@downey@floss.social @relay@relay

[mrfoostang@foostang.xyz]

@downey@floss.social @relay@relay.infosec.exchange As much as I wish this were true, it’s not. Obscurity is a valid security layer and open source software with exposed source code _does_ make it easier for attackers to find attack vectors.

Without access to source code an attacker has to infer vulnerabilities by hitting the code. Those recon hits are visible in security tools like SIEMs.

Open source vulnerabilities can be discovered directly from the source and the attacker can craft the perfect exploit without ever touching production code. Then hit it once very effectively, probably escaping detection because there’s no recon signals.

The days of #OSS being used for actual critical applications is drawing to a close.

#infosec