Comment by a_simple_man | Hacker News Reader

Comment by a_simple_man | Hacker News Reader

Parent Full thread

how are those systems going to be secure without being audited by the market?

the reality is that this military industrial complex is just a way to print money and funnel it into the hands of a few criminals. all of the major news publications openly told you that the USA has been attacked over 100 times in the middle east AND WE LEFT. The public is going to find out very soon that this massive, expensive military can't actually defend against or defeat other militaries. That when you spend $1000 on a hammer everything looks really flashy and impressive AT FIRST with your fancy jets and missile systems, but after enough time, and after enough of the money has been funneled out, you realize it's a paper army. the USA is so weak that Iran is pushing them out of the middle east and there's nothing the theives that run the military can do about it. but don't worry. they already manufactured a Palestine sympathy story ahead of time to explain why they have to pull out and run away like the cowards they are. and your son's and neighbors sons will pay the price with their lives

Every time I’ve been involved with selling software in any way adjacent to national security they’ve required source code review.

How are you equating a "code review" to open source, the difference is the difference between asking a couple dudes for advice and asking the entire world for advice. I'm sure the argument sounded really good in your head, but let's be adults here when it comes to the United States military

Because auditable does not mean the same thing as audited. It is silly that people keep pushing that dead argument after Heartbleed pounded a stake through its heart. Audits are time consuming, challenging, and boring. Experience shows even critical, high profile projects hardly get any review at all by the "world", let alone actual audits by competent domain experts.

Quality verification depends on auditing and auditing depends on competent, trusted review and testing. Global transparency is not a substitute for auditing except when discussing absolute rock-bottom standards. Reviewable is significantly better than unreviewed and unreviewable, but that is the lowest possible bar. Unfortunately, software does, as a general rule, have rock-bottom auditing standards, so FOSS does provide meaningful assurance increases in many use cases. But, that is a artifact of the abysmal quality standards rather than any sort of inherent auditing advantage that FOSS provides. That is not to say that global transparency is not valuable for other reasons, but it provides no meaningful quality verification or auditing advantage in serious applications versus local transparency (to the trusted reviewer).

If you want to see how this works in practice, look at literally every other industry.

the market will determine what should and should not be audited, according to supply and demand. thinking that a couple employees that were not paid for with profit but with printed and taxed government dollars is not and never will be a substitute for the free market, which is a synonym for humanity. not respecting that fact will always result in loss and inefficiency. and no amount of paragraphs can undo that.

The market has been horrid in determining that. There are a few dozen massive companies funding a significant amount of the menial and boring work done on FOSS. Possibly because they have more to lose from their competitors building moats and wide-scale incidents.

Thankfully governments are now also funding FOSS work but this really doesn't align with what you're envisioning, I think.

Reply on news.ycombinator.com