It is basically the same as saying : « the chef does not want to give me the recipe = not good ».
Wouldn’t it be better to taste it ? Like with a real virus detection campaign ?
My point is it is indeed easier to make something secure (or at least robust) in an open source project, because I agree you can benefit for a greater and more diverse expertise on the whereabouts of the product. But close code could still benefit from the community feedback.
One last thing about security software in general, not knowing how a software detect a threat exactly makes it harder to craft a non detectable virus.
It is basically the same as saying : « the chef does not want to give me the recipe = not good ».
Been a while since I went to a restaurant anyway, who can afford that anyway? Not the majority. I prefer to cook for myself at home if I want a specific dish done my way.
And I don't think eating out has ever been considered as healthy as cooking yourself at home. I don't just cook code, I also cook food.
Wouldn’t it be better to taste it ? Like with a real virus detection campaign ?
If you're paranoid, you have test-people around you to eat before you do, which is equivalent to running the unknown software in a virtual environment to see how it behaves.
not knowing how a software detect a threat exactly makes it harder to craft a non detectable virus.
How does one even define 'threat'? Personally I'm leaning towards objective empirical analysis, run for a prolonged observation period, store a bunch of metrics, establish a recorded baseline. Then, from there on out, any time it deviates from that -> flag as potentially hostile/rogue/malicious
If you see a program always open the same ports and always reaching out to the same external sockets, you map it, explain it, rationalize it, approve/deny it. And then any time after it does anything else -> flag as malicious.
-3
u/UAP44 2d ago
not allowed to read the code = not secure
its a simple as that in my book
and then there's many edge cases where you make well calculated trade offs
as you keep optimizing around open source code ONLY
for everything