6 ms·

Maybe having it be open source would represent a security risk? https://github.com/reddit-archive/reddit1.0/blob/master/data.lisp#L32 https://github.com/reddit-

Maybe having it be open source would represent a security risk? https://github.com/reddit-archive/reddit1.0/blob/master/data.lisp#L32 https://github.com/reddit-archive/reddit1.0/blob/master/data...

keyle 8y ago
It goes both ways, being open-source can also make your product more secure, as it's out in the open and a lot more eyeballs look at the code.
- colejohnson66 8y ago
  Tell that to OpenSSL
  - __s 8y ago
    Where's your flawless closed source SSL implementation?
    - colejohnson66 8y ago
      Wow. Offended much? Did I say (or even imply) I had one? All I did was provide a counter to the claim that open source means more eyes which could make your software more secure.
      - serf 8y ago
        >All I did was provide a counter to the claim that open source means more eyes which could make your software more secure. You really didn't say much about open source and it's ability find bugs; you just cited a particularly nasty set of bugs on an open source project as a way to condemn all of open source work to being as bug-ridden as other methods. It was more snark than it was providing a clean example as a counter-point. Someone could easily point out the millions of bugs in closed source projects as a counter to your point of equal caliber; but I think that it's clear to most of us that NO methods that we yet understand will result in bug-free code.
  - krapp 8y ago
    Open source allows for the possibility of 'many eyes making all bugs shallow', but I think the open source community assumed that was a guarantee, at least in the case of mission critical software - it's important so obviously it's being scrutinized, right? On the other hand, with closed source, people are presumably being paid to study the code, potentially fewer but a still fixed number of eyes on the code, as it were. But then, since it's closed source, no one really knows what's going on outside the company. Moral arguments aside, neither system is perfect.
laburn 8y ago
Making something closed source does not make your product more secure, it only makes it harder to look at. Determined people will still try to understand how your software works in order to accomplish their goals.
- wvenable 8y ago
  Security through obscurity is a valid and effective tactic -- it's simply ineffective on it's own.
  - Skunkleton 8y ago
    To reinforce your point, see all pre-modern crypto techniques. It cannot be argued that they worked, and they were all certainly security through obscurity.
    - onion2k 8y ago
      Aren't most examples things where it didn't work? The most famous case is the German "Engima" device from WWII (hardware- and 'software'-based, but cracked and readable for years before the Germans knew because they believed it was both obscure and effective) but it's wholly possible that most schemes were broken eventually. Keeping an obscure system secret is really hard, especially against a motivated attacker.
      - azag0 8y ago
        Enigma wasn't hard through obscurity. The Allies had the Enigma machine long before they were able to crack it. It was hard because with the equipment of the day, it was pretty much unbreakable in the same way that prime-number based cryptography is today. It was only A. Turing developing a completely novel kind of machine (https://en.wikipedia.org/wiki/Bombe https://en.wikipedia.org/wiki/Bombe) that enabled the decryption. In the same way that quantum computers could break the current cryptography easily. It's not obscurity, it's assuming that some (mathematical) task is hard.
PascLeRasc 8y ago
They could certainly upload a version of that file with dummy variables (unless that's what this is).
- justinator 8y ago
  Me thinks they didn't allow access to the db from just anywhere, regardless.
Sylos 8y ago
I mean, it shouldn't. Humanity is perfectly capable of building secure web services without having to keep the way it works a secret. You don't publish your encryption keys with your source code, which is what your security should be depending on. And what's more, Reddit themselves did not even use that excuse in their official statement for it, even though to me their excuse felt even less logical. Basically, they don't want to leak the crazy features that they're developing and have such piss-poor source code management that they cannot provide tarballs of clean states of their source code. I mean, how do they deploy new versions, if they cannot cleanly separate feature development from stable code? https://www.reddit.com/r/changelog/comments/6xfyfg/an_update_on_the_state_of_the_redditreddit_and/ https://www.reddit.com/r/changelog/comments/6xfyfg/an_update...
- maruhan2 8y ago
  In theory it shouldn't, but in practice people don't make perfect code that doesn't have vulnerabilities. But a lot of people would argue that by having many reviewers, you're reducing vulnerabilities. Thus, my stance is that "it depends on the situation"
- amelius 8y ago
  > Humanity is perfectly capable of building secure web services without having to keep the way it works a secret. That's the same as saying that humanity is capable of building a large system without bugs, in an economically viable way.
  - zeth___ 8y ago
    Just look at Linux. The only way to keep bugs out of the kernel is to keep the source closed.
    - GTP 8y ago
      No, having an open source kernel means a lot more developers looking at the code and working on a fix if some bug is found, rising the probabilities to find a bug and shortening the time required to fix it. How would keeping the source closed decrease the number of bugs?
ebbv 8y ago
A lot of bad developers like to use this excuse but it doesn’t hold water. Open source has a history of producing better security results.
drosan 8y ago
That's just shitty hardcode, sane human beings build only prototypes like that, not production code. Going opensource would have that code reviewed and fixed -> means positive impact on security.
Qub3d 8y ago
That violates Kerckoff's principle[0],a cornerstone of modern information security. I would run far, far away from anyone coughtelegramcough who claims "its secure, don't worry about it" and otherwise refuses to expose their codebase to scrutiny. [0]:https://simple.wikipedia.org/wiki/Kerckhoffs%27s_principle https://simple.wikipedia.org/wiki/Kerckhoffs%27s_principle

Maybe having it be open source would represent a security risk? https://github.com/reddit-archive/reddit1.0/blob/master/data.lisp#L32 https://github.com/reddit-archive/reddit1.0/blob/master/data...

keyle 8y ago

It goes both ways, being open-source can also make your product more secure, as it's out in the open and a lot more eyeballs look at the code.

colejohnson66 8y ago
Tell that to OpenSSL
- __s 8y ago
  Where's your flawless closed source SSL implementation?
  - colejohnson66 8y ago
    Wow. Offended much? Did I say (or even imply) I had one? All I did was provide a counter to the claim that open source means more eyes which could make your software more secure.
    - serf 8y ago
      >All I did was provide a counter to the claim that open source means more eyes which could make your software more secure. You really didn't say much about open source and it's ability find bugs; you just cited a particularly nasty set of bugs on an open source project as a way to condemn all of open source work to being as bug-ridden as other methods. It was more snark than it was providing a clean example as a counter-point. Someone could easily point out the millions of bugs in closed source projects as a counter to your point of equal caliber; but I think that it's clear to most of us that NO methods that we yet understand will result in bug-free code.
- krapp 8y ago
  Open source allows for the possibility of 'many eyes making all bugs shallow', but I think the open source community assumed that was a guarantee, at least in the case of mission critical software - it's important so obviously it's being scrutinized, right? On the other hand, with closed source, people are presumably being paid to study the code, potentially fewer but a still fixed number of eyes on the code, as it were. But then, since it's closed source, no one really knows what's going on outside the company. Moral arguments aside, neither system is perfect.

laburn 8y ago

Making something closed source does not make your product more secure, it only makes it harder to look at. Determined people will still try to understand how your software works in order to accomplish their goals.

wvenable 8y ago
Security through obscurity is a valid and effective tactic -- it's simply ineffective on it's own.
- Skunkleton 8y ago
  To reinforce your point, see all pre-modern crypto techniques. It cannot be argued that they worked, and they were all certainly security through obscurity.
  - onion2k 8y ago
    Aren't most examples things where it didn't work? The most famous case is the German "Engima" device from WWII (hardware- and 'software'-based, but cracked and readable for years before the Germans knew because they believed it was both obscure and effective) but it's wholly possible that most schemes were broken eventually. Keeping an obscure system secret is really hard, especially against a motivated attacker.
    - azag0 8y ago
      Enigma wasn't hard through obscurity. The Allies had the Enigma machine long before they were able to crack it. It was hard because with the equipment of the day, it was pretty much unbreakable in the same way that prime-number based cryptography is today. It was only A. Turing developing a completely novel kind of machine (https://en.wikipedia.org/wiki/Bombe https://en.wikipedia.org/wiki/Bombe) that enabled the decryption. In the same way that quantum computers could break the current cryptography easily. It's not obscurity, it's assuming that some (mathematical) task is hard.

PascLeRasc 8y ago

They could certainly upload a version of that file with dummy variables (unless that's what this is).

justinator 8y ago
Me thinks they didn't allow access to the db from just anywhere, regardless.

Sylos 8y ago

I mean, it shouldn't. Humanity is perfectly capable of building secure web services without having to keep the way it works a secret. You don't publish your encryption keys with your source code, which is what your security should be depending on. And what's more, Reddit themselves did not even use that excuse in their official statement for it, even though to me their excuse felt even less logical. Basically, they don't want to leak the crazy features that they're developing and have such piss-poor source code management that they cannot provide tarballs of clean states of their source code. I mean, how do they deploy new versions, if they cannot cleanly separate feature development from stable code? https://www.reddit.com/r/changelog/comments/6xfyfg/an_update_on_the_state_of_the_redditreddit_and/ https://www.reddit.com/r/changelog/comments/6xfyfg/an_update...

maruhan2 8y ago
In theory it shouldn't, but in practice people don't make perfect code that doesn't have vulnerabilities. But a lot of people would argue that by having many reviewers, you're reducing vulnerabilities. Thus, my stance is that "it depends on the situation"
amelius 8y ago
> Humanity is perfectly capable of building secure web services without having to keep the way it works a secret. That's the same as saying that humanity is capable of building a large system without bugs, in an economically viable way.
- zeth___ 8y ago
  Just look at Linux. The only way to keep bugs out of the kernel is to keep the source closed.
  - GTP 8y ago
    No, having an open source kernel means a lot more developers looking at the code and working on a fix if some bug is found, rising the probabilities to find a bug and shortening the time required to fix it. How would keeping the source closed decrease the number of bugs?

ebbv 8y ago

A lot of bad developers like to use this excuse but it doesn’t hold water. Open source has a history of producing better security results.

drosan 8y ago

That's just shitty hardcode, sane human beings build only prototypes like that, not production code. Going opensource would have that code reviewed and fixed -> means positive impact on security.

Qub3d 8y ago

That violates Kerckoff's principle[0],a cornerstone of modern information security. I would run far, far away from anyone coughtelegramcough who claims "its secure, don't worry about it" and otherwise refuses to expose their codebase to scrutiny. [0]:https://simple.wikipedia.org/wiki/Kerckhoffs%27s_principle https://simple.wikipedia.org/wiki/Kerckhoffs%27s_principle