OSS security debate: security through obscurity vs thriving in max entropy
fkasummer · x · 2026-11-05
A debate on open-source security. @venki argues 'end of OSS / security through obscurity' has merit: attackers get white-box access to find and deeply verify vulnerabilities, and one discovered bug can be reused against many targets — while an equivalent bug in closed-source compression code reachable only via HTTP is far harder to find.
fkasummer counters: you want to thrive in max entropy, not defend an arbitrary bound against adversaries' intelligent entropy pump — identify the equilibrium maximizing collective leverage (knowledge in OSS); the other direction is fatal.
More from Safety
- Palisade defends AI self-replication proof-of-concept, says wild spread is inevitable — JeffLadish · 2026-11-05
- Guidelight ships Capability Testing standard v1.0 with sandbagging-detection practice — dfrsrchtwts · 2026-11-05
- MCP over HTTP: validating OAuth tokens isn't enough—check the audience claim — alvelda · 2026-11-05
- keltan updates Astra sandbagging analysis: no large updates from new evidence — repligate · 2026-11-05
- Texas lawmaker wants data centers to pay their own energy, recycle water, get community consent — Scobleizer · 2026-11-05
- Residential proxy exits detected on White House network: 236 exits via 28 services — matthew_d_green · 2026-11-05