Hacker News Reader

Comment by figmert | Hacker News Reader

Fair point on the security theatre, but I don't get this:

> Also, no information on its authors, who audited the code, what makes it "secure" enough to warrant giving an administrative entitlement over my system. Hard pass.

The code is hosted by an organization on GitHub, who have clear links to their website, email, twitter. On their website they have their office addresses and it seems to me that they are registered with the Italian government as a business.

They don't mention anything about it being audited or make any claims that it is secure. Both of these would be something to follow up on if someone is planning to use it within their org.

I'm not sure what it is you want from them. They've released something, and made it open source. It is a little over a year old, so they're probably still getting their footing and figuring things out.

View on HN

I want "security" software authors to stop doing harm. Just as physicians take up the Hippocratic Oath, I think we need to set higher standards for programs, applications and processes which avow to improve security, because too often they seem to have the opposite effect. Traditional anti-virus tools are a classic example of this.

I do see their website now, but I'm still confused:

> We are a team of visioneers, engineers, designers, and security experts backed by top-tier VCs who believe in making security work for everyone.

Great. What makes you security experts? In other words, why should we trust you?

You say the code is open source and that makes it trustworthy, but source availability is not a panacea. It must really be vigorously stressed, tested and abused by competent hackers (as a consensual contracted service) - again, if we are to call it "security" software.

Plainly, this is a beta test for a company that wants to make some money and has generously externalized bugs, issues and other nuances of development unto the open source community, which through some sort of Stockholm Syndrome has actually convinced itself more code - even if it's not good code - is still a good thing.

This is such a ridiculous sentiment. You're blaming these people for Antivirus now? Your whole post is just a nonsensical rant.

If you want to say "I'd like to see software like this audited for security" just say so.

Then there's the followup question: Who trusts the auditors?

Well - since it's open source, theoretically you can build it yourself and "trust but verify" the audit, although there we're also assuming you trust your own judgement or that of your security team.

Well, right, of course. My comment is more along the lines of "paying for an audit implies putting faith in those auditors to do a good enough job"

It’s open source. I’ll inspect the source myself. Cross check against auditor findings. Build from source

Consider this a medical trial

Reply on news.ycombinator.com