on help from the technical support). Finally there is a problem of proving that the whole scheme is correct and that our obfuscator (or e.g. ASLR engine) doesn't introduce bugs to the generated code and that we will not get random crashes later (that we would be most likely unable to debug, as the code will be obfuscated).

gray_-_wolf 3y ago

> It’s not like giving them the source code would increase risk significantly I like free software a lot, and do not know much about weapon development, but would not the software reveal a lot about capabilities of the weapon platform? The argument to keep the software private might not be motivated just by attempt to hide security holes, but also by desire to hide what the weapon can do, what are the operational limits, etc.

tester756 3y ago

>It’s a design fallacy that security through obscurity is good. Yet, still obscurity increases security. Reverse engineering is not trivial and raises the bar.

prepend 3y ago
> Yet, still obscurity increases security. I disagree and think obscurity decreases security. It just gives the false belief of security.
- tester756 2y ago
  Reverse engineering is not trivial and raises the bar.
fsflover 2y ago
Any relevant links? I can share this: https://blog.invisiblethings.org/2008/09/02/three-approaches-to-computer-security.html https://blog.invisiblethings.org/2008/09/02/three-approaches...
- tester756 2y ago
  What would I need link for? The point is simple - obscurity as an addition increases security. Reverse engineering is not trivial and raises the bar. Edit. Oh, your link supports that >The obvious disadvantage of this approach is that it doesn't prevent the bugs from being exploited - it only make the meaningful exploitation very hard or even impossible. But if one is concerned also about e.g. DoS attacks, then Security by Obscurity will not prevent them in most cases. The other problem with obfuscating the code is the performance (compiler cannot optimize the code for speed) and maintenance (if we got a crash dump on an "obfuscated" Windows box, we couldn't count on help from the technical support). Finally there is a problem of proving that the whole scheme is correct and that our obfuscator (or e.g. ASLR engine) doesn't introduce bugs to the generated code and that we will not get random crashes later (that we would be most likely unable to debug, as the code will be obfuscated).