I recently learned that my company prefers closed-source tools for privacy and security.
I don’t know whether the person who said that was just confused, but I am trying to come up with reasons to opt to closed-source for privacy.
I recently learned that my company prefers closed-source tools for privacy and security.
I don’t know whether the person who said that was just confused, but I am trying to come up with reasons to opt to closed-source for privacy.
In my experience the “privacy and security” argument is a smokescreen.
The real reason is that it makes someone else responsible for zero-days occuring, for the security of the tool, and for fixing security problems in the tool’s code. With open source tools the responsibility shifts to your cybersecurity team to at least audit the code.
I don’t know about your workplace, but there’s no one qualified for that at my workplace.
A good analogy: If you build your house yourself, you’re responsible for it meeting local building codes. If you pay someone else to build it, you can still have the same problems, but it’s the builder’s responsibility.
That smokescreen argument makes a lot of sense. Both the company and our clients, tend to opt for ready out-of-the-box proprietary solutions, instead of taking responsibility of the maintenance.
It doesn’t matter how bad or limiting that proprietary option is. As long as it somewhat fits our scenario and requires less code, it’s fine.
This is why, they prefer to shift the blame in case it hits the fan. That’s all, that’s it.
They don’t care about code quality, maintainability or whatever.
When you get right down to it, it’s all risk management.
It doesn’t matter if the code is open here. Depending on what your company does, it might be cheaper to buy ready to use products by some vendor than paying software/sysadmin guys to review, deploy and maintain. It can be even required by law. Needless to say there are many software vendors selling contract for open software, either hosted or fully deployed and supported. Still in many fields like medical due to vendor lock ins there aren’t many feature complete open software and you need the programs to be reliable, usable by non technical people and virtually unchanged over long time. To provide these guarantees without depending on proprietary vendors means to make your own software company (and perhaps open up your work not to become just another closed software) and nobody does that.
Security works kinda the same. But in these contexts if someone uses privacy and security together like this it’s probably just bs.