Technology

I'm sure there are exceptions for classified systems. Personally, I do believe all things developed by tax payer money should be released to the public including classified systems, given enough time has passed that the release of such information wouldn't put anything or anyone at risk.

yet just a few days ago, open source software was the key to destroying dozens of bomber planes in Russia

Good thing no bad actors have root access!Agreed; open source software is so notoriously insecure.

Maybe it's the military that's incompatible with our values, not open source

You know open-source doesn't mean publicly available. It means the person, or in this case the US government, that brought the software should have free access to the source code to edit and distribute it as they like.

So yes, the military should use something functional equivalent to open source to prevent vender lock in and to allow for external audits. They probably shouldn't give it to Russia or make it freely available online though.

I am fairly confident that theNSA is aware of this kind of concern and they have an pretty cool repo.

Watch this thread from here on in carefully separate the idealists from those who know what defence is like.

• yes, open-source is the goal of everything that can be opened.
• no, defence code isn't on the list of what can be opened
• yes, obscurity isn't good as a sole effort
• yes, defence in depth
• no the funding to get it to where it's safe to open for randos to submit changes isn't there today

Anything I missed?

Yes, Virginia, it's better to open all the things right now, but there are risks you haven't taken into account because you're not aware of them. The pros are; it's their job and their work, so listen to their expertise no matter what the oppositional/defiant disorder suggests otherwise.

Don't worry, that's all written by defense contractors anyways, so they'll sell it to the US, and to others the US allows, all closed source. The source won't even be open to the US government, either, as that'd harm the bottom line of the contractor (support & maintenance contracts for that closed-source software).

The problem you’re describing (open sourcing critical software) could both increase the capabilities of adversaries and also make it easier for adversaries to search for exploits. Open sourcing defeats security by obscurity.

Leaving security by obscurity aside could be seen as a loss, but it’s important to note what is gained in the process. Most security researchers today advocate against relying on security by obscurity, and instead focus on security by design and open security. Why?

Security by obscurity in the digital world is very easily defeated. It’s easy to copy and paste supposedly secure codes. It’s easy to smuggle supposedly secret code. “Today’s NSA secrets become tomorrow’s PhD theses and the next day’s hacker tools.”

What's the alternative for the military? If you rely on security by design and open security for military equipment, it’s possible that adversaries will get a hold of the software, but they will get a hold of software that is more secure. A way to look at it is that all the doors are locked. On the other hand, insecure software leaves supposedly secret doors open. Those doors can be easily bashed by adversaries. So much for trying to get the upper hand.

The choice between (1) security by obscurity and (2) security by design and open security is ultimately the choice between (1) insecurity for all and (2) security for all. Security for all would be my choice, every time. I want my transit infrastructure to be safe. I want my phone to be safe. I want my election-related software to be safe. I want safe and reliable software. If someone is waging a war, they’re going to have to use methods that can actually create a technical asymmetry of power, and insecure software is not the way to gain the upper hand.

I'm sure a lot of military software, in contrast, is acquired from private companies that retain IP rights. Likely legal exceptions aside.

The GitHub page has a section for this:

Exempted Code

Not all source code, documentation and metadata used in the development of Direct File is included in this repository. Specifically, any code or data that is considered Personally Identifiable Information (PII), Federal Tax Information (FTI), Sensitive But Unclassified (SBU), or source code developed for National Security Systems (NSS), as defined in 40 U.S.C. § 11103, is exempt. Due to these restrictions, certain pieces of functionality have been removed or rewritten.

Depends on the application.

In some cases, it would be fantastic. But it’s clearly not a one size fits all, yeah.

Our entire Internet, the backbone of all encryption, all runs on open source software.

It is more secure because people can see and audit the code.

Let me flip what you wrote:

Our military equipment already is vulnerable. We just don't know how badly because it's not open source.

Prove it's secure by releasing the code.

security through obscurity is not security