Ask HN: Is Heartbleed a good argument for using closed source?

https://news.ycombinator.com/item?id=7566528

by jheriko • 12 years ago

1 4 12 years ago

news.ycombinator.com

We know that websites hosted on e.g. the MS tech stack are basically unaffected by Heartbleed due to their having their own implementation rather than OpenSSL. Even if such a vulnerability exists it is hard to find in source code that isn't publicly available - i'm not sure if thats an argument for or against - or perhaps part of both. The counter of course is that such vulnerabilities are less likely to be discovered (and therefore quickly fixed). Thoughts?

total• 12 years ago

While I'm a novice, at best, on such issues, I personally believe that the more eyes on the code, the better. A team of developers can't possibly account for any and all mistakes, bugs, etc. The code should be secure enough that allowing people to see it wouldn't undermine its security efforts.

jheriko2• 12 years ago

The code should be secure enough that allowing people to see it wouldn't undermine its security efforts.

That is a good idea IMO. :)

LeoSolaris• 12 years ago

Quite the opposite, as total mentioned. If this had been closed source, we would have not known about the bug, and it likely would have stayed around for a lot longer... until someone wanted to modify that particular part, or do a fresh rewrite from scratch.

jheriko2• 12 years ago

sure, i do mention this - but what about the difficulty in finding the vulnerability?

Ask HN: Is Heartbleed a good argument for using closed source?

Related Stories