That's the one. She stopped doing that

Show Post

If you quietly open-source something and no defenders join you, seems like pure downside from a security perspective (though it may still be worthwhile for ideology or to send a message). But if your project gets some attention and some friendly eyes on it? You might be far better off.

Show Post

Security though obscurity isn't REAL security, but one would imagine access to the codebase makes finding vulnerabilities easier for attackers and defenders both. Ofc, by not open-sourcing the project, you limit the defending team to yourself.

Show Post

PHP/node/etc. would still have to be shipped to the end-user in binary form. Any security researcher would have to throw it through a decompiler but would likely still reach the same results. What you lose out on is the ability for anyone else to audit or contribute to it.

Show Post

Watched this exact debate go down at work today. It’s tough out there!

Show Post