3 ms·

>When heartbleed broke that was evidence that the 'many eyes' theory of secure open source software hadn't worked. Alternatively, the bug was found because big

>When heartbleed broke that was evidence that the 'many eyes' theory of secure open source software hadn't worked. Alternatively, the bug was found because big corporations with security budgets were getting serious about holes, so maybe 'many eyes' is starting to be true. Heartbleed proved that just having software be open-source is not sufficient. Having the source available to audit isn't all the helpful if no one bothers to do the work to audit it, because they all assume someone else is going to do it. However, if there are entities willing to put in the effort, it's much better for the code to be open-source because then it can be audited, and this auditing can be documented publicly (e.g., the fixes can be seen in git logs), whereas with proprietary software you have no idea if the software has bugs, you can't audit it if you want to, and you can only take the word of the vendor that they've made it secure, and of course we know that isn't worth squat.

awinter-py 11y ago
Bytecode / binaries can be verified (for certain properties) using static analysis. Open source doesn't make verficiation that much easier (at scale), but it makes fixing a lot easier. Also, until reproducible builds become commonplace, most linux users can't verify that their binaries come from a specific version of the source. Binary verification is the way to go.
- Grishnakh 11y ago
  You only really need reproducible builds if you don't trust the source. So far, there hasn't been any evidence that any open-source projects are untrustworthy.
  - awinter-py 11y ago
    Doveryai no proveryai -- trust but verify. Wasn't sourceforge bundling an adware installer for a while?
    - anonbanker 11y ago
      some of us are using verified gcc builds in Gentoo, and building stage3 installs in order to handle the trust aspect.
Thriptic 11y ago
Are there orgs I can contribute resources to which audit open source software?

awinter-py 11y ago

Bytecode / binaries can be verified (for certain properties) using static analysis. Open source doesn't make verficiation that much easier (at scale), but it makes fixing a lot easier. Also, until reproducible builds become commonplace, most linux users can't verify that their binaries come from a specific version of the source. Binary verification is the way to go.

Grishnakh 11y ago
You only really need reproducible builds if you don't trust the source. So far, there hasn't been any evidence that any open-source projects are untrustworthy.
- awinter-py 11y ago
  Doveryai no proveryai -- trust but verify. Wasn't sourceforge bundling an adware installer for a while?
  - anonbanker 11y ago
    some of us are using verified gcc builds in Gentoo, and building stage3 installs in order to handle the trust aspect.

Thriptic 11y ago

Are there orgs I can contribute resources to which audit open source software?