March 20, 2001, 1:30 PM —
When a software company will not make the source code for a product available, one must put one's faith in something called security through obscurity. The argument for security through obscurity is simple. If crackers could get to the source code, it would be easy for them to find ways to exploit weaknesses in the product.
While that sounds like a logical argument, it is easily refuted. If you are not already convinced by the numerous Windows, Internet Explorer, and Microsoft Outlook exploits, then pay a visit to Game Copy World (see Resources for a link) sometime. You'll see just how easy it is for people to break the copy protection for games without having to see the source code. The site often publishes copy protection workarounds the same day a game is released. (By the way, I believe Game Copy World is actually providing a legitimate and valuable service. As someone with young children, I can confirm the need to make backup copies of games that get scratched and ruined by reckless little fingers.)
Ironically, we open source advocates have confidence in the security of open source software for the same reason others defend security through obscurity -- open source code actually does make it easier to spot weaknesses in a product. We simply take the next step in the logic. If having the source code makes it easy to spot weaknesses, then the best way to find and plug security holes is to make the source code as widely available as possible and solicit the input of those who use it.
NSA key revisited
A greater security risk than system cracking concerns me, one that is only possible through source code obscurity: intentional backdoors.
