3 ms·

>An ideal outcome would be a huge push toward open source (and also toward free software) how much does open source improve security? (And does it at all?) In

• matheusmoreira 8y ago
  I read the source code of programs I use often, mostly for learning purposes. The first thing I do when I want to evaluate the security of a program I don't trust is look at the system calls it performs, especially those related to I/O. Since I don't need to reverse engineer binaries, open source code allows me to spot malicious code much faster. More importantly, it allows me to more easily remove that code from the program. The rate of vulnerabilities caused by honest mistakes is probably the same.
  • jf22 8y ago
    Yeah, everybody is going to start reading the entire source code of the apps they use.
    • Djvacto 8y ago
      There's still a benefit even if only a small amount of people read it, because they can call it out. You don't go to the production areas of packaged food you buy to make sure you know they're not making any mistakes/pumping sawdust into the food, but you trust that because everyone else is buying it and no one is getting sick that there's a fair chance you won't either.
      • dTal 8y ago
        You broke your analogy a bit there. You don't go to the production areas of packaged food companies because you assume that others are doing so - specifically, state regulators. It's not that no one is obviously getting sick - they might be getting sick in subtle ways they can't pin on the food, like long term heavy metal poisoning, in the same way that malicious software can be very quiet about it.
        • Djvacto 8y ago
          That's a good point. It's not a 1-1 analogy, but I think the overall principle applies. If it's open source, more people can regulate it, as opposed to less.
          • dTal 8y ago
            Oh no, it's a fine analogy! I just thought you muddled it a little at the end with the 'no one getting sick' part. It's important that source code be available for the same reason that food preparation not be done behind locked doors with secret ingredients - not so much so that everyone can see for themselves, but so that someone can, and raise the alarm for the rest of us if anything is amiss. The 'getting sick' part actually works too - it's important to be able to review the process precisely because it's not always immediately obvious if something is wrong.
• yosito 8y ago
  > In my experience nobody reads the source code before executing it It's not so much that people need to read the source code before executing it as it is about the code being auditable by any third party, with or without permission.
• bo1024 8y ago
  You definitely have some good points, but I think there are good responses. (1) It doesn't have to be perfect to be better. (2) You don't need everyone to read the source code, just a few people. (3) Open-source not only makes it technically harder to do malicious things to users. It also (hopefully) improves the incentives.
• swebs 8y ago
  >In my experience nobody reads the source code before executing it Joe Schmo isn't going to be auditing it, actual security researchers are. Heartbleed was only discovered because some research firm was auditing random open source software. Imagine how long the exploit would have gone unnoticed in a closed source application. Now imagine if said exploits were intentionally added and used by the software authors since day 1.