4 ms·

Security through obscurity is not security. The source WAS open, any bugs in it then are still discoverable. Opening source can actually make things more secure

by burnte 5y ago

Security through obscurity is not security. The source WAS open, any bugs in it then are still discoverable. Opening source can actually make things more secure, the whole "many eyes" thing.

kasey_junk 5y ago
The interesting thing in this argument is that the first person is positing axiomatically that closed source is more secure, the second person is positing that open/closed largely doesn’t matter and finally your position axiomatically is that open is more secured. We’ve known since the 70s that you (provably) can’t trust source code. We know experientially that it’s easier to diagnose code than programs. We also know experientially that the teams involved have a dramatic effect on the security of the outcomes. How will we ever decide which of our three contestants will win?
- benatkin 5y ago
  Not quite. tptacek says "Most people would say that reducing the threshold to discover security bugs is a good thing." I think that restating what tptacek said earlier, "mostly orthoganal", to "largely doesn't matter", loses some of the meaning. One way of seeing it is that it's mostly orthaganal at a level of all software out there, but that for those who make a serious effort to be secure, there is a lot of benefit to being open source. There's Linus's Law, "given enough eyeballs, all bugs are shallow". I think if the maintainers of Linux didn't meaningfully address security concerns, it would just mean they were doing a bit better at whack-a-mole. You see this in popular open source projects like WordPress. So I think that's why a reader might think tptacek's two comments don't jibe with each other. If you are given a choice between an open source and a closed source application, you wouldn't just assume one is more secure than another. However, if you were starting off to make a secure system, it would be a good idea to make it open source.
colejohnson66 5y ago
Heartbleed proved that the “many eyes” theory doesn’t always work in practice. It was in the codebase for years and no one noticed.
- yjftsjthsd-h 5y ago
  > Heartbleed proved that the “many eyes” theory doesn’t always work in practice. It was in the codebase for years and no one noticed. It proved that FOSS isn't infallible, which I hope isn't that great a shock. To argue that it weakens the general argument, you would need to present a similar TLS library which avoided exploits by being closed source.
  - tptacek 5y ago
    The person you're responding to could simply provide every closed source TLS library as an example, because Heartbleed (a memory leak caused by implementing a TLS feature nobody was using) was exclusive to OpenSSL.
    - yjftsjthsd-h 5y ago
      That's absurd; we're comparing the rate of exploits, not whether the same exact exploit exists. By that logic, I can say that OpenSSL is perfect because it doesn't have (quick search) https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-121 https://docs.microsoft.com/en-us/security-updates/SecurityBu...
      - tptacek 5y ago
        It's not as absurd as it sounds, because a closed-source TLS library had less impetus to implement the extension that caused the vulnerability. But mostly I'm just making a point about the quality of the argument upthread.
- zarzavat 5y ago
  There was also the Apple “goto fail” bug in their open source TLS code[0], which was so shockingly obvious that it would have been found by compiler warnings, yet it was not. I myself have on occasion found high priority bugs (not security issues) in open source projects with many eyeballs, simply by turning on additional compiler warnings. The fruit out there hangs very low. Openness counts for nothing if nobody is reading the code. Open is better than being closed source but the difference is marginal. The real difference is made by having the code reviewed by security professionals, and by how the project is maintained/lead, and those are orthogonal to open/closed source. [0] https://www.imperialviolet.org/2014/02/22/applebug.html https://www.imperialviolet.org/2014/02/22/applebug.html

by burnte 5y ago

Security through obscurity is not security. The source WAS open, any bugs in it then are still discoverable. Opening source can actually make things more secure, the whole "many eyes" thing.

kasey_junk 5y ago

The interesting thing in this argument is that the first person is positing axiomatically that closed source is more secure, the second person is positing that open/closed largely doesn’t matter and finally your position axiomatically is that open is more secured. We’ve known since the 70s that you (provably) can’t trust source code. We know experientially that it’s easier to diagnose code than programs. We also know experientially that the teams involved have a dramatic effect on the security of the outcomes. How will we ever decide which of our three contestants will win?

benatkin 5y ago
Not quite. tptacek says "Most people would say that reducing the threshold to discover security bugs is a good thing." I think that restating what tptacek said earlier, "mostly orthoganal", to "largely doesn't matter", loses some of the meaning. One way of seeing it is that it's mostly orthaganal at a level of all software out there, but that for those who make a serious effort to be secure, there is a lot of benefit to being open source. There's Linus's Law, "given enough eyeballs, all bugs are shallow". I think if the maintainers of Linux didn't meaningfully address security concerns, it would just mean they were doing a bit better at whack-a-mole. You see this in popular open source projects like WordPress. So I think that's why a reader might think tptacek's two comments don't jibe with each other. If you are given a choice between an open source and a closed source application, you wouldn't just assume one is more secure than another. However, if you were starting off to make a secure system, it would be a good idea to make it open source.

colejohnson66 5y ago

Heartbleed proved that the “many eyes” theory doesn’t always work in practice. It was in the codebase for years and no one noticed.

yjftsjthsd-h 5y ago
> Heartbleed proved that the “many eyes” theory doesn’t always work in practice. It was in the codebase for years and no one noticed. It proved that FOSS isn't infallible, which I hope isn't that great a shock. To argue that it weakens the general argument, you would need to present a similar TLS library which avoided exploits by being closed source.
- tptacek 5y ago
  The person you're responding to could simply provide every closed source TLS library as an example, because Heartbleed (a memory leak caused by implementing a TLS feature nobody was using) was exclusive to OpenSSL.
  - yjftsjthsd-h 5y ago
    That's absurd; we're comparing the rate of exploits, not whether the same exact exploit exists. By that logic, I can say that OpenSSL is perfect because it doesn't have (quick search) https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-121 https://docs.microsoft.com/en-us/security-updates/SecurityBu...
    - tptacek 5y ago
      It's not as absurd as it sounds, because a closed-source TLS library had less impetus to implement the extension that caused the vulnerability. But mostly I'm just making a point about the quality of the argument upthread.
zarzavat 5y ago
There was also the Apple “goto fail” bug in their open source TLS code[0], which was so shockingly obvious that it would have been found by compiler warnings, yet it was not. I myself have on occasion found high priority bugs (not security issues) in open source projects with many eyeballs, simply by turning on additional compiler warnings. The fruit out there hangs very low. Openness counts for nothing if nobody is reading the code. Open is better than being closed source but the difference is marginal. The real difference is made by having the code reviewed by security professionals, and by how the project is maintained/lead, and those are orthogonal to open/closed source. [0] https://www.imperialviolet.org/2014/02/22/applebug.html https://www.imperialviolet.org/2014/02/22/applebug.html