Security audits, good implementation and proper reserach require the work of rare (as in there aren't many) and talented individuals. The funding model for open-source security is bug hunting and having big corporation who use your open-source product to give you from their money or their talent.

A funding model where you pay the company to hire auditors, implementors and researchers directly could be argued to be the better funding model.

I'm not saying it is better, since open-source has proven itself many times, but it has also failed miserably many times because of lack of funding or interest.

Open source, especially open-source that is produced and maintained by companies with different agendas (for instance google) as opposed to a foundation is prone to having that agenda color the way it works. Commercial product's agenda usually align better with it's customers then some random company. Some would say that in a security product it is vitally important that the creators' motivations are aligned with the users'.

If I can hire a code auditor to audit closed source, I get one audit. If I hire an audit and someone else hires an audit on the same open source code, I get two audits.

> If I hire an audit and someone else hires an audit on the same open source code, I get two audits.

So there's incentive to save money and wait for someone else to do audits.

That incentive only weighs so heavily against the incentive to run audited code.

I think webkik is saying, Open Source is better because if you DO spend money on security it can be spent by the community in aggregate / across successive efforts to pay experts to AUDIT the open source project.

Hypothetically speaking, because you can get a better support contract with a closed (or semi-closed) source software vendor. Alternatively because closed source software is easier to monetize and likely has better resources to direct to feature development.

But in practice almost all cryptography is deployed via open source software. Large tech companies like Google and Apple can develop reliable and safe closed source cryptography. But most companies don't because that's expensive and usually unnecessary.

>> Hypothetically speaking, because you can get a better support contract with a closed (or semi-closed) source software vendor.

I knew a guy who worked at a medium size company (few thousand people). They tried to drag him back into an old product he worked on years ago to help because.... They still had one customer paying support on it, but someone realized they couldn't find the source code. This guy couldn't help and fortunately the customer hadn't asked for any changes to the software in several years. So no, paying for software doesn't necessarily mean it's supported in any meaningful way.

I have to be honest, I don't think that one example can tell us anything meaningful about whether or not closed source software is typically better supported.

Note that I used the word "can", not the word (which you used) "necessarily."

Agreed. My point was simply that the level of "support" you get by paying for software can actually be zero. I don't claim to know what's typical.

My estimation is that typical support consists of listening to customer complaints and suggestions and prioritizing development around that and available resources. I doubt many companies do extensive analysis or hire consultants to do security audits or much of anything that isn't directly customer driven.

The company I mentioned previously actually does extensive design, testing and regression testing on most of their products but the smaller side project just didn't get that attention. YMMV even within one company.

The parent obviously didn't mean that ALL TIMES UNDER ALL CIRCUMSTANCES DO YOU GET PERFECT SUPPORT. It's simply a data point in the overall calculus. Support vs internal maintainability vs cost vs ability to find supporting talent vs license provisions vs IP concerns vs regulatory requirements vs a million other reasons.

Because you get to pay money for closed source. And if you're paying, you can justify it for yourself that it's somehow better, because it costs money.

You probably wouldn't! Aumasson isn't arguing in favor of closed-source cryptography. He's just dispelling a particular myth about the security differences between the two types.

I don’t know that this holds for crypto but for security systems more generally history has shown that ability to staff professional security & legal teams has more to do with practical security than the advantage open source provides.

So in a situation where your choice in crypto is open vs closed & legal/security funded you might pick the closed solution.

That's a logically false inversion, assuming you take 'no better than' to mean '<=' (as I think makes sense in context).

OSS <= CSS does not imply CSS <= OSS...

> why on earth would you ever choose closed source components

There are often no open source alternatives to closed source things that are meaningfully equivalent. For example, the iPhone is a secure and closed source phone. There is no open source equivalent to that package. Android devices have critical closed source components with almost no exception, but also are not equivalent to an iphone in many meaningful ways.

I think a better take-away is the nuanced "evaluate things on a case-by-case basis, don't let a security system having closed source components needlessly bias you"

I took “no better than” to mean approximately equal. I feel otherwise the author would have added “and possibly worse than”. I think your assumption however is probably more correct.