Post B5KwwKgruy5csFCt5U by Chrizmas@social.linux.pizza
 (DIR) More posts by Chrizmas@social.linux.pizza
 (DIR) Post #B5K5QFLuvwVpTuDphI by downey@floss.social
       0 likes, 0 repeats
       
       Open Source calendar platform goes proprietary under the delusion that "AI" means keeping their code secret leads to more secure software.The move does absolutely nothing to increase the security of their product.https://cal.com/blog/cal-com-goes-closed-source-why#OpenSource #FreeSoftware #FOSS #FLOSS #AI #ArtificialIntelligence
       
 (DIR) Post #B5K5QFpLAY32x9zKYi by mrfoostang@foostang.xyz
       0 likes, 0 repeats
       
       @downey@floss.social @relay@relay.infosec.exchange As much as I wish this were true, it’s not. Obscurity is a valid security layer and open source software with exposed source code _does_ make it easier for attackers to find attack vectors.Without access to source code an attacker has to infer vulnerabilities by hitting the code. Those recon hits are visible in security tools like SIEMs.Open source vulnerabilities can be discovered directly from the source and the attacker can craft the perfect exploit without ever touching production code. Then hit it once very effectively, probably escaping detection because there’s no recon signals.The days of #OSS being used for actual critical applications drawing to a close.#infosec
       
 (DIR) Post #B5KwwKgruy5csFCt5U by Chrizmas@social.linux.pizza
       0 likes, 0 repeats
       
       @mrfoostang @downey @relay it is easier in Oss but not having the source is not a big problem. Most vulnerabilities come from dependencies. And an attacker can get the source code from a leak oder decompile a copy. The main reason that most closed source software I have seen not get hacked is poor luck and no one has tried it hard enough. Whitebox is a benefit but never a security mechanic
       
 (DIR) Post #B5KwwKuL6srhY1Ve5I by mrfoostang@foostang.xyz
       0 likes, 0 repeats
       
       @Chrizmas@social.linux.pizza @relay@relay.toot.io @mrfoostang @relay@relay.infosec.exchange It is a security layer. Akin to moving ssh off port 22. It’s a small thing but defense in depth pays off by creating friction for attackers.It’s certainly not a huge thing, but it can’t be discounted as irrelevant.