4 ms·

To me it's kinda baffling that an open source project so intensively used had a root privilege exploit for years. It is often said that open source is inherentl

To me it's kinda baffling that an open source project so intensively used had a root privilege exploit for years. It is often said that open source is inherently more secure because "everyone can look at the source" yet quite a few exploits in in the last few years alone kindly proved the opposite. This is not a jab at open source software, just at the general statement which people like to throw around when referring to the security of open source software; "It's open so it must be safe!"

oldmanjay 11y ago
i guess learning that unqualified opinions don't really convey useful information is a valuable lesson no matter how you learn it.
redahs 11y ago
Open source is inherently more secure then closed source, not because of how the code is written and reviewed, but because of how the code is published and distributed. Suppose we have two projects with 100% identical source code, which are mathematically proven to both contain 0 bugs, and which have been extensively audited by third parties. Despite being identical, the open source version will be much more secure for end users, because the source code and machine code can be obtained, compiled and distributed by a much larger number of competing parties. This allows users to compare compiler output and run-time behavior, to verify that software being run is actually the software being written, and to ensure that the software is not surreptitiously modified by the publisher during its distribution. With closed source software, even if developers write a 100% perfect codebase, the end users have no way of knowing whether they are actually getting that specific code base in their binaries, as there are legal and technical barriers in place preventing them from reliably making that verification for every change.
- chatmasta 11y ago
  What about the corollary to that? Open source code is more accessible than closed source code, not only to reviewers, but also to vulnerability hunters. For every honest reviewer, there can be a malicious one. Also consider the profit incentives are stronger for malicious reviewers than they are for friendly ones.
  - 5ilv3r 11y ago
    The National Institute of Standards and Technology (NIST) in the United States specifically recommends against this practice https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity
cyphar 11y ago
Free software allows users to get access to fixes for systems not supported by vendors. Saying "free software" is more secure is not correct (just look at libpurple, a free software library riddled with bugs). What is correct is that you have a much better shot at white hats and security researchers finding bugs in free software, and the fixes for those bugs being freely available. Black hats (trust me, I've known a few) will gladly attack proprietary software (usually with more glee, because there's far less review of proprietary software in general). Using proprietary software doesn't save you from black hats. But it does give you more chances of white hats finding the bugs sooner. Security isn't a binary state, it's a lifestyle. All code has bugs, and almost all bugs can be security bugs. Taking steps to add more layers to your security is what you should be doing, not arguing that "because the software is free someone found it!".

oldmanjay 11y ago

i guess learning that unqualified opinions don't really convey useful information is a valuable lesson no matter how you learn it.

redahs 11y ago

Open source is inherently more secure then closed source, not because of how the code is written and reviewed, but because of how the code is published and distributed. Suppose we have two projects with 100% identical source code, which are mathematically proven to both contain 0 bugs, and which have been extensively audited by third parties. Despite being identical, the open source version will be much more secure for end users, because the source code and machine code can be obtained, compiled and distributed by a much larger number of competing parties. This allows users to compare compiler output and run-time behavior, to verify that software being run is actually the software being written, and to ensure that the software is not surreptitiously modified by the publisher during its distribution. With closed source software, even if developers write a 100% perfect codebase, the end users have no way of knowing whether they are actually getting that specific code base in their binaries, as there are legal and technical barriers in place preventing them from reliably making that verification for every change.

chatmasta 11y ago
What about the corollary to that? Open source code is more accessible than closed source code, not only to reviewers, but also to vulnerability hunters. For every honest reviewer, there can be a malicious one. Also consider the profit incentives are stronger for malicious reviewers than they are for friendly ones.
- 5ilv3r 11y ago
  The National Institute of Standards and Technology (NIST) in the United States specifically recommends against this practice https://en.wikipedia.org/wiki/Security_through_obscurity https://en.wikipedia.org/wiki/Security_through_obscurity

cyphar 11y ago

Free software allows users to get access to fixes for systems not supported by vendors. Saying "free software" is more secure is not correct (just look at libpurple, a free software library riddled with bugs). What is correct is that you have a much better shot at white hats and security researchers finding bugs in free software, and the fixes for those bugs being freely available. Black hats (trust me, I've known a few) will gladly attack proprietary software (usually with more glee, because there's far less review of proprietary software in general). Using proprietary software doesn't save you from black hats. But it does give you more chances of white hats finding the bugs sooner. Security isn't a binary state, it's a lifestyle. All code has bugs, and almost all bugs can be security bugs. Taking steps to add more layers to your security is what you should be doing, not arguing that "because the software is free someone found it!".