3 ms·

>trusted sources, basically Google or Apple. I'd say open source apps are more trustworthy that Google or Apple.

by sandov 9y ago

Someone1234 9y ago
Only if you inspect the source, understand the source, and build it yourself. Most people just check if an app is OSS and then install the binary version from the app store. I've installed plenty of OSS apps but I've never built them myself and while I've looked at the source code, I have no way of knowing if what was in the repository was what got delivered.
- mirimir 9y ago
  I guess that the argument is that: 1) sources are available, so anyone can look at them; and 2) that if sources and binaries are in a distro's repo, someone knowledgeable must have looked at them. Also, some repos (Debian and ?) are signed, so you know that you're getting authentic binaries. But even with that, it's taken years to find some serious bugs.
- noobiemcfoob 9y ago
  The viability of OSS is based on presumably someone within the community has or will check that connection. The risk of that highly encourages OSS owners to tell the truth in what they're doing.
  - c22 9y ago
    Realistically though no one is checking, especially on smaller projects. You may be putting yourself at even higher risk since open source contributors are often not vetted as deeply as random employees.
    - kingofhdds 9y ago
      Quite a lot of people do look into sources, actually. Quality of those checks, and how much do they cover in the end - that is the question. But it is better than nothing, and absolute majority of closed source apps offers you exactly nothing in this regard. Surely, opensourced code is not inherently safe, but with time passing, while userbase is big enough, it gets some attention, which means advantage on a scale of probabilities.
- TeMPOraL 9y ago
  There are actually two gains from having the source in the open. One, that you can inspect the source - and in case of popular applications, even if you don't, you can be sure that someone already had and would speak up if they noticed anything off. But the second one is, if there really is something off, there's an unambiguous proof of it - you can point directly at the implementation! And with luck, even at the particular person or organization responsible.
  - dsacco 9y ago
    > and in case of popular applications, even if you don't, you can be sure that someone already had and would speak up if they noticed anything off. You can’t be sure of that at all. This isn’t just an epistemological point either - people are still routinely finding vulnerabilities in the most widely used open source software that were introduced two decades ago. This is despite extremely lucrative incentives for finding them. In many cases it’s because no one bothered to look; in other cases it’s because the numerous (ostensibly qualified) people who looked weren’t capable of finding them. Open source software is a red herring for security. Its benefits are vastly overstated. You gain an incremental improvement in the theoretical ease of review, but this almost always comes at the cost of the overseeing organization having fewer resources to devote to security because its more difficult and uncommon to monetize open source software. Overall I’d say open source software is at best weakly correlated with improved security posture. As it turns out most people don’t inspect their code before running it, and this includes those who fully buy into the many eyes aphorism. Of those who do inspect it, approximately all of them are woefully incapable of identifying real vulnerabilities beyond all but the lowest hanging fruit. Those who remain are typically extremely well paid for their expertise and will only look at software which features a sizable bounty. Unfortunately most open source software, including widely used open source software, does not have a bug bounty and isn’t on e.g. Google Project Zero’s radar.
    - kingofhdds 9y ago
      Vulnerabilities are everywhere, let's not be mistaken here. Closed source is full of them too, you just don't have a chance to know it in most cases. The fact that bugs are found, and publicly announced does, in fact, prove that the model works. That said, I agree that "opensource" label is overadvertised, and many people started to see it as a synonym to "safe" which is definitely a grave mistake. But dismissing its small advantages, just because someone believes they are big doesn't make sense too.
- smichel17 9y ago
  For me, using FLO apps is more about freedom from lock-in. You're right; I don't usually vet apps past the simple "is it FLO?" check (although I will do this before accepting a suspicious permission). However, I do keep a copy of the source of most of the apps I use. As a result, if it were to come out that the app is doing something shady, I could remove that part and keep enjoying the functionality of the app, whereas with a proprietary app I'd be SoL. I also know that the developers know this, so they have an incentive not to do that stuff if they don't want a competing fork to take off. That is the main reason why I trust FLO apps more.

>trusted sources, basically Google or Apple. I'd say open source apps are more trustworthy that Google or Apple.

by sandov 9y ago

>trusted sources, basically Google or Apple. I'd say open source apps are more trustworthy that Google or Apple.

Only if you inspect the source, understand the source, and build it yourself. Most people just check if an app is OSS and then install the binary version from the app store. I've installed plenty of OSS apps but I've never built them myself and while I've looked at the source code, I have no way of knowing if what was in the repository was what got delivered.

mirimir 9y ago
I guess that the argument is that: 1) sources are available, so anyone can look at them; and 2) that if sources and binaries are in a distro's repo, someone knowledgeable must have looked at them. Also, some repos (Debian and ?) are signed, so you know that you're getting authentic binaries. But even with that, it's taken years to find some serious bugs.
noobiemcfoob 9y ago
The viability of OSS is based on presumably someone within the community has or will check that connection. The risk of that highly encourages OSS owners to tell the truth in what they're doing.
- c22 9y ago
  Realistically though no one is checking, especially on smaller projects. You may be putting yourself at even higher risk since open source contributors are often not vetted as deeply as random employees.
  - kingofhdds 9y ago
    Quite a lot of people do look into sources, actually. Quality of those checks, and how much do they cover in the end - that is the question. But it is better than nothing, and absolute majority of closed source apps offers you exactly nothing in this regard. Surely, opensourced code is not inherently safe, but with time passing, while userbase is big enough, it gets some attention, which means advantage on a scale of probabilities.
TeMPOraL 9y ago
There are actually two gains from having the source in the open. One, that you can inspect the source - and in case of popular applications, even if you don't, you can be sure that someone already had and would speak up if they noticed anything off. But the second one is, if there really is something off, there's an unambiguous proof of it - you can point directly at the implementation! And with luck, even at the particular person or organization responsible.
- dsacco 9y ago
  > and in case of popular applications, even if you don't, you can be sure that someone already had and would speak up if they noticed anything off. You can’t be sure of that at all. This isn’t just an epistemological point either - people are still routinely finding vulnerabilities in the most widely used open source software that were introduced two decades ago. This is despite extremely lucrative incentives for finding them. In many cases it’s because no one bothered to look; in other cases it’s because the numerous (ostensibly qualified) people who looked weren’t capable of finding them. Open source software is a red herring for security. Its benefits are vastly overstated. You gain an incremental improvement in the theoretical ease of review, but this almost always comes at the cost of the overseeing organization having fewer resources to devote to security because its more difficult and uncommon to monetize open source software. Overall I’d say open source software is at best weakly correlated with improved security posture. As it turns out most people don’t inspect their code before running it, and this includes those who fully buy into the many eyes aphorism. Of those who do inspect it, approximately all of them are woefully incapable of identifying real vulnerabilities beyond all but the lowest hanging fruit. Those who remain are typically extremely well paid for their expertise and will only look at software which features a sizable bounty. Unfortunately most open source software, including widely used open source software, does not have a bug bounty and isn’t on e.g. Google Project Zero’s radar.
  - kingofhdds 9y ago
    Vulnerabilities are everywhere, let's not be mistaken here. Closed source is full of them too, you just don't have a chance to know it in most cases. The fact that bugs are found, and publicly announced does, in fact, prove that the model works. That said, I agree that "opensource" label is overadvertised, and many people started to see it as a synonym to "safe" which is definitely a grave mistake. But dismissing its small advantages, just because someone believes they are big doesn't make sense too.
smichel17 9y ago
For me, using FLO apps is more about freedom from lock-in. You're right; I don't usually vet apps past the simple "is it FLO?" check (although I will do this before accepting a suspicious permission). However, I do keep a copy of the source of most of the apps I use. As a result, if it were to come out that the app is doing something shady, I could remove that part and keep enjoying the functionality of the app, whereas with a proprietary app I'd be SoL. I also know that the developers know this, so they have an incentive not to do that stuff if they don't want a competing fork to take off. That is the main reason why I trust FLO apps more.