4 ms·

Of course the idea that open source software in general, and firewalls in specific are better than closed source ones relies on people actually having the skill

Of course the idea that open source software in general, and firewalls in specific are better than closed source ones relies on people actually having the skills and time necessary to conduct a decent audit. Some of the very large security bugs found in open source software which were present in that code for years, indicate that this is not commonly done. And that was just bugs as opposed to actual backdoors which would likely be harder to find if inserted competently. So whilst in theory you are correct, I'm not so sure you are in practice.

jordigh 11y ago
With visible source code, at least the security bugs are actual bugs instead of deliberate attacks on the users. Psychologically, people are less likely to commit antisocial acts if they think that they are being watched. So, if nothing else, having visible source code helps reducing some attacks. The more popular a particular project is, the more watched they will feel. I therefore still trust OpenVPN a lot more than I trust Juniper. Every one of its patches goes through a public code review: https://community.openvpn.net/openvpn/wiki/DeveloperDocumentation#Developmentprocesses https://community.openvpn.net/openvpn/wiki/DeveloperDocument... http://sourceforge.net/p/openvpn/mailman/openvpn-devel/?viewmonth=201512&viewday=11 http://sourceforge.net/p/openvpn/mailman/openvpn-devel/?view...
JeremyNT 11y ago
Indeed, for those of us not taking the time (or lacking the expertise) to audit code ourselves, this is all ultimately appeal to authority. If anything, the advantages of open source here are more about open development processes and being able to know just who is the gate keeper. As an example, if you use OpenBSD, you have reasonable assurances that Theo will do a good job, because he has earned his reputation. Juniper? Who really knows what goes on internally? How are people allocated and shuffled around? It's a black box. Ultimately I'd put more trust in OpenBSD than in Juniper because of this, but I'm still making a leap of faith. And OpenBSD is an extreme example of how much trust a project can earn; a vast majority of open source code is not held to such scrutiny.

jordigh 11y ago

With visible source code, at least the security bugs are actual bugs instead of deliberate attacks on the users. Psychologically, people are less likely to commit antisocial acts if they think that they are being watched. So, if nothing else, having visible source code helps reducing some attacks. The more popular a particular project is, the more watched they will feel. I therefore still trust OpenVPN a lot more than I trust Juniper. Every one of its patches goes through a public code review: https://community.openvpn.net/openvpn/wiki/DeveloperDocumentation#Developmentprocesses https://community.openvpn.net/openvpn/wiki/DeveloperDocument... http://sourceforge.net/p/openvpn/mailman/openvpn-devel/?viewmonth=201512&viewday=11 http://sourceforge.net/p/openvpn/mailman/openvpn-devel/?view...

JeremyNT 11y ago

Indeed, for those of us not taking the time (or lacking the expertise) to audit code ourselves, this is all ultimately appeal to authority. If anything, the advantages of open source here are more about open development processes and being able to know just who is the gate keeper. As an example, if you use OpenBSD, you have reasonable assurances that Theo will do a good job, because he has earned his reputation. Juniper? Who really knows what goes on internally? How are people allocated and shuffled around? It's a black box. Ultimately I'd put more trust in OpenBSD than in Juniper because of this, but I'm still making a leap of faith. And OpenBSD is an extreme example of how much trust a project can earn; a vast majority of open source code is not held to such scrutiny.