2 ms·

Serious question: What's the point of safely downloading any binary to run on your closed-source operating system? None of that code can be verified. Do peop

by na85 11y ago

Serious question: What's the point of safely downloading any binary to run on your closed-source operating system? None of that code can be verified. Do people actually believe Windows is secure?

belak 11y ago
Windows is definitely still a closed source operating system, but the code for putty is definitely available on the same page as the downloads. I assume it has the same security concerns, but at least you can look at the code.
krapp 11y ago
Unless you have personally read, fully understood the security implications of, and compiled from source every application currently running on a Linux machine, including the kernel, then you really have little guarantee of safety in open source, and probably not even then. Most Linux users are not experts in any of the multiple languages that their applications might have been written in, and so are neither capable, nor likely willing, to pore over millions of lines of polyglot code just to verify that the latest version of Iceweasel doesn't have an NSA backdoor (or what have you.) Therefore, the blind trust most Linux users place in whomever wrote their distro and their applications is no different than the blind trust Windows and OSX users place in the companies that make their operating systems and any binaries they download from third parties. Granted, in the open source case, anyone can look at the code, and the axiom that "with enough eyes, all bugs are shallow" does sometimes work. But it doesn't necessarily follow that no one at Microsoft or Apple is paying as much attention to their code as the masses are to open source code. It's just an assumption on the part of the open source community, that open source necessarily leads to greater code coverage because the code is available to everyone, versus a subset of employees at a company, and that it's harder to hide things in plain sight when the source code is available. This assumption of course turns out sometimes to be spectacularly untrue, as it was in the case of Heartbleed.

by na85 11y ago

Serious question: What's the point of safely downloading any binary to run on your closed-source operating system? None of that code can be verified. Do people actually believe Windows is secure?

belak 11y ago

Windows is definitely still a closed source operating system, but the code for putty is definitely available on the same page as the downloads. I assume it has the same security concerns, but at least you can look at the code.

krapp 11y ago

Unless you have personally read, fully understood the security implications of, and compiled from source every application currently running on a Linux machine, including the kernel, then you really have little guarantee of safety in open source, and probably not even then. Most Linux users are not experts in any of the multiple languages that their applications might have been written in, and so are neither capable, nor likely willing, to pore over millions of lines of polyglot code just to verify that the latest version of Iceweasel doesn't have an NSA backdoor (or what have you.) Therefore, the blind trust most Linux users place in whomever wrote their distro and their applications is no different than the blind trust Windows and OSX users place in the companies that make their operating systems and any binaries they download from third parties. Granted, in the open source case, anyone can look at the code, and the axiom that "with enough eyes, all bugs are shallow" does sometimes work. But it doesn't necessarily follow that no one at Microsoft or Apple is paying as much attention to their code as the masses are to open source code. It's just an assumption on the part of the open source community, that open source necessarily leads to greater code coverage because the code is available to everyone, versus a subset of employees at a company, and that it's harder to hide things in plain sight when the source code is available. This assumption of course turns out sometimes to be spectacularly untrue, as it was in the case of Heartbleed.