4 ms·

It seems when proprietary resources get infected it's because hackers are the problem, but when open source resources get infected its a problem with open sourc

by causal 2y ago

It seems when proprietary resources get infected it's because hackers are the problem, but when open source resources get infected its a problem with open source. But there isn't any particular reason why a paid/proprietary host couldn't just as easily end up being taken over / sold to a party intending to inject malware. It happens all the time really.

program_whiz 2y ago
agreed, but if a company is making millions for the security of software, the incentive is to keep it secure so customers stick with it. Remember the lastpass debacle, big leak and lost many customers...
- krageon 2y ago
  Oh yeah, corporations are so accountable. We have tons of examples of this.
- advael 2y ago
  Directly security-focused products like lastpass are the only things that have any market pressure whatsoever on this, and that's because they're niche products for which the security is the only value-add, marketed to explicitly security-conscious people and not insulated by a whole constellation of lock-in services. The relevant security threats for the overwhelming majority of people and organizations are breaches caused by the practices of organizations that face no such market pressure, including constant breaches of nonconsensually-harvested data, which aren't even subject to market pressures from their victims in the first place
  - PaulHoule 2y ago
    I wouldn’t point to LastPass as an exemplar… https://www.theverge.com/2024/5/1/24146205/lastpass-independent-company-security-breaches https://www.theverge.com/2024/5/1/24146205/lastpass-independ...
    - advael 2y ago
      I didn't, and my point was exactly that it's not a great one, so I think we largely agree here
  - the8472 2y ago
    Even for security-related products the incentives are murky. If they're not actually selling you security but a box on the compliance bingo then it's more likely that they actually increase your attack surface because they want to get their fingers into everything so they can show nice charts about all the things they're monitoring.
    - advael 2y ago
      Aye. My internal mythological idiolect's trickster deity mostly serves to personify the game-theoretic arms race of deception and is in a near-constant state of cackling derisively at the efficient market hypothesis
- f1refly 2y ago
  I think for some reason some people still buy cisco products, so this reasoning doesn't seem to be applicable to the real world.
- hatenberg 2y ago
  Only if they have competition. Which long term is not the default state in the market.
  - robertlagrant 2y ago
    > Which long term is not the default state in the market Why not?
    - lucianbr 2y ago
      Why did Facebook buy Instagram and Whatsapp? Why did Google buy Waze? Why did Volkswagen buy Audi and Skoda and Seat and Bentley and so on? Might as well ask why companies like money.
      - robertlagrant 2y ago
        Sure, but the car industry is pretty old and there's plenty of competition still.
        hatenberg 2y ago
        I’m not sure about plenty when you actually look at it, but in any case it’s because of government intervention.
    - Draiken 2y ago
      Think about it for a second mate: competition leads to winners and winners don't like competition, they like monopolies. And no, the car industry has almost no competition. It's an oligopoly with very few players and a notoriously hard industry to get in.
TZubiri 2y ago
Yes, the economic problem of reward absence is exclusive to open source and private software does not have it. They may have others, like excess of rewards to hackers in form of crypto ransom to the point that the defense department had to step in and ban payouts.
- immibis 2y ago
  Private software always wants more rewards, leading to identical symptoms.
  - bratbag 2y ago
    Private software already has rewards that may be threatened by certain types of behaviour, leading to reduced symptoms.
    - bigiain 2y ago
      Hasn't stopped Larry Ellison from laughing all the way to the bank.
- theamk 2y ago
  private != profitable As long as business is not going as well as owners want, the same economic problem exists in private software too - in fact, the private companies get acquired all the time too, and they get shut down, causing DOS for many of their clients. (See for example: https://www.tumblr.com/ourincrediblejourney https://www.tumblr.com/ourincrediblejourney ) One difference is that closed-source source usually much less efficient; I cannot imagine "100K+" customers from a commercial org with just a single developer. And when there are dozens or hundreds of people involved, it's unlikely that new owners would turn to outright criminal activity like malware; they are much more likely to just shut down.
deleted 2y ago
[deleted]

by causal 2y ago

program_whiz 2y ago

agreed, but if a company is making millions for the security of software, the incentive is to keep it secure so customers stick with it. Remember the lastpass debacle, big leak and lost many customers...

krageon 2y ago
Oh yeah, corporations are so accountable. We have tons of examples of this.
advael 2y ago
Directly security-focused products like lastpass are the only things that have any market pressure whatsoever on this, and that's because they're niche products for which the security is the only value-add, marketed to explicitly security-conscious people and not insulated by a whole constellation of lock-in services. The relevant security threats for the overwhelming majority of people and organizations are breaches caused by the practices of organizations that face no such market pressure, including constant breaches of nonconsensually-harvested data, which aren't even subject to market pressures from their victims in the first place
- PaulHoule 2y ago
  I wouldn’t point to LastPass as an exemplar… https://www.theverge.com/2024/5/1/24146205/lastpass-independent-company-security-breaches https://www.theverge.com/2024/5/1/24146205/lastpass-independ...
  - advael 2y ago
    I didn't, and my point was exactly that it's not a great one, so I think we largely agree here
- the8472 2y ago
  Even for security-related products the incentives are murky. If they're not actually selling you security but a box on the compliance bingo then it's more likely that they actually increase your attack surface because they want to get their fingers into everything so they can show nice charts about all the things they're monitoring.
  - advael 2y ago
    Aye. My internal mythological idiolect's trickster deity mostly serves to personify the game-theoretic arms race of deception and is in a near-constant state of cackling derisively at the efficient market hypothesis
f1refly 2y ago
I think for some reason some people still buy cisco products, so this reasoning doesn't seem to be applicable to the real world.
hatenberg 2y ago
Only if they have competition. Which long term is not the default state in the market.
- robertlagrant 2y ago
  > Which long term is not the default state in the market Why not?
  - lucianbr 2y ago
    Why did Facebook buy Instagram and Whatsapp? Why did Google buy Waze? Why did Volkswagen buy Audi and Skoda and Seat and Bentley and so on? Might as well ask why companies like money.
    - robertlagrant 2y ago
      Sure, but the car industry is pretty old and there's plenty of competition still.
      - hatenberg 2y ago
        I’m not sure about plenty when you actually look at it, but in any case it’s because of government intervention.
  - Draiken 2y ago
    Think about it for a second mate: competition leads to winners and winners don't like competition, they like monopolies. And no, the car industry has almost no competition. It's an oligopoly with very few players and a notoriously hard industry to get in.

TZubiri 2y ago

Yes, the economic problem of reward absence is exclusive to open source and private software does not have it. They may have others, like excess of rewards to hackers in form of crypto ransom to the point that the defense department had to step in and ban payouts.

immibis 2y ago
Private software always wants more rewards, leading to identical symptoms.
- bratbag 2y ago
  Private software already has rewards that may be threatened by certain types of behaviour, leading to reduced symptoms.
  - bigiain 2y ago
    Hasn't stopped Larry Ellison from laughing all the way to the bank.
theamk 2y ago
private != profitable As long as business is not going as well as owners want, the same economic problem exists in private software too - in fact, the private companies get acquired all the time too, and they get shut down, causing DOS for many of their clients. (See for example: https://www.tumblr.com/ourincrediblejourney https://www.tumblr.com/ourincrediblejourney ) One difference is that closed-source source usually much less efficient; I cannot imagine "100K+" customers from a commercial org with just a single developer. And when there are dozens or hundreds of people involved, it's unlikely that new owners would turn to outright criminal activity like malware; they are much more likely to just shut down.

deleted 2y ago

[deleted]