News for hackers. Stuff that matters.

A comment on $50,000 to keep Symantec source code private. Parent comment

Re:$50,000 to keep Symantec source code private by Ctech237 on Tuesday February 07, 2012 @11:06AM (#3562283)
Yes but there are probably lots of code blocks that are used throughout their entire software line. Like how they establish secure connections between the client software and the update server.
[ Parent | on HN ]
Re:$50,000 to keep Symantec source code private by rplnt on Tuesday February 07, 2012 @11:21AM (#3562357)
Still, the code is worthless for anyone if your product is secure. And I would imagine that product by security company would be secure.

Antivirus software might be something different as you might learn how to trick it. But "remote desktop"? It doesn't require any "security by obscurity".

[ Parent | on HN ]
Re:$50,000 to keep Symantec source code private by onedognight on Tuesday February 07, 2012 @01:06PM (#3562935)
> Still, the code is worthless for anyone if your product is secure. And I would imagine that product by security company would be secure.

Actually they had known vulnerabilities, but they didn't think it worth their time to fix them until their code was to be released.

http://www.symantec.com/theme.jsp?themeid=anonymous-code-cla...

> On Friday, January 27, 2012, Symantec released a patch that eliminates known vulnerabilities affecting customers using pcAnywhere 12.0 and pcAnywhere 12.1.

[ Parent | on HN ]
Re:$50,000 to keep Symantec source code private by scoot on Tuesday February 07, 2012 @04:14PM (#3563656)
Poorly worded that's all, after all, you can't fix unknown vulnerabilities.
[ Parent | on HN ]
Re:$50,000 to keep Symantec source code private by lambersley on Tuesday February 07, 2012 @12:58PM (#3562884)
"..product by security company would be secure"

By this logic, wouldn't you also expect the storage of the source code to be secured?

In my mind, security implies all forms; physical, logical, in-transit, at rest, etc

[ Parent | on HN ]
Re:$50,000 to keep Symantec source code private by rplnt on Wednesday February 08, 2012 @03:56AM (#3565815)
> By this logic, wouldn't you also expect the storage of the source code to be secured?

No, developers have to have access to the code and they can just steal it. And this wasn't even the case. If I read correctly, the code was leaked by 3rd party (some India state agency) which had it for some sort of security review.

[ Parent | on HN ]
Re:$50,000 to keep Symantec source code private by djtriptych on Tuesday February 07, 2012 @11:52AM (#3562527)
The source is still pretty valuable to a competitor right?
[ Parent | on HN ]
Re:$50,000 to keep Symantec source code private by rplnt on Tuesday February 07, 2012 @12:08PM (#3562610)
I would say no. Although I might be mistaken as I don't know what exactly is the application capable of. But from the brief description I think it doesn't contain any magic; something that competitor would love to see. The only benefit I see for competitors is the bad press.
[ Parent | on HN ]
Re:$50,000 to keep Symantec source code private by ConstantineXVI on Tuesday February 07, 2012 @03:08PM (#3563449)
Not if Symantec has any proof that they've touched it. You're legally screwed if you touch this code thanks to any combination of patents, trade secrets, or even good old-fashioned copyright violation (just because the source is out there doesn't mean you can use it).
[ Parent | on HN ]