Hacker News Reader

The Thompson attack's where code is able to secretly modify/exploit the compiler to propagate through future compiled programs or itself when compiled. Preventing the execution of foreign code thus reduces the attack surface even further.

From my understanding, it's generally the same reason they have made the kernel exceptionally small -- to reduce attack surface.

It makes liability for failure more complicated and customers might link their proprietary items to toxic licenses. They don’t want to be involved.

Also, just to be frank, if you’re using a solution like this, open source does not meet your requirements.

No, it's because open source competes with some of their upsell offerings and they want to preserve their auxiliary sales.

As for whether it meets your requirements, that's entirely dependent on context. In most cases it's a perfectly valid choice as long as you understand that you're taking on the associated maintenance and certification burden. In our case, it included stuff we had written and open sourced ourselves.