Security by obscurity is flawed.
Open Source Isn't Dead
161–170 of 200 posts
Re: Open Source Isn't Dead
#162Earlier quoted context omitted.
Exactly. I respect their decision to go closed source if that's what they need to do to make it a viable business, but just be honest about it. Don't make up some excuse around security and open source.
I don't know if I fully agree with this -- how many people were actually self-hosting cal infra? I def could be wrong though
The issue isn’t would-be customers going to the trouble of self hosting to save a measly $30/month.
The issue is competitors popping up to clone your offering with your own codebase.
Re: Open Source Isn't Dead
#163Earlier quoted context omitted.
As someone who works on closed source software and has done for a couple of decades, most companies won't even know about that and of those who do only a fraction give enough of a shit about it to do anything until they are caught with their pants down.
Seconded. Having worked in quite a few agency/consultancy situations, it is far more productive to smash your head against a wall till bleeding, than to get a client to pay for security. The regular answer: "This is table stakes, we pay you for this." Combined with: "Why has velocity gone down, we don't pay you for that security or documentation crap." There are unexploited security holes in enterprise software you c…
Yea, its fundamentally an issue of asymmetric economics.
Running AI scanners internally costs money, dev time, and management buy in to actually fix the mountain of tech debt the scanners uncover. As you said there is no incentive for that
But for bad actors the cost of pointing an LLM at an exposed endpoint or reverse engineered binary has dropped to near zero. The attackers tooling just got exponentially cheaper and faster, while the enterprise defenders budget remained at zero.
Re: Open Source Isn't Dead
#164> The reasoning provided by their CEO, Bailey Pumfleet, is that AI has automated vulnerability discovery at scale, That sounds like an excuse. The real reason is probably that it's hard to make a viable business out of developing open source.
Yes, it feels like they've been looking for an excuse to go closed-source, and this one is plausible enough to make it sound like they're only doing it because they "have to".
What an uncharitable take
Re: Open Source Isn't Dead
#165I don’t believe for a second that the real reason is security by obscurity. They probably believe they can make more money not being open source and this sounds like a better excuse than ”we wanna make more money”.
Re: Open Source Isn't Dead
#166Earlier quoted context omitted.
It’s also now ridiculously easy to simply cherry pick from open source without actually “using” it. “I need to do foo in my app. Libraries bar and baz do these bits well. Pick the best from each and let’s implement them here” I’d not be surprised if npmjs.com and its ilk turn into more a reference site than a package manager backend soon.
I literally have a Claude Code skill called "/delib" that takes takes in any nodejs project/library and converts it to a dependency-less project only using the standard library. It started as a what-if joke, but it's turned out to be amazing. So yeah, npmjs.com is just reference site for me now, and node_modules stays tiny. And the output is honestly superior. I end up with smaller projects, clean code, and a huge su…
Interesting - I am interested to know how’s it impacting the codebase size interms of lines of code.
Re: Open Source Isn't Dead
#167> The reasoning provided by their CEO, Bailey Pumfleet, is that AI has automated vulnerability discovery at scale, That sounds like an excuse. The real reason is probably that it's hard to make a viable business out of developing open source.
We've run an extremely profitable business for five years, raised a seed and a Series A, and grown at 300% a year sustainably while being open source. Going closed source actually hurts our business more than it benefits it. But it ultimately protects customer data, and that's what we care about the most.
By this logic, Linux should switch to closed-source.
All your servers are Linux, so imagine how insecure you are - must switch to windows ASAP.
Re: Open Source Isn't Dead
#168I support and encourage the death of “““open source””” so that we may retvrn to Free Software.
Re: Open Source Isn't Dead
#169Earlier quoted context omitted.
> Closed source software won't receive any reports Not from the automated repo scanners, but bug bounty programs can generate a lot of reports in my experience. AI tools are becoming a problem there, too, because amateurs are drawn to the bounties and will submit anything the AI hallucinates. Closed source companies can (and should!) also run their own security audits rather than passively waiting for volunteers to s…
> Not from the automated repo scanners, but bug bounty programs can generate a lot of reports in my experience. AI tools are becoming a problem there, too, because amateurs are drawn to the bounties and will submit anything the AI hallucinates So just like a pre-AI or worse?
Worse. [0]
Re: Open Source Isn't Dead
#170Earlier quoted context omitted.
given what the clankers can do unassisted and what more they can do when you give them ghidra, no software is 'closed source' anymore
Guess that kind of depends on your definition of "source", I personally wouldn't really agree with you here.
I mean-- to an LLM is there really any difference between the actual source and disassembled source? Informative names and comments probably help them too, but it's not clear that they're necessary.