$50,000 to keep Symantec source code private

Symantec might be the target for PR (its products are supposed to protect others but it can't protect itself) and 50000 other reasons.

It is not self-evident that an antivirus provides enough benefit to outweigh its disadvantages (resource-hog, false-positives (intentional?), can't detect all attacks). In short security theater is not security.

Of cause it doesn't make the crime any less.

The media eats up the concept of an organized global conspiracy group so it works out for everyone; the media makes money, the independent operators have a convenient, catch-all banner to fly under and the collective gets publicity for their cause.

Edit: I meant this to be humorous, though it may not be far from the truth. If Symantec values its source code above a certain dollar amount, I'm sure it would be a federal offense in America to download this code. This is how Kevin Mitnick became a federal fugitive... it was simply based on the dollar amount of the source code he possessed.

As you point out, it's security through obscurity (which we all know isn't really security), but what's more, you can never know if there is a backdoor in proprietary software, or if it's actually doing what it's supposed to do (and not less, or more - like logging your activity or listening in on your traffic).

This is antivirus software, a specific sub genre of security software. Historically, the most popular such packages have not been open.

You are not expected to trust them not to have backdoors any more that you are expected to trust any other vendor (say, Microsoft). What you are expected to do is trust that it catches virus and third party spyware. Which, supposedly, it does, and people have been using it for ages.

Even if it was open, you would need to have it in binary form to run it, so you either need to know to compile it yourself and check the code first (not an option for 99.9999999 of the users) or trust the party that compiled it for you. And then you need to check again for every virus definition and engine update downloaded.

Better just trust the vendor and use it closed source...

Looks like the hackers didn't fall for it.

Finally, I suspect at least part of the reason is that the source code contains a number of heuristics that, if known, are easier to circumvent for malware developers.

Back doors seem distinctly possible. I'll bet there is some seriously poor crypto in there, too.

Now, this isn't an argument against open-source software – much to the contrary, in fact, because, I'd argue, OSS has, by virtue of being developed in the open, had much more opportunity for bugs to be seen by contributors and by those looking to crack/exploit it. As exploits are found, they get patched. Closed source, code, on the other hand, faces a lot of catch-up when its code is released into the wild.

I'd argue that's a bit like what happens to one's immune system if it's not regularly challenged (particularly as a child). Frequent exposure to pathogens tends to make one's immune system better, whereas living in a bubble only works as long as nobody lets you out.

Also, as much as codebases change, many parts stay the same, so yes, 5 year old code may well still be similar to currently shipping code that unexploited/unpatched issues may well still exist.

It would be interesting if Semantec would do something like start a bounty for reporting exploits. But of course that would be promoting use of their source code which I'm sure they would never do.

If Anon are at least mildly intelligent they'll figure out this is a sting operation. Slowly trickling in money then following it to the source is most likely an FBI setup.

Now Anon could keep playing this and accept money but provide some random bank account just to see what Symantec does.

Actually, to think about it, their best possible exit out of this is to ask this money to be sent to a charity, or a foundation. For example, "Donate $50k immediately to EFF and we'll promise we'll erase the source files".

But then going by their previous patterns they'll probably release the source anyway.

I don't know, but if this is an FBI sting they are not very ingenious. "We'll give you money in the course of 3 months as continuous payments... you'll have to provide proof you deleted files.. really?". A 10 year old can figure out what this is. Kind of disappointed at the quality of their work (and our tax money's use).

Really?

So if I, a supposedly reputable citizen have to resort to calling the police after my house is broken into that reflects poorly on me?

Symantec may have doen things that reflect poorly on them, but I don't think calling the police in is one of them. That's what you are supposed to do.

Remember that pretty much every tech company has had some of their code broken into, whether it's microsoft's OS, to Google's Chinese gmail back doors to oracle's db leak.