DEV Community

Discussion on: Is open-sourcing server-side code a security threat?

Collapse
 
patarapolw profile image
Pacharapol Withayasakpunt • Edited

I think licensing and make a lawsuit is another topic. Of course, I know LICENSE is one thing, and sue is another.

That should be thought be open sourcing or licensing.

Thread Thread
 
_hs_ profile image
HS

Licensing has no impact on you knowing that anyone took your backend code nor gives you any ability to detect such things if you have non obfuscated code (even when you do but it's quite improbable) especially in languages where you use only that language; like Java where you mainly relies on Java libraries and most people avoid native calls except well-known ones from the system or such were you depend on other external parties that you have no influence of.

Let's say you get your Python/Java/whatever service online and expose that code on GitHub. Someone clones it, makes a couple of changes to fit their idea and is silent competitor to you with smaller prices since he didn't invest in human resources to get the API done. He makes fully new frontend and viola. How can you ever know that he didn't just had same idea? Would you really ask someone to check their code if it looks like yours? Only way to know is to have some developer inside their company and tell rest of the world ohh this is copy from X project.

This can happen with small or maybe even mid size projects, while big ones are not as vulnerable as even getting up and running such projects might cost a small fortune and a lot of professionals. And no one ever has to know. You loos potential clients you fail to generate enough revenue to keep project alive and your company suffers. It doesn't matter if someone who did a copy fails also, you were damaged and never knew. Or it doesn't even matter if you knew if you failed because of it nothing will fix it since customers went away and have no intention of coming back.

So I would say that at some point if you get big enough you don't have to worry about getting damaged by stolen code then you can consider these issues about security. If you don't keep sensitive info you can risk bad hacker not reporting bug and using it to steal info which may impact your revenue but not actual end users which should be less of a worry than exposing actual user info.

Thread Thread
 
patarapolw profile image
Pacharapol Withayasakpunt

That's not the security issue. It's the business-building issue.

Thread Thread
 
_hs_ profile image
HS

Not focusing on security with that answer but rather replying to your Licensing comment as solution to it. How does the licensing solve security at all? It doesn't. This part "What about bad people reading code finding security issues before others and not reporting it but abusing it?" was security and licensing doesn't help in any case. If you don't detect malicious activity on time nothing helps