3 ms·

This also highlights why it would be better to use opensource firewalls such as Openbsd instead of proprietary ones! If you care about your security then you n

by acd 11y ago

This also highlights why it would be better to use opensource firewalls such as Openbsd instead of proprietary ones! If you care about your security then you need to be able to inspect the code that protects your assets. Distributed open source firewall vs propritary firewall with backdoors.

raesene9 11y ago
Of course the idea that open source software in general, and firewalls in specific are better than closed source ones relies on people actually having the skills and time necessary to conduct a decent audit. Some of the very large security bugs found in open source software which were present in that code for years, indicate that this is not commonly done. And that was just bugs as opposed to actual backdoors which would likely be harder to find if inserted competently. So whilst in theory you are correct, I'm not so sure you are in practice.
- jordigh 11y ago
  With visible source code, at least the security bugs are actual bugs instead of deliberate attacks on the users. Psychologically, people are less likely to commit antisocial acts if they think that they are being watched. So, if nothing else, having visible source code helps reducing some attacks. The more popular a particular project is, the more watched they will feel. I therefore still trust OpenVPN a lot more than I trust Juniper. Every one of its patches goes through a public code review: https://community.openvpn.net/openvpn/wiki/DeveloperDocumentation#Developmentprocesses https://community.openvpn.net/openvpn/wiki/DeveloperDocument... http://sourceforge.net/p/openvpn/mailman/openvpn-devel/?viewmonth=201512&viewday=11 http://sourceforge.net/p/openvpn/mailman/openvpn-devel/?view...
- JeremyNT 11y ago
  Indeed, for those of us not taking the time (or lacking the expertise) to audit code ourselves, this is all ultimately appeal to authority. If anything, the advantages of open source here are more about open development processes and being able to know just who is the gate keeper. As an example, if you use OpenBSD, you have reasonable assurances that Theo will do a good job, because he has earned his reputation. Juniper? Who really knows what goes on internally? How are people allocated and shuffled around? It's a black box. Ultimately I'd put more trust in OpenBSD than in Juniper because of this, but I'm still making a leap of faith. And OpenBSD is an extreme example of how much trust a project can earn; a vast majority of open source code is not held to such scrutiny.
azernik 11y ago
Given that this was hidden even from the organization that was in control of the codebase, it's not clear that open source on its own is a real solution. This made it through whatever initial review processes Juniper has, and was only caught by an "internal code review" performed after the fact - an exercise only infrequently conducted on most open source projects. Given enough eyeballs backdoors can be easy to spot in source code, but eyeballs aren't an unlimited resource. In addition to open sourcing your software, the community that cares about the project needs enough funding or institutional support to actually review the code in question.
- Kristine1975 11y ago
  >Given enough eyeballs backdoors can be easy to spot in source code After looking at some examples of the Underhanded C contest (http://underhanded-c.org/ http://underhanded-c.org/) and its predecessor, the Obfuscated V contest (http://web.archive.org/web/20110605000401/http://graphics.stanford.edu/~danielrh/vote/vote.html http://web.archive.org/web/20110605000401/http://graphics.st...), I'm not so sure that well-implemented backdoors are easy to spot.
tyingq 11y ago
I agree with the premise, but I'm not aware of an open source firewall that can provide the same functionality and scale as Juniper's product line. You can certainly provide, for example, open source designs for a specialized ASIC, but it doesn't mean anyone could afford to actually make it.
- tyingq 11y ago
  Mmm. For those downvoting, it's fairly easy to compare features and throughput. The pfSense team is making great strides, and has a roadmap that starts to close the gap. But, there is a notable gap. Compare throughput for a 3DES vpn for example. Or total throughput with filtering on.
kbenson 11y ago
Not that OpenBSD hasn't had its own scares[1]. If you find those allegations feasible, even if you don't believe they are true in this instance, then you should not necessarily consider open source and/or free security software as more secure than commercial software. 1: https://www.schneier.com/blog/archives/2010/12/did_the_fbi_pla.html https://www.schneier.com/blog/archives/2010/12/did_the_fbi_p...

by acd 11y ago

raesene9 11y ago

Of course the idea that open source software in general, and firewalls in specific are better than closed source ones relies on people actually having the skills and time necessary to conduct a decent audit. Some of the very large security bugs found in open source software which were present in that code for years, indicate that this is not commonly done. And that was just bugs as opposed to actual backdoors which would likely be harder to find if inserted competently. So whilst in theory you are correct, I'm not so sure you are in practice.

jordigh 11y ago
With visible source code, at least the security bugs are actual bugs instead of deliberate attacks on the users. Psychologically, people are less likely to commit antisocial acts if they think that they are being watched. So, if nothing else, having visible source code helps reducing some attacks. The more popular a particular project is, the more watched they will feel. I therefore still trust OpenVPN a lot more than I trust Juniper. Every one of its patches goes through a public code review: https://community.openvpn.net/openvpn/wiki/DeveloperDocumentation#Developmentprocesses https://community.openvpn.net/openvpn/wiki/DeveloperDocument... http://sourceforge.net/p/openvpn/mailman/openvpn-devel/?viewmonth=201512&viewday=11 http://sourceforge.net/p/openvpn/mailman/openvpn-devel/?view...
JeremyNT 11y ago
Indeed, for those of us not taking the time (or lacking the expertise) to audit code ourselves, this is all ultimately appeal to authority. If anything, the advantages of open source here are more about open development processes and being able to know just who is the gate keeper. As an example, if you use OpenBSD, you have reasonable assurances that Theo will do a good job, because he has earned his reputation. Juniper? Who really knows what goes on internally? How are people allocated and shuffled around? It's a black box. Ultimately I'd put more trust in OpenBSD than in Juniper because of this, but I'm still making a leap of faith. And OpenBSD is an extreme example of how much trust a project can earn; a vast majority of open source code is not held to such scrutiny.

azernik 11y ago

Given that this was hidden even from the organization that was in control of the codebase, it's not clear that open source on its own is a real solution. This made it through whatever initial review processes Juniper has, and was only caught by an "internal code review" performed after the fact - an exercise only infrequently conducted on most open source projects. Given enough eyeballs backdoors can be easy to spot in source code, but eyeballs aren't an unlimited resource. In addition to open sourcing your software, the community that cares about the project needs enough funding or institutional support to actually review the code in question.

Kristine1975 11y ago
>Given enough eyeballs backdoors can be easy to spot in source code After looking at some examples of the Underhanded C contest (http://underhanded-c.org/ http://underhanded-c.org/) and its predecessor, the Obfuscated V contest (http://web.archive.org/web/20110605000401/http://graphics.stanford.edu/~danielrh/vote/vote.html http://web.archive.org/web/20110605000401/http://graphics.st...), I'm not so sure that well-implemented backdoors are easy to spot.

tyingq 11y ago

I agree with the premise, but I'm not aware of an open source firewall that can provide the same functionality and scale as Juniper's product line. You can certainly provide, for example, open source designs for a specialized ASIC, but it doesn't mean anyone could afford to actually make it.

tyingq 11y ago
Mmm. For those downvoting, it's fairly easy to compare features and throughput. The pfSense team is making great strides, and has a roadmap that starts to close the gap. But, there is a notable gap. Compare throughput for a 3DES vpn for example. Or total throughput with filtering on.

kbenson 11y ago

Not that OpenBSD hasn't had its own scares[1]. If you find those allegations feasible, even if you don't believe they are true in this instance, then you should not necessarily consider open source and/or free security software as more secure than commercial software. 1: https://www.schneier.com/blog/archives/2010/12/did_the_fbi_pla.html https://www.schneier.com/blog/archives/2010/12/did_the_fbi_p...