cross-posted from: https://fost.hu/post/226135

Let’s say, I create a bank with the caveat that all of my banking phone apps and webapps are FOSS (or if they depend on non-free components — banks probably do to communicate with each other —, then just OSS). Am I going to be behind the competition by doing this?

If the most secure crypto algorithms are the ones that are public, can we ensure the security of a bank’s apps by publicizing it?

Are they not doing this because they secretly collect a lot of data (on top of your payment history because of the centralized nature of card payments) through these apps?

EDIT: Clarifying question: Is there a technical reason they don’t publicize their code or is it just purely corporate greed and nothing else?

  • OhNoMoreLemmy@lemmy.ml
    3·
    1 year ago

    Yeah I thought you'd ask this. Basically they'll never do this, just because their attitude is "fuck you I'm a bank".

    Beyond this, there's a big difference between source code and having a working system.

    For very long running systems their state depends very heavily on how they were maintained, little bits of informal design decisions that get components working together, and the order stuff was loaded in, and what other services were up and running when you booted up.

    None of this magic is captured by source code, and it can make even setting up a replacement server, even as part of the same infrastructure really hard.

    Of course banks are moving to more modern dev methods that encourages turnkey deployment, but the fact that they still rely on a bunch of COBOL code tells you there's a lot of very old system running in "do not touch" mode