3 ms·

I'm curious if someone more knowledgeable than me in the security world could elaborate on where most people tend to sit on this spectrum of openness. I figure

by cjslep 12y ago

I'm curious if someone more knowledgeable than me in the security world could elaborate on where most people tend to sit on this spectrum of openness. I figure "obscurity" reduces the number of potential attackers that have the capability of cleverly attaining the information being kept obscure, but at the cost of not having much of the public available to evaluate the software's integrity. My uninformed guess is many people stick to the former.

riskable 12y ago
Finding vulnerabilities in closed source software is just as easy as finding vulnerabilities in open source software. The key differences are: * Transparency. * The ability to fix it yourself. Also consider this: No one submits patches to fix vulnerabilities in closed source software because that's not possible without the source. This results in all sorts of problems that just don't exist when the code is available: * After reporting a vulnerability you now have to wait for the vendor to fix it. If the vulnerability isn't out in the open (yet) they might take their sweet time while you nervously twiddle your thumbs. * If the vendor doesn't support the product anymore (or the vendor doesn't exist anymore) then there's really no options at all. You have to live with the vulnerability or get a new product. * When the vendor releases a fix how do you know if they fixed the core vulnerability or just the edge case that was given to them? All too often vendors apply hacks to detect specific edge cases instead of fixing underlying problems. This is why attackers are able to take advantage of old vulnerabilities by means of simple fuzzing (or just being clever). For example, I reported a horrific information disclosure vulnerability (SSNs in the clear) once and their 'fix' was to base64-encode the data. If I didn't keep track and follow up with them (took them four months to release that 'fix') it is likely that vulnerability would still be present. There's actually a lot of other problems related to closed source vulnerabilities and fixes but I'm out of time...
- cjslep 12y ago
  I appreciate the time you did spend writing this comment. I don't work in the security world so it is nice to know some arguments for open-source software as a way of removing vulnerability in software.

by cjslep 12y ago

riskable 12y ago

Finding vulnerabilities in closed source software is just as easy as finding vulnerabilities in open source software. The key differences are: * Transparency. * The ability to fix it yourself. Also consider this: No one submits patches to fix vulnerabilities in closed source software because that's not possible without the source. This results in all sorts of problems that just don't exist when the code is available: * After reporting a vulnerability you now have to wait for the vendor to fix it. If the vulnerability isn't out in the open (yet) they might take their sweet time while you nervously twiddle your thumbs. * If the vendor doesn't support the product anymore (or the vendor doesn't exist anymore) then there's really no options at all. You have to live with the vulnerability or get a new product. * When the vendor releases a fix how do you know if they fixed the core vulnerability or just the edge case that was given to them? All too often vendors apply hacks to detect specific edge cases instead of fixing underlying problems. This is why attackers are able to take advantage of old vulnerabilities by means of simple fuzzing (or just being clever). For example, I reported a horrific information disclosure vulnerability (SSNs in the clear) once and their 'fix' was to base64-encode the data. If I didn't keep track and follow up with them (took them four months to release that 'fix') it is likely that vulnerability would still be present. There's actually a lot of other problems related to closed source vulnerabilities and fixes but I'm out of time...

cjslep 12y ago
I appreciate the time you did spend writing this comment. I don't work in the security world so it is nice to know some arguments for open-source software as a way of removing vulnerability in software.