5 ms·

You are right that closed source doesn't mean its insecure - on the other hand, open source could prove that it is indeed secure. With new scandals coming up ev

You are right that closed source doesn't mean its insecure - on the other hand, open source could prove that it is indeed secure. With new scandals coming up every week these days, about hidden backdoors in security software, I trust open source more than ever before.

abtinf 13y ago
Open source would not prove it is secure. At best, you could look for obvious attacks. Cryptography is hard.
- gizmo686 13y ago
  No, at best you could have a large, diverse group of experts look for potential flaws and fix them. But, I agree being open source is not enough, you need to be open source, and the one implementation that everyone contributes to.
tptacek 13y ago
Ironically, it's particularly vis a vis cryptographic random number generation where we can most easily show open source cryptography failing its users; Debian fatally broke the OpenSSL CSPRNG so badly that attackers could remotely brute force SSH keys.
- deleted 13y ago
  [deleted]
- tankenmate 13y ago
  Whereas with closed source you would almost never know. Crypto is very hard to do properly, but at least with open source you have the possibility of independent third party analysis.
  - lmm 13y ago
    Wasn't the debian vulnerability discovered because someone noticed that two different servers had the same key? That would have gone down exactly the same with closed source.
- nwmcsween 13y ago
  Not defending the debain change but openssl code structure / readability is far from great, the only packages I would put behind openssl is libxml2, glib and glibc.
  - matthiasv 13y ago
    Weird. I find glib quite readable: https://git.gnome.org/browse/glib/tree/ https://git.gnome.org/browse/glib/tree/
- oellegaard 13y ago
  Maybe no-one would have noticed if it was closed source. I bet if Microsoft released everything as Open Source there would be billions of bugs discovered.
  - marshray 13y ago
    The Debian RNG bug was noticed by folks who found identical certificates in the wild, not by code inspection. Similar RNG weaknesses are commonly found in closed systems as well, so it doesn't seem to be a particularly open/closed source thing.
    - snogglethorpe 13y ago
      It's true that merely the ability for widespread code inspection doesn't mean all the code really gets widespread inspection [although I'm surprised by the number of messages I see on mailing lists like Q: "Hi, I'm a Chinese grad student and have been reading the gcc source... I don't understand how XXX can work, given that YYY... can you explain? thanks" A: "oh, hmm, actually, that seems to be a bug..."] Still, I think a common pattern is (1) notice funny symptom, (2) go look at code, puzzle through it for a while, and then "oh!" You're now in a much stronger position to fix the problem or petition for a fix. With closed-source code, step (2) is a lot harder unless you're in a privileged position...
- DanBC 13y ago
  Yes. And didn't that bug stay in Debian for two years? Open source code still needs people looking at it.

abtinf 13y ago

Open source would not prove it is secure. At best, you could look for obvious attacks. Cryptography is hard.

gizmo686 13y ago
No, at best you could have a large, diverse group of experts look for potential flaws and fix them. But, I agree being open source is not enough, you need to be open source, and the one implementation that everyone contributes to.

tptacek 13y ago

Ironically, it's particularly vis a vis cryptographic random number generation where we can most easily show open source cryptography failing its users; Debian fatally broke the OpenSSL CSPRNG so badly that attackers could remotely brute force SSH keys.

deleted 13y ago
[deleted]
tankenmate 13y ago
Whereas with closed source you would almost never know. Crypto is very hard to do properly, but at least with open source you have the possibility of independent third party analysis.
- lmm 13y ago
  Wasn't the debian vulnerability discovered because someone noticed that two different servers had the same key? That would have gone down exactly the same with closed source.
nwmcsween 13y ago
Not defending the debain change but openssl code structure / readability is far from great, the only packages I would put behind openssl is libxml2, glib and glibc.
- matthiasv 13y ago
  Weird. I find glib quite readable: https://git.gnome.org/browse/glib/tree/ https://git.gnome.org/browse/glib/tree/
oellegaard 13y ago
Maybe no-one would have noticed if it was closed source. I bet if Microsoft released everything as Open Source there would be billions of bugs discovered.
- marshray 13y ago
  The Debian RNG bug was noticed by folks who found identical certificates in the wild, not by code inspection. Similar RNG weaknesses are commonly found in closed systems as well, so it doesn't seem to be a particularly open/closed source thing.
  - snogglethorpe 13y ago
    It's true that merely the ability for widespread code inspection doesn't mean all the code really gets widespread inspection [although I'm surprised by the number of messages I see on mailing lists like Q: "Hi, I'm a Chinese grad student and have been reading the gcc source... I don't understand how XXX can work, given that YYY... can you explain? thanks" A: "oh, hmm, actually, that seems to be a bug..."] Still, I think a common pattern is (1) notice funny symptom, (2) go look at code, puzzle through it for a while, and then "oh!" You're now in a much stronger position to fix the problem or petition for a fix. With closed-source code, step (2) is a lot harder unless you're in a privileged position...
DanBC 13y ago
Yes. And didn't that bug stay in Debian for two years? Open source code still needs people looking at it.