4 ms·
It is generally accepted in the security community that hiding source code does not provide security. The principles for developing secure software were identi
by dwheeler 6y ago
It is generally accepted in the security community that hiding source code does not provide security.
The principles for developing secure software were identified in the 1970s by Saltzer and Schroeder, and they're still true today. One of those principles is "open design", that is, don't depend on design secrecy for security of the system. Instead, depend on secrecy of things that are trivially changed (like private keys and passwords). Then, when the secret is exposed (or you think it might be), you quickly change all the secrets and there's no problem. One source of this paper: https://www.cs.virginia.edu/~evans/cs551/saltzer/ https://www.cs.virginia.edu/~evans/cs551/saltzer/
In the case of Windows, the source code is not really secret anyway. Most governments have continuous access to the source code, typically through the Microsoft Government Support Program (GSP) https://www.microsoft.com/en-us/securityengineering/gsp https://www.microsoft.com/en-us/securityengineering/gsp
Many businesses and universities also have access to Windows source code. You can see various programs to provide such access in different cases via https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/ In addition, Microsoft employs a huge number of employees who have access to its source code, and you can't really keep a secret long when a large number of people know the secret. Efforts like bribes, appeals to patriotism, etc. will eventually successfully get someone to reveal a secret if there's a large enough group, especially since it's relatively easy to identify who works for Microsoft or otherwise might have such access.
If that's not enough, Microsoft distributes executables, and disassembers & decompilers can provide enough information for static analysis anyway. So you could re-derive what you need to attack Windows if you needed the source code for some reason.
Anyone who depends on secrecy of code to provide security is in trouble. Typically the real reason to keep (some) code secret is to support certain proprietary business models and to meet certain legal obligations, and are not really about security.
Note that Microsoft understands this; they're quite clear in stating that the security of Windows does not depend on keeping its source code a secret.
- dividuum 6y agoIsn't that the Kerckhoffs's principle? https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
- dwheeler 6y agoOpen design is basically a generalization of Kerckhoffs's principle. Kerckhoffs's principle is usually stated as "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge." Note that Kerckhoffs's principle only refers to cryptosystems. The open design principle is a generalization that applies to all systems, whether or not they are cryptosystems.
- hguant 6y agoIt's not just governments - if you give them enough money they'll send you the source, and all the tools required to build it. Device manufacturers in particular need this - you think SeaGate is using the online windows docs when they write SSD drivers?
- zinekeller 6y agoYes. /s (The point is correct, but SSDs are probably a bad example: it is very standardised whether it is in consumer or enterprise space. Maybe nVidia and AMD with regards to graphics card would be a better example?)
- zinekeller 6y agoTo expound on the disassembly, the debug symbols are not just easily accessible but also actively used in Windows app development.
- frozenport 6y agoNot for the OS
- cjohansson 6y agoGood points, sounds reasonable and plausible
- usr1106 6y ago> It is generally accepted in the security community that hiding source code does not provide security Yes. But with not enough eyes carefully reviewing the code security vulnerabilities will remain also in open source code. And once a bad actor finds it it will be easier to implement an exploit. It's not opening the source that makes the software more secure. It's enough reviewers or white hats looking at the code. Security vulnerabilities in Linux (both kernel and user space) show that regularly. Of course with closed source your external reviewers are zero, so that's not the solution.
- konceptz 6y ago"It's not opening the source that makes the software more secure. It's enough reviewers or white hats looking at the code. Security vulnerabilities in Linux (both kernel and user space) show that regularly." Thank you for that additional point, it's worth being said and helps us model the closed source alternative.