578
Firefox is on the brink of being dropped by the US Government
(www.brycewray.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 05 Dec 2023
578 points (90.0% liked)
Technology
60062 readers
1820 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
The Free Software Foundation Europe has an awesome initiative called Public Money Public Code where they try to convince lawmakers to use as much open source software as possible when using public funds. I really hope they succeed.
What about security? If it's open source, anyone can poke around in the code and find vulnerabilities to exploit way easier.
Security through obscurity doesn’t, work the vulnerabilities are still there. Also if the vulnerabilities are visible they’re also easier to close.
Tell me you have never worked in IT security without telling me you never worked in IT security.
To give you an actual answer, instead of pure Internet snark, the concept you're proposing is called "security through obscurity" if you want to research it.
The TL:DR of it is it doesn't work. If it did, all software would be proprietary and things like viruses wouldn't exist. The source code for Windows isn't available, but Windows gets exploited constantly.
More eyeballs are from people wanting those flaws fixed that wanting to exploit them.
Proprietary source code has much fewer eyeballs, none of which you can verify belong to competent or trustworthy people.
FTFY. Open source software is more secure than closed source, not less
No, you can't really make blanket statements like that at all.
Open source doesn't compromise security on its own and closed source is the same.
Open source might be more secure but that's only if people actually audit it properly and some closed source codes are audited more closely than some open source code.
Depends how u interpret it. I would assume they talking averages.
Is this a serious question?
This is the exact same ridiculous argument that proprietary software corporations make. It never made any sense, security through obscurity will never work. Linux is open-source used on ~80% of all web servers, in your logic these servers would all be vulnerable. It just doesn't make any sense. Linux is also used in many embedded devices and Android is based on the Linux kernel. But Android (which is also entirely open source) has one of the best security models out there.
That's the same bullshit line politicians and corporations use, it's simply not true
Vulnerabilities can and are usually found without code inspection. Fuzzing, reverse engineering, etc. At the same time, it is easier to find vulnerabilities having the code to check, but it is easier also for those who want to have them patched. That's why we have tons of CVEs in Windows, iOS etc., and they don't all come from the vendor... Depending on the ratio of eyeballs looking at something to fix and the ones looking at something to exploit, open source can be more secure compared to closed source.
Lol
And 100% of it is dog shit. I have seen custom products from Accenture, Deloitte, and E&Y, and they were passable prototypes at best.
Accenture doesn't make shit. They bring in expensive ass consultants with 25 years of experience (on paper), then they sell something basically off the shelf. What's left of the budget goes to a subcontractor, who now has to glue the already purchased pieces together with spit and gum, now on a very tight timeline before the funding runs out and your tiny company gets the blame
Haven't worked directly with the others, but the Accenture story was the same everywhere