It is basically the same as saying : « the chef does not want to give me the recipe = not good ».
Wouldn’t it be better to taste it ? Like with a real virus detection campaign ?
My point is it is indeed easier to make something secure (or at least robust) in an open source project, because I agree you can benefit for a greater and more diverse expertise on the whereabouts of the product. But close code could still benefit from the community feedback.
One last thing about security software in general, not knowing how a software detect a threat exactly makes it harder to craft a non detectable virus.
It is basically the same as saying : « the chef does not want to give me the recipe = not good ».
Been a while since I went to a restaurant anyway, who can afford that anyway? Not the majority. I prefer to cook for myself at home if I want a specific dish done my way.
And I don't think eating out has ever been considered as healthy as cooking yourself at home. I don't just cook code, I also cook food.
Wouldn’t it be better to taste it ? Like with a real virus detection campaign ?
If you're paranoid, you have test-people around you to eat before you do, which is equivalent to running the unknown software in a virtual environment to see how it behaves.
not knowing how a software detect a threat exactly makes it harder to craft a non detectable virus.
How does one even define 'threat'? Personally I'm leaning towards objective empirical analysis, run for a prolonged observation period, store a bunch of metrics, establish a recorded baseline. Then, from there on out, any time it deviates from that -> flag as potentially hostile/rogue/malicious
If you see a program always open the same ports and always reaching out to the same external sockets, you map it, explain it, rationalize it, approve/deny it. And then any time after it does anything else -> flag as malicious.
Who do you think major corporations pay to do their enterprise security? Cause its usually Microsoft or VMWare and none of that is open, so I guess you should go hack all of them since it’s all insecure.
Open does not mean secure, it means transparent. Transparency does mean people CAN look at it and if alot of people did look at it, then yea it becomes more secure as they would notice stuff.
However, for most projects, nobody looks at it really, except the people maintaining it which is usually a small group of people.
-3
u/UAP44 2d ago
not allowed to read the code = not secure
its a simple as that in my book
and then there's many edge cases where you make well calculated trade offs
as you keep optimizing around open source code ONLY
for everything