Free and Open Source Software

17919 readers

90 users here now

If it's free and open source and it's also software, it can be discussed here. Subcommunity of Technology.

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago

MODERATORS

[email protected]

What's stopping banks from creating FOSS (or atleast open-source) banking solutions (apps)? (fost.hu)

submitted 11 months ago* (last edited 11 months ago) by [email protected] to c/[email protected]

44 comments fedilink hide all child comments

Let's say, I create a bank with the caveat that all of my banking phone apps and webapps are FOSS (or if they depend on non-free components — banks probably do to communicate with each other —, then just OSS). Am I going to be behind the competition by doing this?

If the most secure crypto algorithms are the ones that are public, can we ensure the security of a bank's apps by publicizing it?

Are they not doing this because they secretly collect a lot of data (on top of your payment history because of the centralized nature of card payments) through these apps?

EDIT: Clarifying question: Is there a technical reason they don't publicize their code or is it just purely corporate greed and nothing else?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 1 points 11 months ago (1 children)

I think you might have read it backwards, I equated closed source with security by obscurity. And obviously you can have both, if you pay extra.

Sure, finance is not technology, but I think it’s worth it pointing out that it’s not arbitrary or just greed or whatever, it has technicalities too.

[–] [email protected] 1 points 11 months ago (1 children)

That was quite vague and still hard to interpret the trade you mention. But I’ll say generally security benefits from:

a good number of careful eyes on the code
bug bounty programs
audits
red teams

Closed source has the false sense of security pitfall, which stems from the mentality that code secrecy is a protection of some kind. That pitfall is avoidable simply by not using it as a crutch for lacking security. Open source automatically avoids that pitfall. Bug bounties (2) help get motivated eyes (1) on the code (eyes motivated by generous legit rewards, as opposed to the reward of a zero day in the wrong hands). From there, I see no advantage to closed-source here.

[–] [email protected] 1 points 11 months ago* (last edited 11 months ago)

I'm in total agreement that OSS builds more secure software. What I'm saying is that these companies are not in the business of building safe software.

From there, I see no advantage to closed-source here.

I think the easiest mental map is this: doing things well has a cost; doing things poorly can be cheaper; if it's way cheaper and there's some method available to de-risk it even if a little bit, no matter how little effective it is, it might be financially advantageous to pick the inferior option. This is not just for security, but pretty much everything.