> That's why militaries and defence companies go to great lengths to vet their staff
What a joke, no they don't. They establish security internally by gating access, not trusting everyone because they've been "pre-vetted".
What a joke, no they don't. They establish security internally by gating access, not trusting everyone because they've been "pre-vetted".
I'm not saying that just because you have some kind of clearance you will get access to everything, but it's part of the preconditions to your own relevant access.
A very secure codebase is designed in a way that all the sensitive parts are separated from the parts general users (and developers) have access to - it shouldn't be all imbued together such that sensitive parts about missiles are exposed to login APIs etc. as it seems like you were saying.
It may even be lower risk than not to open-source as the public is more likely to find and fix actual security quirks that a private contractor might miss (or could even be paid as a spy to purposely leave vulnerable).
There's also the community/recruitment aspect. AI/LLM companies are cleverly open-sourcing major parts of their work while keeping the only important part that makes them valuable private - it's a win:win as they keep their secrets yet provide for and stimulate a developer community.