By Kaspersky Lab [Public domain], via Wikimedia Commons
In a reactionary move most likely guided by fear rather than by measurable security benefit the company Symantec has decided to stop letting countries analyze it's source code. Why might this be a problem? Just because the source code cannot be directly analyzed it does not mean the flaws don't exist or that it cannot be indirectly analyzed. Should we finally move away from closed source "anti-virus" software?
While Symantec once allowed the reviews, Clark said that he now sees the security threats as too great. At a time of increased nation-state hacking, Symantec concluded the risk of losing customer confidence by allowing reviews was not worth the business the company could win, he said.
To put it another way, should we change the trust model and shift the trust away from companies like Symantec and onto a global network of source code auditors? Is there any evidence that merely not disclosing the vulnerabilities inherent in the code that this will somehow benefit security? What about the possibility of backdoors? Any time software is closed source or pre-compiled you really cannot know what the software is doing. Governments likely do seek to put backdoors in any closed source software but I do not see how this particular kind of secrecy does anything to benefit actual security or even the perception of safety. Less eyes reviewing the code is still less eyes reviewing the code.
If anyone has a cybersecurity background feel free to offer your opinion on this.
thanks for sharing
looking forward more from you
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
I'm skeptical of open source antivirus because making the source code available makes it easier for hackers to find vulnerabilities. If the project contributors reveal all of their secrets, would they really be able to keep up with malicious actors?
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
This sounds like a horrible decision to me personally. Fresh out of college, it is basically ingrained in our heads that security through obscurity does not work.
Just because people cannot see your source code does not mean they can't find vulnerabilities. I feel it adds too much ability for nefarious actors to find vulnerabilities while white hats are not even looking for any.
And like you stated, you then have no idea of how they are actually implenting their code. There is no way to no for sure it is secure or not. It is lack closed source encryption vs open. Do you want encryption that has been tried and tested by the community, or encryption that says it is great with no community consensus. It puts heavy trust onto the company to find their own vulnerabilities..... But how can a team of, let's be generous, 100 people, do better than the entire security community....
It'll be interesting to ask my colleagues at work tomorrow about this as we use SEP for all of our workstations.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Thanks for sharing! Any safe software you would recommend?
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit