3 ms·

To me, this website makes FOSS seem like the only way to keep your data private. FOSS software can still have trackers in it, and it can absolutely be backdoor

To me, this website makes FOSS seem like the only way to keep your data private. FOSS software can still have trackers in it, and it can absolutely be backdoored. Unless you're auditing the source code and building it yourself, you're trusting the developers as much as any other piece of software.

ChrisMarshallNY 4y ago
> Unless you're auditing the source code and building it yourself, you're trusting the developers as much as any other piece of software. Not sure, but I would not be surprised if some of these nightmarish supply chain attacks are open-source.
Zababa 4y ago
> Unless you're auditing the source code and building it yourself, you're trusting the developers as much as any other piece of software. The thing is that you probably have to trust someone at some point. Better focus on those that have a good track record.
PeterZaitsev 4y ago
The fact you have access to the source code and CAN audit software and modify it (ie to remove trackers) makes it much more balanced relationship. Note you do not have to do it yourself you can rely on someone to do it for you (there is no monopoly here) If you use Oracle you have no choice you Have to trust Oracle - if you use PostgreSQL you can chose to choose to PostgreSQL Global development team or of many commercial and community vendors who provide PostgreSQL builds for you.
- traceroute66 4y ago
  > Note you do not have to do it yourself you can rely on someone to do it for you (there is no monopoly here) Which is why the "but but but you can access the source" argument the FOSS people put up is such bullshit. I mean: a) Let's be honest, with most FOSS projects, security is an afterthought, assuming it was ever thought of at all. Very few go to the extents of OpenBSD or, indeed, anywhere remotely near it. Most don't even have any security bods on the team to start with. b) If you're relying on someone else to audit it, then its no different to employing someone to blackbox fuzz test some closed source software and attach some monitors to your network to watch for undocumented exfiltration. c) If you're relying on someone else to audit it, then that "someone else" with sufficient skills will come with $$$ attached. d) If you're reviewing it yourself, assuming you can speak the relevant programming language in the first place, there are few people who can speak a programming language well enough for the purposes of security auditing. e) If you're relying on "the community" to review it, then well, we all know how your average open source community is ... lots of infighting, lots of egos amongst the core maintainers, and occasionally some work gets done in the middle. Don't get me wrong, I'm not suggesting closed-source is some panacea. But I am also equally enlightened enough to know that FOSS is not the panacea either. Both have their strengths, both have their weaknesses. And certainly in terms of code security, neither is perfect by any means.
  - _Algernon_ 4y ago
    Most, if not all, closed source software builds on open source software at this point, if not directly then at least in the tooling around the development process (compilers/interpreters, version control, build systems, etc.). I doubt that most developers of closed source software have audited their entire tech stack. So in the end you have all the same problems with proprietary software as you describe for foss, but you don't even have the opportunity to audit the source code yourself, should you want to.
dr_kiszonka 4y ago
I am curious if there are any organizations (formal or informal) that audit popular FLOSS projects for such issues.
- rapnie 4y ago
  F-Droid looks to be doing this for their appstore. https://f-droid.org/en/docs/ https://f-droid.org/en/docs/
- gofoss 4y ago
  Also https://exodus-privacy.eu.org/ https://exodus-privacy.eu.org/
gofoss 4y ago
Hi, Georg from https://gofoss.net https://gofoss.net here. I'm not a security expert. Heck, I'm not even a hacker. So take this comment with a pinch of salt. For all its merits, Free Software is not free from criticism. This includes security vulnerabilities. On the flip side, keeping the source code a secret doesn’t necessarily increase security. Arguing that closed source code is vastly more secure than FOSS conveniently omits the fact that proprietary stacks are increasingly built on top of open source code. Sure, FOSS is not immune to security breaches. But neither are proprietary solutions, as illustrated by the leaks of a billion people’s data from Facebook, LinkedIn and Clubhouse. Or the spectacular security attacks against SolarWind and Colonial Pipeline. I do believe that Free Software is instrumental in promoting online privacy. For nearly forty years, FOSS has been encouraging developers to audit the code, fix issues and ensure nothing shady goes on in the background. Ultimately, FOSS is not only about technology. It’s about social, political and economic emancipation.

ChrisMarshallNY 4y ago

> Unless you're auditing the source code and building it yourself, you're trusting the developers as much as any other piece of software. Not sure, but I would not be surprised if some of these nightmarish supply chain attacks are open-source.

Zababa 4y ago

> Unless you're auditing the source code and building it yourself, you're trusting the developers as much as any other piece of software. The thing is that you probably have to trust someone at some point. Better focus on those that have a good track record.

PeterZaitsev 4y ago

The fact you have access to the source code and CAN audit software and modify it (ie to remove trackers) makes it much more balanced relationship. Note you do not have to do it yourself you can rely on someone to do it for you (there is no monopoly here) If you use Oracle you have no choice you Have to trust Oracle - if you use PostgreSQL you can chose to choose to PostgreSQL Global development team or of many commercial and community vendors who provide PostgreSQL builds for you.

traceroute66 4y ago
> Note you do not have to do it yourself you can rely on someone to do it for you (there is no monopoly here) Which is why the "but but but you can access the source" argument the FOSS people put up is such bullshit. I mean: a) Let's be honest, with most FOSS projects, security is an afterthought, assuming it was ever thought of at all. Very few go to the extents of OpenBSD or, indeed, anywhere remotely near it. Most don't even have any security bods on the team to start with. b) If you're relying on someone else to audit it, then its no different to employing someone to blackbox fuzz test some closed source software and attach some monitors to your network to watch for undocumented exfiltration. c) If you're relying on someone else to audit it, then that "someone else" with sufficient skills will come with $$$ attached. d) If you're reviewing it yourself, assuming you can speak the relevant programming language in the first place, there are few people who can speak a programming language well enough for the purposes of security auditing. e) If you're relying on "the community" to review it, then well, we all know how your average open source community is ... lots of infighting, lots of egos amongst the core maintainers, and occasionally some work gets done in the middle. Don't get me wrong, I'm not suggesting closed-source is some panacea. But I am also equally enlightened enough to know that FOSS is not the panacea either. Both have their strengths, both have their weaknesses. And certainly in terms of code security, neither is perfect by any means.
- _Algernon_ 4y ago
  Most, if not all, closed source software builds on open source software at this point, if not directly then at least in the tooling around the development process (compilers/interpreters, version control, build systems, etc.). I doubt that most developers of closed source software have audited their entire tech stack. So in the end you have all the same problems with proprietary software as you describe for foss, but you don't even have the opportunity to audit the source code yourself, should you want to.

dr_kiszonka 4y ago

I am curious if there are any organizations (formal or informal) that audit popular FLOSS projects for such issues.

rapnie 4y ago
F-Droid looks to be doing this for their appstore. https://f-droid.org/en/docs/ https://f-droid.org/en/docs/
gofoss 4y ago
Also https://exodus-privacy.eu.org/ https://exodus-privacy.eu.org/

gofoss 4y ago

Hi, Georg from https://gofoss.net https://gofoss.net here. I'm not a security expert. Heck, I'm not even a hacker. So take this comment with a pinch of salt. For all its merits, Free Software is not free from criticism. This includes security vulnerabilities. On the flip side, keeping the source code a secret doesn’t necessarily increase security. Arguing that closed source code is vastly more secure than FOSS conveniently omits the fact that proprietary stacks are increasingly built on top of open source code. Sure, FOSS is not immune to security breaches. But neither are proprietary solutions, as illustrated by the leaks of a billion people’s data from Facebook, LinkedIn and Clubhouse. Or the spectacular security attacks against SolarWind and Colonial Pipeline. I do believe that Free Software is instrumental in promoting online privacy. For nearly forty years, FOSS has been encouraging developers to audit the code, fix issues and ensure nothing shady goes on in the background. Ultimately, FOSS is not only about technology. It’s about social, political and economic emancipation.