nemo

> The alternative, a secret weak algorithm we hope people don't discover vulnerabilities in, is super unsatisfying to me.

Yeah but somehow, people still believe security by obscurity is a valid strategy. I think it's just intuition but maybe this is a prime example where intuition is wrong.

I would rather build everything in the open and get exploited on day 1 and then fix it than build secretly and then hope no one is going to find a single exploit.

Going from proprietary software to OSS code is a whole different topic though. I think it's hard to be confident enough in your code to release it if you built it long enough not in the open. But maybe that's another sign that security by obscurity doesn't work "at scale". 

Daily discussion thread

saloon

That's right.

I'd also add that fastest way we'll improve the algorithm's gamelessness is by helping people "play the game," observe, and correct it. 

The alternative, a secret weak algorithm we hope people don't discover vulnerabilities in, is super unsatisfying to me. 