4 ms·

Change my view: open source operating systems are bad in practice since good actors rarely audit them but bad actors not only have the usual exploits but also h

Change my view: open source operating systems are bad in practice since good actors rarely audit them but bad actors not only have the usual exploits but also have the keys to the castle. Edit: guess we’re not having a fruitful discussion about this then. Shame.

reaperducer 2y ago
Edit: guess we’re not having a fruitful discussion about this then. Shame. When you started with the low-grade trope "Change my view" you already indicated you weren't interested in a discussion, just arguing for the sake of arguing on the internet.
- thebruce87m 2y ago
  I actually wasn’t, I was looking for other opinions. I think my view holds merit, but clearly smarter people than me think differently and I wanted to hear their angle. Thanks for explaining though, I was genuinely confused at the downvotes. Maybe that meme doesn’t mean what I thought it did.
  - freedomben 2y ago
    I think you've been gotten by the Reddit-ification of everything. Essentially, many people assume sinister motives on everyone else's part. If you're saying/asking something like you did, it must be because you have an agenda. Fortunately with a bit of time it will even out and probably go positive. It's the early voters on comments that are the most negative and quick to judgment.
  - JoshTriplett 2y ago
    > Maybe that meme doesn’t mean what I thought it did. It doesn't. The general implication of that meme is not that someone actually wants to seriously consider alternative views; the implication is "I want to assert my position, which I think is unassailable, using the veneer of an argument".
tholdem 2y ago
Why do you think bad actors "audit" open source more than good actors? Isn't it more the case that all actors audit all software? Open source just has potentially more "auditors" than closed source? (I don't understand what you mean by "usual exploits" and "keys to the castle")
- thebruce87m 2y ago
  Usual exploits = using the normal tools to look for buffer overflows and such by attacking the running system and compiled binaries. Keys to the castle = the ability to also look in the source code for vulnerabilities, run static analysis, fuzzing but also architectural flaws. Basically use extra methods that you can’t do on the running system or binaries. You would expect some tools to be run already by the authors but some tools will find things that others don’t. Bad actors have an incentive to audit the code (find vulnerabilities) since they were in the process of attacking the system anyway, so why not look at the source? You also have state level attackers who are getting paid to find these sort of things, and others looking to sell 0-days. Who are good actors? Who is willing to spend their time finding and fixing bugs? There are definitely people doing it out of the kindness of their heart, and others might be researchers and so on, maybe some companies that use the software - but you are relying on these outnumbering the bad actors. I think there will always be bad actors, and assuming that there is an army of good actors watching your back might not always be correct. But happy to hear other angles, which is why I opened (and accidentally closed) the conversation.
  - tholdem 2y ago
    Good actors do it mostly for money and fame, bad actors do it mostly for money. Both actors do it for open source and closed source software. Isn't it a good thing that anyone can effectively use tools to check for potential vulnerabilities? This is just speculation, but I think open source projects may mature faster in terms of security because the low-hanging fruit is maybe found faster than in closed source projects? Another interesting case I think about a lot is the classic AOSP vs. iOS. Apple tried to sue Corellium for making it easier to research iOS. Then Apple started the Apple Security Research Device program to make it easier for researchers to do iOS research. These two things seem to me to be a kind of involuntary open-sourcing of iOS. Why did Apple see Corellium as a threat and why did they provide researchers with these special devices?
noble-lombax 2y ago
[dead]
freedomben 2y ago
This is the classic "security through obscurity" argument. Yes it makes it harder to find vulns and develop exploits when the source isn't available, but once there are enough users to make it worth it, people are gonna fuzz the shit out of it regardless whether it's open or not. At least with open source, you have white hats (and gray hats to some extent) using the available source to get hints. These end up getting reported a lot more than for closed OSes. There may seem like more CVEs for Linux than Macos for example, but that isn't proportional to the number of vulns, researchers, or exploits out there. That said though, even if open were less secure (which I don't think it is), it is still a better and more ethical model for software and would be worth the security risk. Luckily for the world, open is more secure (or at least equally secure).
wezdog1 2y ago
Why don't you think they get audited by "good" actors.

reaperducer 2y ago

Edit: guess we’re not having a fruitful discussion about this then. Shame. When you started with the low-grade trope "Change my view" you already indicated you weren't interested in a discussion, just arguing for the sake of arguing on the internet.

thebruce87m 2y ago
I actually wasn’t, I was looking for other opinions. I think my view holds merit, but clearly smarter people than me think differently and I wanted to hear their angle. Thanks for explaining though, I was genuinely confused at the downvotes. Maybe that meme doesn’t mean what I thought it did.
- freedomben 2y ago
  I think you've been gotten by the Reddit-ification of everything. Essentially, many people assume sinister motives on everyone else's part. If you're saying/asking something like you did, it must be because you have an agenda. Fortunately with a bit of time it will even out and probably go positive. It's the early voters on comments that are the most negative and quick to judgment.
- JoshTriplett 2y ago
  > Maybe that meme doesn’t mean what I thought it did. It doesn't. The general implication of that meme is not that someone actually wants to seriously consider alternative views; the implication is "I want to assert my position, which I think is unassailable, using the veneer of an argument".

tholdem 2y ago

Why do you think bad actors "audit" open source more than good actors? Isn't it more the case that all actors audit all software? Open source just has potentially more "auditors" than closed source? (I don't understand what you mean by "usual exploits" and "keys to the castle")

thebruce87m 2y ago
Usual exploits = using the normal tools to look for buffer overflows and such by attacking the running system and compiled binaries. Keys to the castle = the ability to also look in the source code for vulnerabilities, run static analysis, fuzzing but also architectural flaws. Basically use extra methods that you can’t do on the running system or binaries. You would expect some tools to be run already by the authors but some tools will find things that others don’t. Bad actors have an incentive to audit the code (find vulnerabilities) since they were in the process of attacking the system anyway, so why not look at the source? You also have state level attackers who are getting paid to find these sort of things, and others looking to sell 0-days. Who are good actors? Who is willing to spend their time finding and fixing bugs? There are definitely people doing it out of the kindness of their heart, and others might be researchers and so on, maybe some companies that use the software - but you are relying on these outnumbering the bad actors. I think there will always be bad actors, and assuming that there is an army of good actors watching your back might not always be correct. But happy to hear other angles, which is why I opened (and accidentally closed) the conversation.
- tholdem 2y ago
  Good actors do it mostly for money and fame, bad actors do it mostly for money. Both actors do it for open source and closed source software. Isn't it a good thing that anyone can effectively use tools to check for potential vulnerabilities? This is just speculation, but I think open source projects may mature faster in terms of security because the low-hanging fruit is maybe found faster than in closed source projects? Another interesting case I think about a lot is the classic AOSP vs. iOS. Apple tried to sue Corellium for making it easier to research iOS. Then Apple started the Apple Security Research Device program to make it easier for researchers to do iOS research. These two things seem to me to be a kind of involuntary open-sourcing of iOS. Why did Apple see Corellium as a threat and why did they provide researchers with these special devices?

noble-lombax 2y ago

[dead]

freedomben 2y ago

This is the classic "security through obscurity" argument. Yes it makes it harder to find vulns and develop exploits when the source isn't available, but once there are enough users to make it worth it, people are gonna fuzz the shit out of it regardless whether it's open or not. At least with open source, you have white hats (and gray hats to some extent) using the available source to get hints. These end up getting reported a lot more than for closed OSes. There may seem like more CVEs for Linux than Macos for example, but that isn't proportional to the number of vulns, researchers, or exploits out there. That said though, even if open were less secure (which I don't think it is), it is still a better and more ethical model for software and would be worth the security risk. Luckily for the world, open is more secure (or at least equally secure).

wezdog1 2y ago

Why don't you think they get audited by "good" actors.