undefined | Better HN

0 pointscudgy1y ago0 comments

So why bother securing anything at all if not willing to secure the raisons d'être? Doesn’t that suggest that these companies are trivial entities?

0 comments

3 comments · 2 top-level

ThePyCoder1y ago· 1 in thread

Only if you see source code as the only valuable thing, which it isn't. The knowledge of the team, industry connections, experience etc etc are a big part of what make it so you can effectively use the source code.

We're making an industrial sorting machine. Our management is feared to death to lose the source code. But realistically, who's going to put in the time to fully understand a codebase we can barely grasp ourselves? Then get rid of all custom sensor mappings, paths and other stuff specific for us. And then develop on it further, assuming they even believe we have the "right" way of doing things?

Right, no one. 90% of companies could open source their stuff and, apart from legal nonsense, nothing practical will happen, no one will read the code.

cudgyOP1y ago

You just supported my point that these companies at their core have little value. A team? Teams are fleeting and easily replaced given the hiring and firing (and poaching) practices of companies. Industry connections? Maybe to some degree, but those are fleeting as well and how do you value it? Most of these connections are held by relatively few people in the company.

Companies in other legal jurisdictions will and can steal ip with little impunity and throw new AI tools to quickly gather an understanding of the codebase. Furthermore, knowledge of source provides a roadmap to attack vectors for security violations. Seems foolish to dismiss the risks of losing control of source code.

golergka1y ago

There are plenty of very realistic attack scenarios, that's why we secure stuff.

j / k navigate · click thread line to collapse