The other benefit of Open Source is that good projects tend to attract the best minds and the best talent, which leads to the best possible software design. And secure design is what makes secure software. Compare that to the approach of closed-source vendors, who release their software to the public and patch as necessary. If this were an effective security strategy, Internet Explorer would have run out of vulnerabilities years ago.

I don’t release all of my software source code anymore for that part of that reason. I have unfortunately, had clients go and reuse software I had originally written for them. If I increase my prices to cover the possibility of theft, then it makes it difficult to secure clients. (I’ve gone to Open Office because it is hard for me to justify MS Office’s price.) If the code isn’t provided, and I encode some specific elements for the site into the code, as a security measure against theft, it allows me to keep the prices down. This is the same reason why stores put security tags on their merchandise; it’s cheaper than letting it walk out the door.

However, the operative phrase there is “primarily or solely,” since obscuring certain details of an application is often an important part of a defense-in-depth strategy.

@Chris: This is possibly the most poignant piece I have ever read on this subject, bravo. I could not agree more.

It’s simply a fact that it’s far easier to find bugs/loopholes in someones code, if you can actually read the code in the first place. Surely that’s the point that is being made here?

If there is no security in obscurity, why bother turning off server signatures in Apache, or why not just leave that phpinfo page up?

I don’t advocate writing sloppy code and hiding it through encryption, but lets face it… most ‘bugs’ are simply features that weren’t intended. Features that are not part of the regular functionability of the application… Features usually found by studying the source code.

Just look at any security site and you’ll see hundreds of open source applications on there, many quite respected.

You must have laughed out loud when you read this nugget… “Serious business demands closed source” I’ll have to read it in context in the article, but that’s just bad….

This is also one of the major arguments (in my opinion) there is against open source code. If you buy code, you buy a warranty that the code will work.

If the code has bugs it will be fixed, or I can at least ask the author.

I don’t know this for sure, but I think vBulletin code isn’t secured and they are still selling their work.
That’s an example that business is working without encrypted code.

BTW: doesn’t make encryption your code slower at runtime, or is Zent using a “compiled/unencrypted” version internally?