Quote from: jeffsandwich on July 23, 2012, 05:55 pmQuote from: LouisCyphre on July 21, 2012, 05:55 pmWhat I'd like to see is the message and order system released so that it can be independently audited to confirm there are no security flaws in it, that the encryption on the messages is up to par and that orders (e.g. addresses) are securely deleted when finished.If I wrote the software and you asked for it to be open source, I'd probably tell you to get fucked. Any sensitive info should be encrypted PGP on your end, and if you don't that's your bad. You should realize that worst-case, they would be able to login to your account and few your current orders + feedback + any unencrypted messages. As long as you operate off of that assumption, I don't see too many potential risks.Oh, I'm well aware of that. The shocking thing is the number of people here who aren't and how many of them are vendors.Quote from: jeffsandwich on July 23, 2012, 05:55 pmAlso if they released the source code, I'm sure someone would find some tiny hole and fuck us all and cheat the system. Security by source control isn't ideal, but hopefully it's written by someone with a little security background and the main things you'd easily discover on your own (WITHOUT it's source code) are taken care of.Security through obscurity is no security at all.Fortunately the majority of the site appears to just be HTML and CSS, although that can be deceiving (see below). DPR has also said that the new version will be the same, which is why I only really care about the message and order system. At least we don't have to worry about the sort of problems opened up by Javascript.That said, a determined and sufficiently proficient attacker may still find a way in without access to the code and then we're still fucked. Remember, Tor can run just about any protocol across it if you configure your systems to handle it.Now, I was going to say above that we didn't have to "worry about the sort of problems opened up by PHP and Javascript" but it turns out that isn't accurate. Going to a deliberately wrong page on the SR site (without logging in) results in this error message:QuoteAn Error Was EncounteredUnable to load your default controller. Please make sure the controller specified in your Routes.php file is valid.PHP. Hmmm, now what happens if we do a Google search on "php exploit" ... I'm not going to bother because I already know the list is large.Running a search on that specific error message indicates that error is common with a PHP framework called CodeIgniter. Then we just run another search for "codeigniter exploit" and lo and behold there's a list of SQL injections, remote file vulnerabilities, etc.That's what I found in five minutes. Ten if you count wandering into the kitchen to make a cup of coffee.The point is that flaws can be found in any system whether the source code is available to the attacker or not. Shit, hacker tales from the past thirty years are filled with such anecdotes. Opening the source code to peer review makes it more likely that flaws will be found quicker and more easily. More importantly it means that those flaws will be fixed.I guarantee you there will be flaws and some enterprising person, whether in law enforcement or otherwise, will be looking for them.