oce 🐆

I try to contribute to things getting better, sometimes through polite rational skepticism.
Disagreeing with your comment ≠ supporting the opposite side, I support rationality.
Let’s discuss to refine the arguments that make things better sustainably.
Always happy to question our beliefs.

  • 0 Posts
  • 72 Comments
Joined 1 year ago
cake
Cake day: July 7th, 2023

help-circle














  • oce 🐆@jlai.lutolinuxmemes@lemmy.worldBackdoors
    link
    fedilink
    arrow-up
    1
    arrow-down
    1
    ·
    3 months ago

    You have provided no valuable argument except “believe my experience”, so I am answering with an equally weak one. Provide me some good quality study and I will be happy to change my mind. I recognize this lack of enlightening information is pretty aligned with closed source philosophy.





  • oce 🐆@jlai.lutolinuxmemes@lemmy.worldBackdoors
    link
    fedilink
    arrow-up
    4
    ·
    edit-2
    3 months ago

    In this case, downgrading to the not affected version. If there’s no possible downgrade, stopping the compromised system until it is fixed.
    Keeping the vulnerable system up because you think nobody else should know is a bet, I don’t think it’s sound. State actors are investing a lot to find and exploit those vulnerabilities, in this case probably even funded the implementation of the vulnerability, so I think you should assume that any vulnerability you discover is already used.


  • oce 🐆@jlai.lutolinuxmemes@lemmy.worldBackdoors
    link
    fedilink
    arrow-up
    1
    arrow-down
    1
    ·
    edit-2
    3 months ago

    No I don’t think you said I was entirely wrong, that part was clear enough.

    My issue is more with your argument from authority and personal experience. It is very easy to be biased by personal experience, especially when it brings good money.

    access controls and supply chain management and traditional security mechanisms.

    So I’ll put my personal experience too (which is also a low value argument). From the outside it may seem this is well done in big companies. But the reality is that this is often a big mess and security often depends on some guy, if any, actually having some standards and enforcing them, until they leave because the company doesn’t value those tasks. But since it’s closed source, nobody knows about it. With open source, there’s more chance more people will look at this system and find issues.
    I don’t doubt some ultra sensitive systems like nuclear weapons have a functional closed source security process because the government understands the risk well enough. But I think there are way more closed source systems, at lower danger level but which still impacts people’s security, that are managed with a much lower standard than if they were open-sourced.