News for hackers. Stuff that matters.
Re:Hackers who broke into Equifax exploited a flaw in open-s... by ajarmst on Saturday September 09, 2017 @01:40AM (#15205714)
I find the title irritating, as it seems to impugn open source software as a category. Why is the licensing model even relevant? A better phrasing would be something like "...flaw in a popular web framework" or "...flaw in Apache Struts."
Re:Hackers who broke into Equifax exploited a flaw in open-s... by znpy on Saturday September 09, 2017 @04:08AM (#15206047)
> Why is the licensing model even relevant?

Licensing model directly affects the availability of source code, and this technically facilitates exploit discovery.

Re:Hackers who broke into Equifax exploited a flaw in open-s... by throwawaykf09 on Saturday September 09, 2017 @04:56AM (#15206176)
Also, many open source proponents claim that open source software is more secure because the “many eyes” theory will lead to bugs and vulnerabilities being discovered sooner. This and other high profile exploits like heartbleed show how well this theory applies in practice is questionable.
Re:Hackers who broke into Equifax exploited a flaw in open-s... by lillesvin on Saturday September 09, 2017 @05:26AM (#15206240)
I find that conclusion presumptuous. Unless you can say how many bugs would have been discovered had the source been closed, then it doesn't make sense to claim the opposite.

Also, do we know that e.g. this and Heartbleed were discovered by reading the source? If they weren't then the availability of the source code is inconsequential IMO.

Re:Hackers who broke into Equifax exploited a flaw in open-s... by ajarmst on Saturday September 09, 2017 @11:40AM (#15207580)
That's a very dubious claim, as it depends on the largely debunked idea of "security through obscurity." Bruce Schneier: https://www.schneier.com/crypto-gram/archives/2002/0515.html...
Re:Hackers who broke into Equifax exploited a flaw in open-s... by znpy on Saturday September 09, 2017 @11:58AM (#15207647)
I am not saying that closed-source software is more secure. I am saying finding exploits when the source code is available is definitely easier.
Re:Hackers who broke into Equifax exploited a flaw in open-s... by ajarmst on Saturday September 09, 2017 @12:44PM (#15207827)
Ah. Yes, I suppose. As it is easier to find exploits in service of closing them as well as in using them (security researchers seem to mostly come down on the side that this averages out as more secure). If that's what you meant, I apologise for the misinterpretation. This particular article doesn't make that point, though, so I remain with the feeling that mentioning the license model in the title is irrelevant and a bit misleading.