Hacker News Reader

Comment by mavroprovato | Hacker News Reader

This is a classic argument against open source, but security through obscurity never works. If you want to keep safe from script kiddies, always keep your software up to date.

View on HN

Keeping your software up to date is great advise. However I do not entirely agree with the statement that security through obscurity never works. It can never work alone - true. But in combination with other measures it can be a great help.

And with respect to the point cshimmin makes, there is some merit to it. Yes nearly every piece of software, open or closed source is bound to have vulnerabilities. However, the chance of someone taking the time for finding and exploiting a moderately hard to find bug (not referring to a run-of-the-mill sql injection) in a piece of software I've written myself and I'am the only user of is vastly lower than in case of a popular piece of open source forum software (to some extend depending on who I - the only user - am of course).

unless, of course, you are vulnerable to a certain class of attacks (e.g. the ruby on rails attack this year). the chance that others have already fixed it is way better when more people use the same software.

i'm not subscribing to the "enough eyeballs, all bugs are shallow"-argument, but the opposite is also wrong. deeply wrong.

It's really not intended as an argument against open source. It's an argument against using open source forum software (maybe even open source web app software with user accounts). There are always exploits available and you can't always patch in time. Sometimes there isn't even a patch available before the exploits are in use. I was always taught never to rely on security through obscurity. I understand that it's a best practice to not. But feeding off of what jvdongen said, you are far less likely to be hacked using well-constructed homebrew software than an off-the-shelf open source solution.

Reply on news.ycombinator.com