security through obscurity pros and cons

Security through obscurity pros and cons software#

Security through obscurity pros and cons software#

This is a fact highlighted by the report, which found that the average number of days to fix a vulnerability is currently 97.8 – leaving enterprises running that software open to attacks for many months. Even worse: only 49% of organizations have an open-source security policy.Įven if a security issue is found in open-source software, it does not mean someone will fix it. That’s 15,000+ lines of code per active developer!Ī recent report from the Linux Foundation found that the average number of outstanding critical vulnerabilities in an application is 5.1, and that 41% of organizations are not confident in their open source software security. For example: the Linux kernel project has 30+ million lines of code, hundreds of bugs that need to be fixed, and almost 2000 active developers working on it. This can be a challenge even for larger open-source projects. There are widely used open-source projects that are being maintained by only a small number of engineers, and those engineers cannot be entirely altruistic with their contributions of time and effort – they, too, have bills to pay. The challenge of OSS security is that just because everyone can look at the source code, it does not mean anyone will.

After all, why would we continuously try and write code that solves problems that others have already solved? Why not share the knowledge and gradually and incrementally improve existing open-source solutions? These egalitarian ideals are arguably central to civilization itself – never mind software – but also contain underlying tensions that have been a challenge for generations. Open-source software (OSS) has a lot of advocates.