5 ms·

> Open-source code is not in fact easier to exploit than closed-source code is Not sure if I agree with this. Obscure systems are usually harder to hack as the

> Open-source code is not in fact easier to exploit than closed-source code is Not sure if I agree with this. Obscure systems are usually harder to hack as they require an extra effort on discoverability that open systems don't have. Easier to exploit != more exploitable. One is about the threshold to discover an exploit, the other is about the total exploitable bugs. In my view, the "hackability level" is the same for both open and closed-source projects. Making something close it doesn't make it less hackeable, it just makes the threshold to discover bugs higher. Also, one may argue that with open-source projects you may be able to fix more bugs since those are in the open and more people can report them (thus, more secure). I think it really depends on the contribution level and where the codebase is at to see if security might be a concern or not. > Security and openness are mostly orthogonal. But I mostly agree with this ;)

tptacek 5y ago
Most people would say that reducing the threshold to discover security bugs is a good thing.
- burnte 5y ago
  Security through obscurity is not security. The source WAS open, any bugs in it then are still discoverable. Opening source can actually make things more secure, the whole "many eyes" thing.
  - kasey_junk 5y ago
    The interesting thing in this argument is that the first person is positing axiomatically that closed source is more secure, the second person is positing that open/closed largely doesn’t matter and finally your position axiomatically is that open is more secured. We’ve known since the 70s that you (provably) can’t trust source code. We know experientially that it’s easier to diagnose code than programs. We also know experientially that the teams involved have a dramatic effect on the security of the outcomes. How will we ever decide which of our three contestants will win?
    - benatkin 5y ago
      Not quite. tptacek says "Most people would say that reducing the threshold to discover security bugs is a good thing." I think that restating what tptacek said earlier, "mostly orthoganal", to "largely doesn't matter", loses some of the meaning. One way of seeing it is that it's mostly orthaganal at a level of all software out there, but that for those who make a serious effort to be secure, there is a lot of benefit to being open source. There's Linus's Law, "given enough eyeballs, all bugs are shallow". I think if the maintainers of Linux didn't meaningfully address security concerns, it would just mean they were doing a bit better at whack-a-mole. You see this in popular open source projects like WordPress. So I think that's why a reader might think tptacek's two comments don't jibe with each other. If you are given a choice between an open source and a closed source application, you wouldn't just assume one is more secure than another. However, if you were starting off to make a secure system, it would be a good idea to make it open source.
  - colejohnson66 5y ago
    Heartbleed proved that the “many eyes” theory doesn’t always work in practice. It was in the codebase for years and no one noticed.
    - yjftsjthsd-h 5y ago
      > Heartbleed proved that the “many eyes” theory doesn’t always work in practice. It was in the codebase for years and no one noticed. It proved that FOSS isn't infallible, which I hope isn't that great a shock. To argue that it weakens the general argument, you would need to present a similar TLS library which avoided exploits by being closed source.
      - tptacek 5y ago
        The person you're responding to could simply provide every closed source TLS library as an example, because Heartbleed (a memory leak caused by implementing a TLS feature nobody was using) was exclusive to OpenSSL.
        yjftsjthsd-h 5y ago
        That's absurd; we're comparing the rate of exploits, not whether the same exact exploit exists. By that logic, I can say that OpenSSL is perfect because it doesn't have (quick search) https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-121 https://docs.microsoft.com/en-us/security-updates/SecurityBu...
        tptacek 5y ago
        It's not as absurd as it sounds, because a closed-source TLS library had less impetus to implement the extension that caused the vulnerability. But mostly I'm just making a point about the quality of the argument upthread.
    - zarzavat 5y ago
      There was also the Apple “goto fail” bug in their open source TLS code[0], which was so shockingly obvious that it would have been found by compiler warnings, yet it was not. I myself have on occasion found high priority bugs (not security issues) in open source projects with many eyeballs, simply by turning on additional compiler warnings. The fruit out there hangs very low. Openness counts for nothing if nobody is reading the code. Open is better than being closed source but the difference is marginal. The real difference is made by having the code reviewed by security professionals, and by how the project is maintained/lead, and those are orthogonal to open/closed source. [0] https://www.imperialviolet.org/2014/02/22/applebug.html https://www.imperialviolet.org/2014/02/22/applebug.html

tptacek 5y ago

Most people would say that reducing the threshold to discover security bugs is a good thing.

burnte 5y ago
Security through obscurity is not security. The source WAS open, any bugs in it then are still discoverable. Opening source can actually make things more secure, the whole "many eyes" thing.
- kasey_junk 5y ago
  The interesting thing in this argument is that the first person is positing axiomatically that closed source is more secure, the second person is positing that open/closed largely doesn’t matter and finally your position axiomatically is that open is more secured. We’ve known since the 70s that you (provably) can’t trust source code. We know experientially that it’s easier to diagnose code than programs. We also know experientially that the teams involved have a dramatic effect on the security of the outcomes. How will we ever decide which of our three contestants will win?
  - benatkin 5y ago
    Not quite. tptacek says "Most people would say that reducing the threshold to discover security bugs is a good thing." I think that restating what tptacek said earlier, "mostly orthoganal", to "largely doesn't matter", loses some of the meaning. One way of seeing it is that it's mostly orthaganal at a level of all software out there, but that for those who make a serious effort to be secure, there is a lot of benefit to being open source. There's Linus's Law, "given enough eyeballs, all bugs are shallow". I think if the maintainers of Linux didn't meaningfully address security concerns, it would just mean they were doing a bit better at whack-a-mole. You see this in popular open source projects like WordPress. So I think that's why a reader might think tptacek's two comments don't jibe with each other. If you are given a choice between an open source and a closed source application, you wouldn't just assume one is more secure than another. However, if you were starting off to make a secure system, it would be a good idea to make it open source.
- colejohnson66 5y ago
  Heartbleed proved that the “many eyes” theory doesn’t always work in practice. It was in the codebase for years and no one noticed.
  - yjftsjthsd-h 5y ago
    > Heartbleed proved that the “many eyes” theory doesn’t always work in practice. It was in the codebase for years and no one noticed. It proved that FOSS isn't infallible, which I hope isn't that great a shock. To argue that it weakens the general argument, you would need to present a similar TLS library which avoided exploits by being closed source.
    - tptacek 5y ago
      The person you're responding to could simply provide every closed source TLS library as an example, because Heartbleed (a memory leak caused by implementing a TLS feature nobody was using) was exclusive to OpenSSL.
      - yjftsjthsd-h 5y ago
        That's absurd; we're comparing the rate of exploits, not whether the same exact exploit exists. By that logic, I can say that OpenSSL is perfect because it doesn't have (quick search) https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-121 https://docs.microsoft.com/en-us/security-updates/SecurityBu...
        tptacek 5y ago
        It's not as absurd as it sounds, because a closed-source TLS library had less impetus to implement the extension that caused the vulnerability. But mostly I'm just making a point about the quality of the argument upthread.
  - zarzavat 5y ago
    There was also the Apple “goto fail” bug in their open source TLS code[0], which was so shockingly obvious that it would have been found by compiler warnings, yet it was not. I myself have on occasion found high priority bugs (not security issues) in open source projects with many eyeballs, simply by turning on additional compiler warnings. The fruit out there hangs very low. Openness counts for nothing if nobody is reading the code. Open is better than being closed source but the difference is marginal. The real difference is made by having the code reviewed by security professionals, and by how the project is maintained/lead, and those are orthogonal to open/closed source. [0] https://www.imperialviolet.org/2014/02/22/applebug.html https://www.imperialviolet.org/2014/02/22/applebug.html