3 ms·

That argument is often repeated and also that often falsified, that Open Source is better because there are more people who have an eye on it. I just want to m

by PinguTS 12y ago

That argument is often repeated and also that often falsified, that Open Source is better because there are more people who have an eye on it. I just want to mention: — The famous Debian-Bug, which lead to easily guessable "random" numbers. Nobody reviewed that code change for years. — SSL Heartbleed. Nobody reviewed the code change by that guy. Not even the maintainer reviewed it. So the problem with Open Source is, as I see it, that everybody - from those who are experienced - thinks, that someone else has done the review. Which leads to the situation, that at the end of the day nobody does a review.

clarry 12y ago
It's a problem with the people who make that assumption. Not everyone does. Just because you have examples of code that wasn't reviewed properly doesn't mean it applies to all open source software. I personally have my eyes on open source quite often, and I know many others who do. I also know we wouldn't have our eyes on it if it weren't for the source. Really, software being open source doesn't make it secure. It's just a precondition that allows us to find out if it is secure (and fix it when it isn't). If it isn't open source, then we should assume the worst, as we likely have no other way of knowing whether it's reasonably secure.
ultramancool 12y ago
> SSL Heartbleed. Nobody reviewed the code change by that guy. Not even the maintainer reviewed it. I think this is a blatant counterexample actually. The code _was_ reviewed. It passed the review. This just shows that security is hard and that reviews don't always catch everything. But the only reason that heartbleed ever came to light was that OpenSSL is open source. Had it not been, such a bug would have been much much more difficult to find. Yes, this is not instant, yes, it takes time and leaves people vulnerable in that time, but it did work out in the end. If a similar bug were to exist in proprietary software, there's a good chance it would never come to light at all. Save for the extremely dedicated intelligence agencies who may have the people and desire to exert the effort to find it. That's who proprietary security software helps. The Debian bug isn't a terrible example, but it simply shows that distro-specific patches aren't well reviewed, not projects in general. Most people who want to see OpenSSL code go to OpenSSL, not Debian. Bugs happen, reviewers miss things or may not look in the right places. Open source does not mean secure by any means, it simply removes some requirements of trust of a sole entity and eases reviews.
arihant 12y ago
So if it wasn't open source, how would you go about discovering Heartbleed? It was discovered independently by multiple people beacause it was open source - so contrary to your naive assumption, people are looking at these things. Here is a story how it happened and how it was patched - http://en.wikipedia.org/wiki/Heartbleed#Discovery http://en.wikipedia.org/wiki/Heartbleed#Discovery Are you really arguing that discovering and fixing Heartbleed would be simpler and faster in a closed source form?
- bsamuels 12y ago
  heartbleed wasn't discovered by browsing the source code, it was found using a fuzzer. it wouldnt have mattered if it was open or closed source.

by PinguTS 12y ago

clarry 12y ago

It's a problem with the people who make that assumption. Not everyone does. Just because you have examples of code that wasn't reviewed properly doesn't mean it applies to all open source software. I personally have my eyes on open source quite often, and I know many others who do. I also know we wouldn't have our eyes on it if it weren't for the source. Really, software being open source doesn't make it secure. It's just a precondition that allows us to find out if it is secure (and fix it when it isn't). If it isn't open source, then we should assume the worst, as we likely have no other way of knowing whether it's reasonably secure.

ultramancool 12y ago

> SSL Heartbleed. Nobody reviewed the code change by that guy. Not even the maintainer reviewed it. I think this is a blatant counterexample actually. The code _was_ reviewed. It passed the review. This just shows that security is hard and that reviews don't always catch everything. But the only reason that heartbleed ever came to light was that OpenSSL is open source. Had it not been, such a bug would have been much much more difficult to find. Yes, this is not instant, yes, it takes time and leaves people vulnerable in that time, but it did work out in the end. If a similar bug were to exist in proprietary software, there's a good chance it would never come to light at all. Save for the extremely dedicated intelligence agencies who may have the people and desire to exert the effort to find it. That's who proprietary security software helps. The Debian bug isn't a terrible example, but it simply shows that distro-specific patches aren't well reviewed, not projects in general. Most people who want to see OpenSSL code go to OpenSSL, not Debian. Bugs happen, reviewers miss things or may not look in the right places. Open source does not mean secure by any means, it simply removes some requirements of trust of a sole entity and eases reviews.

arihant 12y ago

So if it wasn't open source, how would you go about discovering Heartbleed? It was discovered independently by multiple people beacause it was open source - so contrary to your naive assumption, people are looking at these things. Here is a story how it happened and how it was patched - http://en.wikipedia.org/wiki/Heartbleed#Discovery http://en.wikipedia.org/wiki/Heartbleed#Discovery Are you really arguing that discovering and fixing Heartbleed would be simpler and faster in a closed source form?

bsamuels 12y ago
heartbleed wasn't discovered by browsing the source code, it was found using a fuzzer. it wouldnt have mattered if it was open or closed source.