5 ms·

> All software related to security should be open source. That's a very common and dangerous misbelief. Security products should come from a trustworthy sourc

> All software related to security should be open source. That's a very common and dangerous misbelief. Security products should come from a trustworthy source. Open source doesn't imply trustworthiness. If I were to screw you, I can very well do it with an open source product and pre-compiled binaries. Some people will rebuild from source, but a vast majority will use binaries provided assuming that since I'm all "open source" then I must be trustworthy. Hell of an assumption to make if I am not.

Sir_Cmpwn 12y ago
I'd argue that both criteria needs to be met :)
fabulist 12y ago
> If I were to screw you, I can very well do it with an open source product and pre-compiled binaries. This is even easier to do to closed-source products, and if you're worried about security than compiling your own binaries is a pretty basic measure. It is not just that open source software is inherently more trustworthy than closed source software. 1. It is more resistant to backdoor attacks (related to trustworthiness) and more effectively hardened. Fundamental to security is transparency. You cannot secure something if you cannot understand its attack surface; insecure undocumented features (ie the recent iPhone discoveries[1]) and binaries accidentally (or "accidentally") compiled with debug flags are only detectable if the source is available. 2. It is often more nimble and can respond to new threats which closed-source projects ignore. At my work, we were hit by as USB virus that McCaffe ignored despite our very premium support plan because it didn't exist anywhere else. This was before my time, but from my understanding it was a custom-tailored attack that was made in a virus creator -- a drag-and-drop not-so-advanced persistent threat. (Probably a prank or experiment; I work at a school.) If we used open source software, and the community shrugged at us, we could at least make our own signature. At it was, we had to bring the computers down one at a time, boot them into Linux, and run a script to delete the files and registry keys. This is the job antivirus software is meant to automate. I understand virus companies have a heavy workload, but what exactly were we paying for? With open source, you always get your monies worth. (For the software at least; open source support plans can still suck.) 3. Appsec is expensive, its not always something you can afford to pay for. If you aren't designing with security in mind from the start, its not just a feature you can build into your app. It will require pentests and likely a partial rewrite. On an open source project, theres a good chance someone will volunteer to close at least the widest holes. No one volunteers for closed source. 4. This is likely not a part of your threat model, but its harder to serve an open source project with a national security letter. [1] http://www.theguardian.com/technology/2014/jul/23/iphone-backdoors-surveillance-forensic-services http://www.theguardian.com/technology/2014/jul/23/iphone-bac...
arihant 12y ago
It's not just about screwing intentionally. Open source also helps with getting more eyes on the code. You need to be able to catch vulnerabilities before the bad guys or no amount of good reputation would survive. That is the primary reason for security software to be open source - reducing security by obfuscation and easy vulnerability check. That said, all software is written and audited by a group of individuals. Ultimately it all comes down to trusting them. Even audits on open source software is done by a few individuals, so when using any open source security software, you are only really trusting them. Any sense of security more than that is a smokescreen. In that regard, I agree with you. Open source does not help with reducing risk of bad intention. That is a myth.
- PinguTS 12y ago
  That argument is often repeated and also that often falsified, that Open Source is better because there are more people who have an eye on it. I just want to mention: — The famous Debian-Bug, which lead to easily guessable "random" numbers. Nobody reviewed that code change for years. — SSL Heartbleed. Nobody reviewed the code change by that guy. Not even the maintainer reviewed it. So the problem with Open Source is, as I see it, that everybody - from those who are experienced - thinks, that someone else has done the review. Which leads to the situation, that at the end of the day nobody does a review.
  - clarry 12y ago
    It's a problem with the people who make that assumption. Not everyone does. Just because you have examples of code that wasn't reviewed properly doesn't mean it applies to all open source software. I personally have my eyes on open source quite often, and I know many others who do. I also know we wouldn't have our eyes on it if it weren't for the source. Really, software being open source doesn't make it secure. It's just a precondition that allows us to find out if it is secure (and fix it when it isn't). If it isn't open source, then we should assume the worst, as we likely have no other way of knowing whether it's reasonably secure.
  - ultramancool 12y ago
    > SSL Heartbleed. Nobody reviewed the code change by that guy. Not even the maintainer reviewed it. I think this is a blatant counterexample actually. The code _was_ reviewed. It passed the review. This just shows that security is hard and that reviews don't always catch everything. But the only reason that heartbleed ever came to light was that OpenSSL is open source. Had it not been, such a bug would have been much much more difficult to find. Yes, this is not instant, yes, it takes time and leaves people vulnerable in that time, but it did work out in the end. If a similar bug were to exist in proprietary software, there's a good chance it would never come to light at all. Save for the extremely dedicated intelligence agencies who may have the people and desire to exert the effort to find it. That's who proprietary security software helps. The Debian bug isn't a terrible example, but it simply shows that distro-specific patches aren't well reviewed, not projects in general. Most people who want to see OpenSSL code go to OpenSSL, not Debian. Bugs happen, reviewers miss things or may not look in the right places. Open source does not mean secure by any means, it simply removes some requirements of trust of a sole entity and eases reviews.
tuananh 12y ago
most people do that but developers contribute to that will see it eventually.

Sir_Cmpwn 12y ago

I'd argue that both criteria needs to be met :)

fabulist 12y ago

> If I were to screw you, I can very well do it with an open source product and pre-compiled binaries. This is even easier to do to closed-source products, and if you're worried about security than compiling your own binaries is a pretty basic measure. It is not just that open source software is inherently more trustworthy than closed source software. 1. It is more resistant to backdoor attacks (related to trustworthiness) and more effectively hardened. Fundamental to security is transparency. You cannot secure something if you cannot understand its attack surface; insecure undocumented features (ie the recent iPhone discoveries[1]) and binaries accidentally (or "accidentally") compiled with debug flags are only detectable if the source is available. 2. It is often more nimble and can respond to new threats which closed-source projects ignore. At my work, we were hit by as USB virus that McCaffe ignored despite our very premium support plan because it didn't exist anywhere else. This was before my time, but from my understanding it was a custom-tailored attack that was made in a virus creator -- a drag-and-drop not-so-advanced persistent threat. (Probably a prank or experiment; I work at a school.) If we used open source software, and the community shrugged at us, we could at least make our own signature. At it was, we had to bring the computers down one at a time, boot them into Linux, and run a script to delete the files and registry keys. This is the job antivirus software is meant to automate. I understand virus companies have a heavy workload, but what exactly were we paying for? With open source, you always get your monies worth. (For the software at least; open source support plans can still suck.) 3. Appsec is expensive, its not always something you can afford to pay for. If you aren't designing with security in mind from the start, its not just a feature you can build into your app. It will require pentests and likely a partial rewrite. On an open source project, theres a good chance someone will volunteer to close at least the widest holes. No one volunteers for closed source. 4. This is likely not a part of your threat model, but its harder to serve an open source project with a national security letter. [1] http://www.theguardian.com/technology/2014/jul/23/iphone-backdoors-surveillance-forensic-services http://www.theguardian.com/technology/2014/jul/23/iphone-bac...

arihant 12y ago

It's not just about screwing intentionally. Open source also helps with getting more eyes on the code. You need to be able to catch vulnerabilities before the bad guys or no amount of good reputation would survive. That is the primary reason for security software to be open source - reducing security by obfuscation and easy vulnerability check. That said, all software is written and audited by a group of individuals. Ultimately it all comes down to trusting them. Even audits on open source software is done by a few individuals, so when using any open source security software, you are only really trusting them. Any sense of security more than that is a smokescreen. In that regard, I agree with you. Open source does not help with reducing risk of bad intention. That is a myth.

PinguTS 12y ago
That argument is often repeated and also that often falsified, that Open Source is better because there are more people who have an eye on it. I just want to mention: — The famous Debian-Bug, which lead to easily guessable "random" numbers. Nobody reviewed that code change for years. — SSL Heartbleed. Nobody reviewed the code change by that guy. Not even the maintainer reviewed it. So the problem with Open Source is, as I see it, that everybody - from those who are experienced - thinks, that someone else has done the review. Which leads to the situation, that at the end of the day nobody does a review.
- clarry 12y ago
  It's a problem with the people who make that assumption. Not everyone does. Just because you have examples of code that wasn't reviewed properly doesn't mean it applies to all open source software. I personally have my eyes on open source quite often, and I know many others who do. I also know we wouldn't have our eyes on it if it weren't for the source. Really, software being open source doesn't make it secure. It's just a precondition that allows us to find out if it is secure (and fix it when it isn't). If it isn't open source, then we should assume the worst, as we likely have no other way of knowing whether it's reasonably secure.
- ultramancool 12y ago
  > SSL Heartbleed. Nobody reviewed the code change by that guy. Not even the maintainer reviewed it. I think this is a blatant counterexample actually. The code _was_ reviewed. It passed the review. This just shows that security is hard and that reviews don't always catch everything. But the only reason that heartbleed ever came to light was that OpenSSL is open source. Had it not been, such a bug would have been much much more difficult to find. Yes, this is not instant, yes, it takes time and leaves people vulnerable in that time, but it did work out in the end. If a similar bug were to exist in proprietary software, there's a good chance it would never come to light at all. Save for the extremely dedicated intelligence agencies who may have the people and desire to exert the effort to find it. That's who proprietary security software helps. The Debian bug isn't a terrible example, but it simply shows that distro-specific patches aren't well reviewed, not projects in general. Most people who want to see OpenSSL code go to OpenSSL, not Debian. Bugs happen, reviewers miss things or may not look in the right places. Open source does not mean secure by any means, it simply removes some requirements of trust of a sole entity and eases reviews.

tuananh 12y ago

most people do that but developers contribute to that will see it eventually.