3 ms·

I've said this before, but the dogmatic belief that open source automatically means something is safer just isn't true. In theory it means something could mayb

I've said this before, but the dogmatic belief that open source automatically means something is safer just isn't true. In theory it means something could maybe be safer, but it far from guarantees it.

gggmaster 6y ago
But for a closed source one there’s definitely no way to audit the source code.
- fiddlerwoaroof 6y ago
  Sure there is: tools like strace, dtrace and eBPF let you “peak under the hood” of nearly any application, not to mention disassemblers like IDA Pro and Ghidra. I have debugged all sorts of issues with closed source applications using these tools.
Seirdy 6y ago
Being able to inspect the code is a necessary but insufficient measure for being secure. If you cannot inspect the source code, you are not fully aware of how the program works. Tools like strace can help you analyze a program's behavior from the outside, but you get limited insight into its internals (e.g., what algorithms is it using?). Being open source does not automatically make software more secure. A successful compilation doesn't automatically make your code bug-free. Yet both are necessary to achieve the desired goal: security and correctness, respectively.
- whynotminot 6y ago
  How often do you inspect the code of the open source programs you use every day? How about when updates come out? Do you check again? Or, do you trust that someone has looked at it? How much faith do you have in someone out there in the community? My point isn't that open source isn't a good thing--my point is that it's not the silver bullet a lot of people blindly assume it to be. Hence the second line of my post: > In theory it means something could maybe be safer, but it far from guarantees it.
the_gipsy 6y ago
neither did I say it's automatically safe, nor define "safe" as in bug free. The commented I replied to implied that one would walk through the entire stack, every line of code, to audit e.g. an app running on a phone. This is most certainly not what OP meant. Rather, on a whole OSS is mostly transparent, while proprietary software is not. There are of course bugs, but that's not the focus here with "safety". What we care about is intention. Private companies's have a track record in implementing features that go directly against the benefit if their end-users, e.g. tracking or vendor-lock-in. These anti-features, like the one described in the article, are much harder to detect precisely because the software is proprietary.

gggmaster 6y ago

But for a closed source one there’s definitely no way to audit the source code.

fiddlerwoaroof 6y ago
Sure there is: tools like strace, dtrace and eBPF let you “peak under the hood” of nearly any application, not to mention disassemblers like IDA Pro and Ghidra. I have debugged all sorts of issues with closed source applications using these tools.

Seirdy 6y ago

Being able to inspect the code is a necessary but insufficient measure for being secure. If you cannot inspect the source code, you are not fully aware of how the program works. Tools like strace can help you analyze a program's behavior from the outside, but you get limited insight into its internals (e.g., what algorithms is it using?). Being open source does not automatically make software more secure. A successful compilation doesn't automatically make your code bug-free. Yet both are necessary to achieve the desired goal: security and correctness, respectively.

whynotminot 6y ago
How often do you inspect the code of the open source programs you use every day? How about when updates come out? Do you check again? Or, do you trust that someone has looked at it? How much faith do you have in someone out there in the community? My point isn't that open source isn't a good thing--my point is that it's not the silver bullet a lot of people blindly assume it to be. Hence the second line of my post: > In theory it means something could maybe be safer, but it far from guarantees it.

the_gipsy 6y ago

neither did I say it's automatically safe, nor define "safe" as in bug free. The commented I replied to implied that one would walk through the entire stack, every line of code, to audit e.g. an app running on a phone. This is most certainly not what OP meant. Rather, on a whole OSS is mostly transparent, while proprietary software is not. There are of course bugs, but that's not the focus here with "safety". What we care about is intention. Private companies's have a track record in implementing features that go directly against the benefit if their end-users, e.g. tracking or vendor-lock-in. These anti-features, like the one described in the article, are much harder to detect precisely because the software is proprietary.