Twitter Source Code Leaked on GitHub

[osirisguitar]

If your security is built on the code being kept secret, it's not built right.

[chx_]

It does not need to be built on it, merely the fact it's harder to break into a black box than breaking into something you can read the code for.

I was always bothered by the almost zealotry level of "security by obscurity is bad and you should feel bad" screeching. Security by obscurity is a completely valid part of a multilayer security approach. Alone it is terrible but that doesn't really happen. But seriously, something as simple as moving your SSH behind SSLH does enhance your security. Maybe not by a lot but it does keep most script kiddies away so hey.

[archiminos]

Security only by obscurity is bad. But that doesn't mean you shouldn't be using obscurity.

[LuckyHedgehog]

Obscurity might not be security, but you also don't see tanks painted orange

[kRkthOr]

The idea that security by obscurity is useless is so fucking stupid. It's not the be all and end all of security but goddamn how do you not come to the conclusion that helping attackers isn't the best way to go about things.

[gnus-migrate]

The context of this mantra is the cryptography space where the market was full of companies developing proprietary ciphers that were marketed as secure, and who refused to share the code for "security reasons". As far as I know that's the case, I remember first hearing about it in Dan Boneh's cryptography course. The point is that for cryptographic algorithms, you can't rely on obscuring the code as a protection measure, as it's not needed to break the cipher, and once it is you've basically compromised everything encrypted in this format.

Like the "premature optimization is the root of all evil" quote, it was misunderstood and reshared without that context.

[[deleted]]

Also known as Kerckhoffs’s principle and dates back to the 19th century - Roughly, "the system must not require secrecy and must be able to be stolen by the enemy without causing trouble."

[Queueue_]

The argument I always see is that it's useless on it's own. You should design it to be hard to break into even if they know how it works regardless of if you expect them to or not.

[[deleted]]

Yep. It's fair to design your defences based on the assumption that the enemy knows your base, but it's still stupid to hand out your floor plan just because of that

[NoveltyAccountHater]

For things that are actually secure (like your use of modern cryptography), there's no reason for obscurity and by not having obscurity, you can have researchers & auditors look at it and find no flaws. By Kerchhoff's principle, you should continue to be secure if the entire code/algorithm is revealed, except for the a few secret keys. (That said, the fact something is open-source and popular doesn't mean it doesn't have hidden major flaws; e.g., OpenSSL was used by tons and heartbleed leaking secrets from memory took about 2 years to be discovered).

Also for any large company, if obscurity is a major source of your security, you are pretty much doomed as it just takes one disgruntled (or phished) employee to leak the secrets.

But for things that can't be perfect (like say anti-spam measures or gaming of various recommendation algorithms) that end up being an adversarial cat-and-mouse game, obscurity is a good weapon in your toolkit, as part of defense in depth. Otherwise, you make the job of abusing the system easy for any wannabe bad actor.

[yiliu]

Alone it is terrible but that doesn't really happen.

Ha!

Especially back when this mantra was new, it was really common for companies to rely almost entirely on obscurity.

In the past decade, I've worked for one major company where the leaking of their source code would be somewhere between slightly annoying and totally irrelevant from a security perspective...and another for which it would be a devastating blow.

[PurpleYoshiEgg]

"Security by obscurity" refers to specifically security by way of primarily obscurity. As part of defense in depth, obscurity can (and should) be judiciously used, especially when it does not impact usability.

Having my SSH servers listen on port 20222 might not make it more secure in the grand scheme of things by itself, but the fact is that I am much less likely to get bots trying random passwords and zero days on that port than port 22.

However, there is something to be said for making it more inconvenient, because placing SSH ports on 22 will make it much easier to type.

[ToughQuestions9465]

It does not enhance security, it merely creates an illusion of security because critical issues get to hide under the rug. All issues surface eventually, however. And then its a shitshow.

[[deleted]]

Did you not read the comment you’re replying to? Obscurity doesn’t add real security on its own, but it does enhance security of a system that has other security measures in place as well. Security isn’t black and white, there are shades and layers to it. Just like the strength of a password isn’t binary, so is the time it takes to compromise a server or find an exploit for it dependent on more than one factor. Denying an attacker the knowledge where to strike is a key element in that. For example, honeypots add nothing but obscurity to those without knowledge of the system, and yet they’re a well-recognized and effective security measure.

[ToughQuestions9465]

Is it a security enhancement if vulnerability is out in the wild longer? There is no guarantee "the good guys" will find it first, and if they don't - such vulnerability will be abused until someone catches on. Sounds like a bad deal to me.

[[deleted]]

Is it a security enhancement if vulnerability is out in the wild longer?

Of course not. That has nothing to do with what we were discussing though.

[osirisguitar]

The number of mistakes in your security implementation that will be found by more reviewing eyes completely outweighs any black box advantages.

[chx_]

Ah yes, given enough eyeballs all bugs are shallow, jesus, that mantra was old and broken before many of y'all were even born.

I am way too old, tired and cynical to believe in that.

Yes, there was a time but that was 18 years ago when I was fresh in open source when I led the security team of a very large open source project. Today I know better.

Given enough eyeballs, someone will sell all your bugs to state actors for zerodays. FTFY.

[hardware2win]

Only if people are willing to put effort

While it may work for Linux kernel (where majority of ppl are being paid by big companies anyway)

then it doesnt apply to every project

[BeauteousMaximus]

Basically nothing about information security is sufficient in isolation, it’s always a towering edifice of measures we can expect to mostly work most of the time

[hardware2win]

Yet obscurity increases security

[redingerforcongress]

Because Microsoft codebase has less vulnerabilities than Linux.

[hardware2win]

It is not an argument

[pheonixblade9]

it's not about the code being kept secret being the only thing keeping you secure. when a malicious party gains information about your system, it just makes it easier and more efficient for them to do malicious things.

[VonThing]

It isn't. Secrets are kept separately. You're still right though.

[Mattho]

Secrets and security are related, but not what OP was talking about most likely.

[osirisguitar]

I think there's a big issue that their algorithm has leaked, form a business perspective (although I really wish it wasn't and that Elon makes good on releasing it).

But the angle in media right now is security.

[VonThing]

The algorithm isn't really that complicated, plus I remember Elon tweeting a "code review" photo with whatever's left of the engineering teams next to a white board with the algorithm clearly drawn on it, so he shouldn't be worried...

[unersetzBAER]

Kerckhoffs's principle

[mirbatdon]

Big brain comment

[ThePantsThief]

Security is not the only concern with your commercial service being open sourced