11 ms·

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.

3fe9a03ccd14ca5 7y ago
Every statement you just made is speculation and not backed up by any meaningful data. While it’s obviously “easier” to find bugs when you can view the source code, making it one or the other doesn’t bestow any magical protections on the software.
- d1str0 7y ago
  "Time and effort required" in order to find vulnerabilities is not a magical protection. It is a legitimate protection. Not one that should be relied on, but very much something that factors in. Open sourcing software doesn't immediately improve security, but it drastically lowers the barrier of entry for researchers to start looking into it.
notaplumber 7y ago
I have to believe given the sheer size of these communities, that the source code being available only helped to confirm what was already known. The panic seen here hearkens back to the days when companies made similar ridiculous security claims about open source software compared to proprietary software.
- whylie 7y ago
  That seems like quite a stretch. The difference between having the source code and not having it is night and day as far as exploring potential vulnerabilities...which is one of the strengths of open source as you point out, but this code was not intended to be || written as open source hence the panic. Feel like you missed the mark on this one.
colejohnson66 7y ago
> Open source code is much more likely to already have been audited better. Worth keeping in mind this isn’t a silver bullet. OpenSSL with Heartbleed comes to mind.
- MaxBarraclough 7y ago
  Very true, but OpenSSL in particular is rather infamous. Unfortunate given that so much relies on it. https://news.ycombinator.com/item?id=7556407 https://news.ycombinator.com/item?id=7556407
  - rmdashrfstar 7y ago
    This is why the assumption that “open source code is more likely to be closely audited for vulnerabilities” is not true (even for incredibly core/important projects with a wide scope) and is potentially dangerous to rely on.
    - ngcc_hk 7y ago
      It is not 100% and always. But practically. Especially unexpected leak.
    - tal8d 7y ago
      > This is why the assumption that “open source code is more likely to be closely audited for vulnerabilities” is not true... That is a safe assumption, otherwise you'd have to believe that non-open source code is more closely audited - at greater expense, because businesses secretly prioritize security.
  - chupasaurus 7y ago
    Shellshock still outperforms any security issue of OpenSSL in terms of time in the wild.
hitpointdrew 7y ago
> Open source code is much more likely to already have been audited better. Common wisdom. I just happens to not be true. People just aren't auditing random code on github for fun. Auditing code is hard, and time consuming. Most vulnerabilities are found by techniques like fuzzing, not by combing through thousands of lines of code.
- _pmf_ 7y ago
  > People just aren't auditing random code on github for fun No, just the important code that everyone is running.
  - deleted 7y ago
    [deleted]
  - josefx 7y ago
    Afaik it had the opposite effect for OpenSSL. Not only was the code so bad that it would crash if ran with a secure malloc implementation. Due to being free and open source nobody felt the need to donate[1], with only one developer employed to work on it full time. [1] https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/ https://arstechnica.com/information-technology/2014/04/tech-...
    - _pmf_ 7y ago
      Well. eventually someone looked at it. And probably Heartbleed has been used a long time before it was published.
  - fnord123 7y ago
    I have to confess that I have run afl on random code on github.
  - iforgotpassword 7y ago
    You don't have to audit that. It's so popular, someone else must have done a thorough review already!
baby 7y ago
open source code being more secure is a myth.
numlock86 7y ago
The whole "open source is audited better than closed source" is nothing but a myth and I am actually quite surprised to see this statement appear on HN.

3fe9a03ccd14ca5 7y ago

Every statement you just made is speculation and not backed up by any meaningful data. While it’s obviously “easier” to find bugs when you can view the source code, making it one or the other doesn’t bestow any magical protections on the software.

d1str0 7y ago
"Time and effort required" in order to find vulnerabilities is not a magical protection. It is a legitimate protection. Not one that should be relied on, but very much something that factors in. Open sourcing software doesn't immediately improve security, but it drastically lowers the barrier of entry for researchers to start looking into it.

notaplumber 7y ago

I have to believe given the sheer size of these communities, that the source code being available only helped to confirm what was already known. The panic seen here hearkens back to the days when companies made similar ridiculous security claims about open source software compared to proprietary software.

whylie 7y ago
That seems like quite a stretch. The difference between having the source code and not having it is night and day as far as exploring potential vulnerabilities...which is one of the strengths of open source as you point out, but this code was not intended to be || written as open source hence the panic. Feel like you missed the mark on this one.

colejohnson66 7y ago

> Open source code is much more likely to already have been audited better. Worth keeping in mind this isn’t a silver bullet. OpenSSL with Heartbleed comes to mind.

MaxBarraclough 7y ago
Very true, but OpenSSL in particular is rather infamous. Unfortunate given that so much relies on it. https://news.ycombinator.com/item?id=7556407 https://news.ycombinator.com/item?id=7556407
- rmdashrfstar 7y ago
  This is why the assumption that “open source code is more likely to be closely audited for vulnerabilities” is not true (even for incredibly core/important projects with a wide scope) and is potentially dangerous to rely on.
  - ngcc_hk 7y ago
    It is not 100% and always. But practically. Especially unexpected leak.
  - tal8d 7y ago
    > This is why the assumption that “open source code is more likely to be closely audited for vulnerabilities” is not true... That is a safe assumption, otherwise you'd have to believe that non-open source code is more closely audited - at greater expense, because businesses secretly prioritize security.
- chupasaurus 7y ago
  Shellshock still outperforms any security issue of OpenSSL in terms of time in the wild.

hitpointdrew 7y ago

> Open source code is much more likely to already have been audited better. Common wisdom. I just happens to not be true. People just aren't auditing random code on github for fun. Auditing code is hard, and time consuming. Most vulnerabilities are found by techniques like fuzzing, not by combing through thousands of lines of code.

_pmf_ 7y ago
> People just aren't auditing random code on github for fun No, just the important code that everyone is running.
- deleted 7y ago
  [deleted]
- josefx 7y ago
  Afaik it had the opposite effect for OpenSSL. Not only was the code so bad that it would crash if ran with a secure malloc implementation. Due to being free and open source nobody felt the need to donate[1], with only one developer employed to work on it full time. [1] https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/ https://arstechnica.com/information-technology/2014/04/tech-...
  - _pmf_ 7y ago
    Well. eventually someone looked at it. And probably Heartbleed has been used a long time before it was published.
- fnord123 7y ago
  I have to confess that I have run afl on random code on github.
- iforgotpassword 7y ago
  You don't have to audit that. It's so popular, someone else must have done a thorough review already!

baby 7y ago

open source code being more secure is a myth.

numlock86 7y ago

The whole "open source is audited better than closed source" is nothing but a myth and I am actually quite surprised to see this statement appear on HN.