4 ms·

Both open-source and closed-source have their problems. Closed Source: - Team behind it could add trackers, backdoors, etc that are difficult to detect. - At

Both open-source and closed-source have their problems. Closed Source: - Team behind it could add trackers, backdoors, etc that are difficult to detect. - Attackers could find an exploit that will go unnoticed and unfixed for an indeterminable length of time. Or perhaps use the team's own aforementioned exploits/backdoors. - Can't tell if their app is well-tested and well-written, which means it could be a buggy hot mess from the get-go. Which is the most common reason for hiding source from my anecdotal experience. Open Source: - Much easier for anyone to find a bug, including attackers. You'd hope the maintainers/community will find the bug before them, or at least take less time to fix it than if it were closed-source. - Attackers could add their own exploit that will go unnoticed or unfixed for an indeterminable length of time. I think the conclusion to draw from is: Closed Source = less likely for attackers to find bugs, but more likely for bugs to persist. Can only trust in the company's reputation for code quality. Open Source = more likely for attackers to find bugs, but less likely for bugs to persist. Don't need to trust the company's reputation for code quality.

xerophyte12932 9y ago
> Open Source = more likely for attackers to find bugs, but less likely for bugs to persist. Don't need to trust the company's reputation for code quality. But you need to trust the entire community not to insert bugs/backdoors and/or weed out such code. Not to mention Open Source contributors arguably have a lesser incentive than closed-source development being done by a company. Ofc the above argument assumes contributors are allowed to make changes to the codebase, instead of just reviewing the code
fbender 9y ago
> - Attackers could add their own exploit that will go unnoticed or unfixed for an indeterminable length of time. That's why not everyone has commit access* (for both open and closed source projects) and there's always* a code review performed by independent peers. This neither protects you from accidental security issues nor highly obfuscated malicious exploits (only sufficient skills of the reviewer does), but that holds true to both open and closed source projects. For the former, the "indeterminable length of time" until exploits are found may be much shorter than for closed source projects due to increased eyeballing for large projects. * Let's ignore those who ignore common sense. If you care about the security of the software you use, you want the developer(s) to follow basic rules of software development. And you can even verify that in open source projects without needing to know how to code. For closed source projects you can't, you can only trust the company to do so. How's that different to trusting the skills of the open source developers?

xerophyte12932 9y ago

> Open Source = more likely for attackers to find bugs, but less likely for bugs to persist. Don't need to trust the company's reputation for code quality. But you need to trust the entire community not to insert bugs/backdoors and/or weed out such code. Not to mention Open Source contributors arguably have a lesser incentive than closed-source development being done by a company. Ofc the above argument assumes contributors are allowed to make changes to the codebase, instead of just reviewing the code

fbender 9y ago

> - Attackers could add their own exploit that will go unnoticed or unfixed for an indeterminable length of time. That's why not everyone has commit access* (for both open and closed source projects) and there's always* a code review performed by independent peers. This neither protects you from accidental security issues nor highly obfuscated malicious exploits (only sufficient skills of the reviewer does), but that holds true to both open and closed source projects. For the former, the "indeterminable length of time" until exploits are found may be much shorter than for closed source projects due to increased eyeballing for large projects. * Let's ignore those who ignore common sense. If you care about the security of the software you use, you want the developer(s) to follow basic rules of software development. And you can even verify that in open source projects without needing to know how to code. For closed source projects you can't, you can only trust the company to do so. How's that different to trusting the skills of the open source developers?