4 ms·

The point isn't that every open source app is awesome, it is that now you KNOW. You're directing snark towards OpenSSL presumably because you think it's a poor

The point isn't that every open source app is awesome, it is that now you KNOW. You're directing snark towards OpenSSL presumably because you think it's a poorly coded. If it was closed source you might not even be aware of the issues and there certainly wouldn't be the open source efforts to code alternatives.

nickpsecurity 10y ago
If it was closed-source, we would assume it had lots of issues until reviewed by a qualified, third party that we trust saying otherwise who also gives us signed hash for binary that was reviewed. The way it's been done in proprietary evaluations a long time. It would be done more if companies were actually interested in a real evaluation instead of a stamp that knocks out their liability. ;) Under DOD's TCSEC criteria, the high-assurance systems (A1-class) also had to be delivered in source form to paying customers with evaluation evidence. They can check hashes/signatures, check the evaluation evidence themselves, and build it on site. So, vendors got paid large sums of money to develop the products, independent evaluation ensured you got some pentesting, and you could inspect the source yourself. My modification to the scheme involved evaluators with hacking background in mutually-suspicious countries working side-by-side with developers every step of the way. Traditional open-source development is weak against all of these given there's usually a lack of qualified expertise or just people willing to dig into it. Just open-sourcing something gets people almost nothing in security. Has to be reviewed.
- nkassis 10y ago
  In the case of edge, Microsoft could do both. Not sure where the drawback would be.
  - nickpsecurity 10y ago
    I think the main thing is that Microsoft makes billions from what lock-in remains in their tech. They are probably very afraid that open-source would've made things like OpenOffice happen for all their locked-in tech at great development speed and compatibility. Plus on better platforms that Microsoft doesn't sell. Maybe even ReactOS greatly accelerated by the availability of source. ;) That's my theory anyway. They share source with some but highly selective with plenty restrictions.
- makomk 10y ago
  Some of the recent proposed international trade treaties would forbid governments from requiring companies to supply source code for their software, if I recall correctly.
  - nickpsecurity 10y ago
    No doubt inspired by bottom line and SIGINT concerns. In that case, it can be voluntary as a differentiator.
nneonneo 10y ago
What matters most is the amount of security effort paid to the project, not whether it is open- or closed-source. Commercial decompilers, reverse-engineering tools and automated bug finders have come a long way - a determined reverser can find bugs in closed-source code almost as easily as in open-source code. But, both kinds of bug finding take time and loads of manual effort (despite good tools), and will often only happen with appropriate incentives. This is where closed-source has a major advantage: companies put up money (in the form of bug bounties) to counteract the bug prices that a researcher could obtain on the black market. This incentivizes "good" researchers to spend time on their products. Open-source projects, even highly-successful ones, rarely have enough funding to run good bug bounty programs. Consequently, good guys can't pay the bills finding bugs in open source, whereas bad guys get huge payoffs for finding and exploiting bugs (think the NSA, criminal groups, malicious states, etc.). As the adage goes, enough eyeballs render all bugs shallow. But, in this day and age, that applies both to open- and to closed-source code.

nickpsecurity 10y ago

If it was closed-source, we would assume it had lots of issues until reviewed by a qualified, third party that we trust saying otherwise who also gives us signed hash for binary that was reviewed. The way it's been done in proprietary evaluations a long time. It would be done more if companies were actually interested in a real evaluation instead of a stamp that knocks out their liability. ;) Under DOD's TCSEC criteria, the high-assurance systems (A1-class) also had to be delivered in source form to paying customers with evaluation evidence. They can check hashes/signatures, check the evaluation evidence themselves, and build it on site. So, vendors got paid large sums of money to develop the products, independent evaluation ensured you got some pentesting, and you could inspect the source yourself. My modification to the scheme involved evaluators with hacking background in mutually-suspicious countries working side-by-side with developers every step of the way. Traditional open-source development is weak against all of these given there's usually a lack of qualified expertise or just people willing to dig into it. Just open-sourcing something gets people almost nothing in security. Has to be reviewed.

nkassis 10y ago
In the case of edge, Microsoft could do both. Not sure where the drawback would be.
- nickpsecurity 10y ago
  I think the main thing is that Microsoft makes billions from what lock-in remains in their tech. They are probably very afraid that open-source would've made things like OpenOffice happen for all their locked-in tech at great development speed and compatibility. Plus on better platforms that Microsoft doesn't sell. Maybe even ReactOS greatly accelerated by the availability of source. ;) That's my theory anyway. They share source with some but highly selective with plenty restrictions.
makomk 10y ago
Some of the recent proposed international trade treaties would forbid governments from requiring companies to supply source code for their software, if I recall correctly.
- nickpsecurity 10y ago
  No doubt inspired by bottom line and SIGINT concerns. In that case, it can be voluntary as a differentiator.

nneonneo 10y ago

What matters most is the amount of security effort paid to the project, not whether it is open- or closed-source. Commercial decompilers, reverse-engineering tools and automated bug finders have come a long way - a determined reverser can find bugs in closed-source code almost as easily as in open-source code. But, both kinds of bug finding take time and loads of manual effort (despite good tools), and will often only happen with appropriate incentives. This is where closed-source has a major advantage: companies put up money (in the form of bug bounties) to counteract the bug prices that a researcher could obtain on the black market. This incentivizes "good" researchers to spend time on their products. Open-source projects, even highly-successful ones, rarely have enough funding to run good bug bounty programs. Consequently, good guys can't pay the bills finding bugs in open source, whereas bad guys get huge payoffs for finding and exploiting bugs (think the NSA, criminal groups, malicious states, etc.). As the adage goes, enough eyeballs render all bugs shallow. But, in this day and age, that applies both to open- and to closed-source code.