4 ms·

Unlike you, it's the open-source parts of Vivaldi I'm most afraid of. I trust them to support their users and I believe they desire to have users who trust & r

• prophesi 9y ago
  Both open-source and closed-source have their problems. Closed Source: - Team behind it could add trackers, backdoors, etc that are difficult to detect. - Attackers could find an exploit that will go unnoticed and unfixed for an indeterminable length of time. Or perhaps use the team's own aforementioned exploits/backdoors. - Can't tell if their app is well-tested and well-written, which means it could be a buggy hot mess from the get-go. Which is the most common reason for hiding source from my anecdotal experience. Open Source: - Much easier for anyone to find a bug, including attackers. You'd hope the maintainers/community will find the bug before them, or at least take less time to fix it than if it were closed-source. - Attackers could add their own exploit that will go unnoticed or unfixed for an indeterminable length of time. I think the conclusion to draw from is: Closed Source = less likely for attackers to find bugs, but more likely for bugs to persist. Can only trust in the company's reputation for code quality. Open Source = more likely for attackers to find bugs, but less likely for bugs to persist. Don't need to trust the company's reputation for code quality.
  • xerophyte12932 9y ago
    > Open Source = more likely for attackers to find bugs, but less likely for bugs to persist. Don't need to trust the company's reputation for code quality. But you need to trust the entire community not to insert bugs/backdoors and/or weed out such code. Not to mention Open Source contributors arguably have a lesser incentive than closed-source development being done by a company. Ofc the above argument assumes contributors are allowed to make changes to the codebase, instead of just reviewing the code
  • fbender 9y ago
    > - Attackers could add their own exploit that will go unnoticed or unfixed for an indeterminable length of time. That's why not everyone has commit access* (for both open and closed source projects) and there's always* a code review performed by independent peers. This neither protects you from accidental security issues nor highly obfuscated malicious exploits (only sufficient skills of the reviewer does), but that holds true to both open and closed source projects. For the former, the "indeterminable length of time" until exploits are found may be much shorter than for closed source projects due to increased eyeballing for large projects. * Let's ignore those who ignore common sense. If you care about the security of the software you use, you want the developer(s) to follow basic rules of software development. And you can even verify that in open source projects without needing to know how to code. For closed source projects you can't, you can only trust the company to do so. How's that different to trusting the skills of the open source developers?
• Aaron1011 9y ago
  > I don't trust people who are more code-savvy than I am (that's most people) not to insert or exploit weaknesses in open-source software or other open code That applies to closed-source software as well. With (popular) open-source software, on the other hand, you can be confident that "people who are more code-savvy than you are" can examine the code for inserted weaknesses. Existing vulnerabilities can and with be exploited if there's an incentive to so so, regardless of whether or not the source is available. > With closed-source software, I know the origin point of the software I install, I know the names of the individuals or teams who developed it That seems like the exception, rather than the rule. Consider browsers, for example. I can see exactly which people have commit access on the open-source Firefox or Chromium projects. When it comes to a closed-source browser such as Microsoft Edge, on the other hand, I only know that "the Edge team" develops it. I have absolutely no idea who is currently on this team, or the quality of any individual member's work. > and therefore I know who stands behind it, because their reputation is based on that released software working This doesn't mean that closed-source software is intrinsically less vulnerable than open-source software. Microsoft's reputation may be based on Windows working, but that didn't stop WannaCry - nor will it stop future exploits. > If something goes wrong, I can take clear action because I know who is to blame, e.g. Vivaldi, Microsoft, etc. Realistically speaking, what action can you take, besides switching to other software? > With open-source software, that liability for the software developer is thus offloaded to "the community" You're conflating open-source software with software developed solely by the community. Many open-source projects, such as Chromium, Firefox, and Linux, do have specific organizations that are either involved or responsible for their development. Closed-source software only gives you an opaque team or organization to blame, while open-source software can give you a specific commit - diff, date, and author. > Too many people can see it Direct access to the code may make finding vulnerabilities easier, but as shown by the number of security vulnerabilities in well-known and well-funded closed-source projects (Windows, iOS, etc), it will not stop determined attackers from finding and exploiting them. > too many people can make changes How many is "too many"? If you're referring to the number of people with commit access, then you're almost never be able to know that number for closed-source software. If you're referring to the number of contributors, then it's not much different from trusting the core development team in the first place. Regardless of where the code originally comes from, you're trusting the maintainers to be able to recognize bad and/or vulnerable code, whether done accidentally or maliciously. > and it's happening way too fast Do you have a specific project or projects in mind here? This seems very similar to the issue of "too many people can make changes" - you can only make an informed guess, at best, as to the development rate of closed-source software. Unlike open-source software, you can never know exactly how many changes went into a particular release.