6 ms·

All software related to security should be open source. This particular piece of software doesn't sit at a crucial point in a secure system, but a greater deal

All software related to security should be open source. This particular piece of software doesn't sit at a crucial point in a secure system, but a greater deal of transparency would be appreciated. I personally avoid using closed-source tools for security purposes, and especially closed-source tools that are hoping to monetize. I use Linux, though, so I guess it doesn't really matter to me in this case :) I would also say that calling home is a huge no-no for this software. I would seriously consider revisiting that choice if I were you.

greenwalls 12y ago
Thanks for your feedback. We'll try to add more transparency. The calling home is for software updates and it shows up on the graph, and GlassWire can even block itself.
- Sir_Cmpwn 12y ago
  That may be the case, but it's still not acceptable in my opinion. Calling home to fetch a new database of malicious hosts and such is fine, but calling home for analytics is not okay. At the very least, clearly disclose it and make it easy to opt out.
  - specialk 12y ago
    Out of curiosity, do you have any security concerns about calling home for analytic or is it just you would prefer the privacy of not having your usage tracked?
    - Sir_Cmpwn 12y ago
      It's mostly privacy concerns, but also the fact that you use this software at all can disclose some interesting information to eavesdropping attackers. Most worrisome is just that it's not very well disclosed - most users just don't know it's happening, and it's not very well justified.
      - sbarre 12y ago
        How can you say "most users don't know it's happening" when it's the first thing you see in the graph when you load the application? We got your initial point.. I think you're just grinding metal at this point.. Ease down.. ease down...
        Sir_Cmpwn 12y ago
        I don't see anywhere that it discloses what is being sent, just that it's sending something. Did I miss something?
    - lucb1e 12y ago
      If it's opt-in, I enable it. If it's opt-out, I disable it. For me it's a matter of principle. That people politely ask is both an indication of trustworthiness and how I prefer things to be, so I try to help by enabling it. It also depends on the way they ask. Mozilla Firefox for Android tells me that I should choose what I share, enabling crash reports and disabling telemetry by default. Even though the crash report is technically opt-out, they ask me in clear terms. I like that.
  - johnduhart 12y ago
    > but calling home for analytics is not okay It's like you didn't even read what was written.
- zdrummond 12y ago
  Update channels are very hard to secure and is a huge opportunity to take ownership of the software (and from it, the machine). For an example, check out the Defcon 22 talk Hack All the Things[1], page ~61. NTV200-100NAS owned through unsigned updates.... [1] http://download.gtvhacker.com/file/generic/GTVHacker-DEFCON22.pdf http://download.gtvhacker.com/file/generic/GTVHacker-DEFCON2...
  - greenwalls 12y ago
    Thank you. We will check it out in detail.
- stfnfhrmnn 12y ago
  Another simple fix: tell us who you are. The contact page is woefully generic and anonymous. Glasswire appears to be a company, more than one person. Where are you based? What's your background? Funding?
  - mbrownnyc 12y ago
    I did a corporate search and tracked the owner: ANTON BONDAR. Also affiliated with ManyCam.
huhtenberg 12y ago
> All software related to security should be open source. That's a very common and dangerous misbelief. Security products should come from a trustworthy source. Open source doesn't imply trustworthiness. If I were to screw you, I can very well do it with an open source product and pre-compiled binaries. Some people will rebuild from source, but a vast majority will use binaries provided assuming that since I'm all "open source" then I must be trustworthy. Hell of an assumption to make if I am not.
- Sir_Cmpwn 12y ago
  I'd argue that both criteria needs to be met :)
- fabulist 12y ago
  > If I were to screw you, I can very well do it with an open source product and pre-compiled binaries. This is even easier to do to closed-source products, and if you're worried about security than compiling your own binaries is a pretty basic measure. It is not just that open source software is inherently more trustworthy than closed source software. 1. It is more resistant to backdoor attacks (related to trustworthiness) and more effectively hardened. Fundamental to security is transparency. You cannot secure something if you cannot understand its attack surface; insecure undocumented features (ie the recent iPhone discoveries[1]) and binaries accidentally (or "accidentally") compiled with debug flags are only detectable if the source is available. 2. It is often more nimble and can respond to new threats which closed-source projects ignore. At my work, we were hit by as USB virus that McCaffe ignored despite our very premium support plan because it didn't exist anywhere else. This was before my time, but from my understanding it was a custom-tailored attack that was made in a virus creator -- a drag-and-drop not-so-advanced persistent threat. (Probably a prank or experiment; I work at a school.) If we used open source software, and the community shrugged at us, we could at least make our own signature. At it was, we had to bring the computers down one at a time, boot them into Linux, and run a script to delete the files and registry keys. This is the job antivirus software is meant to automate. I understand virus companies have a heavy workload, but what exactly were we paying for? With open source, you always get your monies worth. (For the software at least; open source support plans can still suck.) 3. Appsec is expensive, its not always something you can afford to pay for. If you aren't designing with security in mind from the start, its not just a feature you can build into your app. It will require pentests and likely a partial rewrite. On an open source project, theres a good chance someone will volunteer to close at least the widest holes. No one volunteers for closed source. 4. This is likely not a part of your threat model, but its harder to serve an open source project with a national security letter. [1] http://www.theguardian.com/technology/2014/jul/23/iphone-backdoors-surveillance-forensic-services http://www.theguardian.com/technology/2014/jul/23/iphone-bac...
rational-future 12y ago
>> All software should be free Fixed that for you, yours RMS ;-)
drdaeman 12y ago
As a (unworthy, since I happen to use proprietary software accidentally) believer in Free Software, I tend to agree, but since that's unlikely to happen, I'd say all security-related software should be at least fully auditable by end-user. That is, there must be either 1) some form of human-readable (i.e. unobfuscated) source code and means to validate the built binaries to match the provided sources or 2) means to easily decompile the binaries to a human-readable high-level language and study their behavior. That is, one of the first things this GlassWire app did is connection to its home server. It openly admitted that itself, but nonetheless, why it did so and what kind of data (~200+ KiB, that's a fair amount that probably exceeds any analytic and update-checking needs) were transferred — I have no idea and I'm too lazy to figure out.
lucb1e 12y ago
> All software related to security should be open source Why just security-related software? It doesn't get special permissions or anything. All software can do equal damage on most operating systems. > I personally avoid using closed-source tools for security purposes I too prefer open source tools for security purposes, but that means that for security purposes I prefer all my software to be open source.
- Sir_Cmpwn 12y ago
  In a perfect world, all software would be open source. Our world isn't perfect so I just live with asking people to make their security-related software open source.
  - lucb1e 12y ago
    Sounds like Debian is perfect world then :) I must confess to using a few blobs for drivers, software that school wants me to run (for UML designing) and the occasional game. But overall, I'm pretty clean of closed source software.
  - andrewchambers 12y ago
    How do you know software isn't security related if you can't see its source? They might tell you it isn't :)
dinkumthinkum 12y ago
I think you are conflating security advice with business advice. Obviously, you are not the target audience. I may agree with you on a technical level but on a business one I do not really agree.

greenwalls 12y ago

Thanks for your feedback. We'll try to add more transparency. The calling home is for software updates and it shows up on the graph, and GlassWire can even block itself.

Sir_Cmpwn 12y ago
That may be the case, but it's still not acceptable in my opinion. Calling home to fetch a new database of malicious hosts and such is fine, but calling home for analytics is not okay. At the very least, clearly disclose it and make it easy to opt out.
- specialk 12y ago
  Out of curiosity, do you have any security concerns about calling home for analytic or is it just you would prefer the privacy of not having your usage tracked?
  - Sir_Cmpwn 12y ago
    It's mostly privacy concerns, but also the fact that you use this software at all can disclose some interesting information to eavesdropping attackers. Most worrisome is just that it's not very well disclosed - most users just don't know it's happening, and it's not very well justified.
    - sbarre 12y ago
      How can you say "most users don't know it's happening" when it's the first thing you see in the graph when you load the application? We got your initial point.. I think you're just grinding metal at this point.. Ease down.. ease down...
      - Sir_Cmpwn 12y ago
        I don't see anywhere that it discloses what is being sent, just that it's sending something. Did I miss something?
  - lucb1e 12y ago
    If it's opt-in, I enable it. If it's opt-out, I disable it. For me it's a matter of principle. That people politely ask is both an indication of trustworthiness and how I prefer things to be, so I try to help by enabling it. It also depends on the way they ask. Mozilla Firefox for Android tells me that I should choose what I share, enabling crash reports and disabling telemetry by default. Even though the crash report is technically opt-out, they ask me in clear terms. I like that.
- johnduhart 12y ago
  > but calling home for analytics is not okay It's like you didn't even read what was written.
zdrummond 12y ago
Update channels are very hard to secure and is a huge opportunity to take ownership of the software (and from it, the machine). For an example, check out the Defcon 22 talk Hack All the Things[1], page ~61. NTV200-100NAS owned through unsigned updates.... [1] http://download.gtvhacker.com/file/generic/GTVHacker-DEFCON22.pdf http://download.gtvhacker.com/file/generic/GTVHacker-DEFCON2...
- greenwalls 12y ago
  Thank you. We will check it out in detail.
stfnfhrmnn 12y ago
Another simple fix: tell us who you are. The contact page is woefully generic and anonymous. Glasswire appears to be a company, more than one person. Where are you based? What's your background? Funding?
- mbrownnyc 12y ago
  I did a corporate search and tracked the owner: ANTON BONDAR. Also affiliated with ManyCam.

huhtenberg 12y ago

> All software related to security should be open source. That's a very common and dangerous misbelief. Security products should come from a trustworthy source. Open source doesn't imply trustworthiness. If I were to screw you, I can very well do it with an open source product and pre-compiled binaries. Some people will rebuild from source, but a vast majority will use binaries provided assuming that since I'm all "open source" then I must be trustworthy. Hell of an assumption to make if I am not.

Sir_Cmpwn 12y ago
I'd argue that both criteria needs to be met :)
fabulist 12y ago
> If I were to screw you, I can very well do it with an open source product and pre-compiled binaries. This is even easier to do to closed-source products, and if you're worried about security than compiling your own binaries is a pretty basic measure. It is not just that open source software is inherently more trustworthy than closed source software. 1. It is more resistant to backdoor attacks (related to trustworthiness) and more effectively hardened. Fundamental to security is transparency. You cannot secure something if you cannot understand its attack surface; insecure undocumented features (ie the recent iPhone discoveries[1]) and binaries accidentally (or "accidentally") compiled with debug flags are only detectable if the source is available. 2. It is often more nimble and can respond to new threats which closed-source projects ignore. At my work, we were hit by as USB virus that McCaffe ignored despite our very premium support plan because it didn't exist anywhere else. This was before my time, but from my understanding it was a custom-tailored attack that was made in a virus creator -- a drag-and-drop not-so-advanced persistent threat. (Probably a prank or experiment; I work at a school.) If we used open source software, and the community shrugged at us, we could at least make our own signature. At it was, we had to bring the computers down one at a time, boot them into Linux, and run a script to delete the files and registry keys. This is the job antivirus software is meant to automate. I understand virus companies have a heavy workload, but what exactly were we paying for? With open source, you always get your monies worth. (For the software at least; open source support plans can still suck.) 3. Appsec is expensive, its not always something you can afford to pay for. If you aren't designing with security in mind from the start, its not just a feature you can build into your app. It will require pentests and likely a partial rewrite. On an open source project, theres a good chance someone will volunteer to close at least the widest holes. No one volunteers for closed source. 4. This is likely not a part of your threat model, but its harder to serve an open source project with a national security letter. [1] http://www.theguardian.com/technology/2014/jul/23/iphone-backdoors-surveillance-forensic-services http://www.theguardian.com/technology/2014/jul/23/iphone-bac...

rational-future 12y ago

>> All software should be free Fixed that for you, yours RMS ;-)

drdaeman 12y ago

As a (unworthy, since I happen to use proprietary software accidentally) believer in Free Software, I tend to agree, but since that's unlikely to happen, I'd say all security-related software should be at least fully auditable by end-user. That is, there must be either 1) some form of human-readable (i.e. unobfuscated) source code and means to validate the built binaries to match the provided sources or 2) means to easily decompile the binaries to a human-readable high-level language and study their behavior. That is, one of the first things this GlassWire app did is connection to its home server. It openly admitted that itself, but nonetheless, why it did so and what kind of data (~200+ KiB, that's a fair amount that probably exceeds any analytic and update-checking needs) were transferred — I have no idea and I'm too lazy to figure out.

lucb1e 12y ago

> All software related to security should be open source Why just security-related software? It doesn't get special permissions or anything. All software can do equal damage on most operating systems. > I personally avoid using closed-source tools for security purposes I too prefer open source tools for security purposes, but that means that for security purposes I prefer all my software to be open source.

Sir_Cmpwn 12y ago
In a perfect world, all software would be open source. Our world isn't perfect so I just live with asking people to make their security-related software open source.
- lucb1e 12y ago
  Sounds like Debian is perfect world then :) I must confess to using a few blobs for drivers, software that school wants me to run (for UML designing) and the occasional game. But overall, I'm pretty clean of closed source software.
- andrewchambers 12y ago
  How do you know software isn't security related if you can't see its source? They might tell you it isn't :)

dinkumthinkum 12y ago

I think you are conflating security advice with business advice. Obviously, you are not the target audience. I may agree with you on a technical level but on a business one I do not really agree.