Re:Researchers crack open malware that hid for 5 years
by PeCaN on Tuesday August 09, 2016 @06:36PM
(#12258189)
The opposite of “open source” isn't “black box”.
[ Parent
| on HN ]
Re:Researchers crack open malware that hid for 5 years
by rifung on Tuesday August 09, 2016 @06:49PM
(#12258248)
Not the person you're replying to but opposite of open source is closed source, and isn't that basically a black box to you since you don't know what it's doing?
Is there something more subtle I'm missing?
Re:Researchers crack open malware that hid for 5 years
by PeCaN on Tuesday August 09, 2016 @07:59PM
(#12258551)
Yes. Microsoft offers source access to Windows. IBM and Oracle will rent you people who know the details of their software. None of those companies' offerings are particularly ‘black box’-y, in spite of being very closed source.
‘Open source’ is more about the development model (and freedoms) than about the nature of ‘knowing what the software is doing’.
Heck, I could argue that Linux is a black box to most people who aren't well-versed in kernel development. OpenSSL is notoriously difficult to understand. Sometimes huge bugs look relatively innocent¹ even with people looking at the code.
Re:Researchers crack open malware that hid for 5 years
by rwallace on Tuesday August 09, 2016 @08:51PM
(#12258763)
At the level of security where you need to be paranoid about the operating system developers, how do you know the source code Microsoft shows you, corresponds to the Windows binaries running on your machines? (Let alone to the sum and total of all binary patches applied thereto?)
Re:Researchers crack open malware that hid for 5 years
by PeCaN on Tuesday August 09, 2016 @10:41PM
(#12259177)
A source license probably also gets you the build system, or if not maybe you could throw more money at them.
But reproducible builds are a hard problem, so… honestly, I can't answer that.
Re:Researchers crack open malware that hid for 5 years
by pjmorris on Tuesday August 09, 2016 @10:53PM
(#12259220)
And that's what I really mean by 'black boxes'. Yes, you can buy access to, e.g., Windows source, but that doesn't mean that what you review and what is running on your systems are the same thing. And I can't even speak to all the third-party bits that get compiled in to an instance of Windows. It's a really, really hard problem.