Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think centralization occurs because of economies of scale, like the talk says. But open source and protocols can decentralize things again. Security is probably the hardest thing to guarantee when all the source is out there. It takes quite a while to secure against all the obvious attacks, while attackers can see all the code. I'd trust gmail for security before I trust some small host which installed squirrelmail.

But having said that, I think that the reason a lot of stuff becomes centralized is because SOCIAL is not decentralized today. Bitcoin decentralized money but user accounts, profiles, connections etc are still done in a centralized way. That's why GitHuv and is centralized even though git is not. Social and security - if there were solutions to these, many people would decentralize.

And by decentralized, I mean you still have a server hosting your stuff, but it would be your choice - it could be on a local network, and you wouldn't even need the internet. You could be in the middle of rural Africa and your village couls run a social network, which sometimes syncs with the outside world but 99% of the communication wouldnt require it, wouldn't require those drones fb launches.

I think our company Qbix has decentralized social, in that way. It's not decentralized like bitcoin or mental poker, but honestly I don't know why zero trust is such a big deal. Even bitcoin has most people host their wallet with others amd take risks.



Trusting closed-source applications over open-source sounds odd. Security by obscurity is not desirable. What you said about open-source, everyone can read it, is a strength not a weakness.

As long as there is programming there are bugs. We can't prove correctness of all programs by writing purely functional code. Having more eyes on the same code is more likely to expose these bugs. The caveat is that everyone hopes someone else has checked the code. But I don't see how using closed-source application would solve this issue.


That's exactly it. When a startup is just starting, the bugs can be exposed and exploited. Someone's got to fix them. Not every project is huge like linux and webkit. Yes, the mantra is with enough eyes, all bugs are shallow, but in the meantime anything that could be exploited would be exploited, if the network becomes big. The effort to result ratio would be small.

Security by obscurity can be better than exposing all your code to the world where any hacked can compromise the whole network, BEFORE the fix is patched.

And even with open source, would I trust a random small host to secure it better than google? Look at all the android vendors that don't even install the latest patches.


Fuzzing systems find exploits quite effectively in systems that are only available as binaries or APIs. SBO only really works if you're obscure in the sense that hardly anyone is using the system.


Fuzzng systems can do far less than an attacker who has the whole source code.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: