• 0 Posts
  • 35 Comments
Joined 1 year ago
cake
Cake day: June 10th, 2023

help-circle

















  • “Given enough eyeballs, all bugs are shallow.” - Linus Torvalds

    Open Source software is (caveat, qualifier) safer than proprietary software. (And I’ll get to the caveats and qualifiers later.)

    Software exploits are possible only because of mistakes, oversights, negligence, or mistaken assumptions on the part of the developer of user of the code. More eyes on the code help suss out those mistakes, oversights, negligence, and mistaken assumptions, creating a more secure (and bug-free) piece of software.

    Besides that, companies that make proprietary software have incentives to put evil things into said proprietary software that endanger you to enrich them. (For instance, phone apps collecting personal data about you only to sell to advertising companies.) Companies that contribute to open source software also have incentives to put evil things into open source software, but when everyone has access to view the source code, it’s a lot harder to get away with that. (Not to say it’s never happened that purposeful vulnerabilities have gotten into open source software, but it’s a lot easier to catch such vulnerabilities in open source software than proprietary software.)

    As others have said, the way algorithms related to security are designed, the security doesn’t depend on keeping the algorithm secret. (But rather, keeping a “key” – a bit of data generated by the algorithm – secret.)

    Now, caveats.

    I do believe there is some extent to which open source software is trusted to be safe even when the “chain of custody” is questionable. There are ways to ensure integrity, but there are repositories such as NPM that carry large amounts of open source software that is used by huge numbers of people on a regular basis that don’t utilize sufficient integrity checking techniques. As a result, there have been a few cases where malicious code has sneaked into NPM and then into codebases.

    There are also cases where governments have gotten malicious code into open source projects. (Though, I’d expect that’s more of a problem with proprietary software, not less.)