3 ms·

Also, the distinction is largely pointless - vulnerabilities are not limited to some magic "security enforcing functions", so if the argument had any value, you

Also, the distinction is largely pointless - vulnerabilities are not limited to some magic "security enforcing functions", so if the argument had any value, you'd have to keep all of the code secret. The security of a system tends to depend on all of the code that is in some way reachable from the outside. Also, they list antivirus software as a security measure - all the more reason to publish it all so people with some actual expertise in IT security can have a look at it.

riskable 12y ago
Not only that but the expectation that you can keep your AV vendor a secret is ridiculous. Especially with tens of thousands of employees having a system tray icon in direct view and hundreds to thousands of techs expected to be able to install/re-install said software. Not to mention the fact that big contracts with AV/security vendors are usually public knowledge and easily accessible. Heck, they probably have press releases indexed by Duck Duck Go!