Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm developing a big community/forum website and I'd like to upload my code to GitHub to have at least some sort of version control over it (because I have nothing other than a .rar file as a backup, not even SVN), to let others contribute to the project, and also perhaps using it to let my potential future employers see some of my code as some sort of curriculum.

But what I'm wondering now, and I'm suprised I haven't seen anyone mention it before is the security aspect of it. Isn't publishing the code of a website a HUGE security hole? Is like giving a potential hacker or anyone who would like to find any potential exploit possible, even considering that the critical files aren't uploaded (database passwords, authentication scripts, etc.).

Of course that there are millions of projects uploaded to GitHub and no one will find mine just 'by chance'. But if they look for it, it would indeed be there.

Bottomline: my problem is not about copyright or licenses, but others finding exploits in my website.

I'm I missing something here?

share|improve this question
4  
Security by obscurity hasn't worked well for most software so far. Source code is but one piece of the puzzle! –  Martijn Pieters Nov 24 '12 at 10:28
2  
Use BitBucket instead. It supports git as well. –  Job Nov 24 '12 at 14:31
    
So don't have obvious exploits in your website for people to find? For example, if people can tell from your source code where the SQL injection vulnerabilities are, then so can you. –  user16764 Nov 24 '12 at 18:12
    
As @delnan points out below, GitHub allows you to host private repos for a price. Aside from the millions of public (open source) projects you can indeed see, there's probably millions of private projects on GitHub that no one outside the owner/collaborators of the project will ever see. –  Suman Nov 24 '12 at 18:50
1  
If nothing else create a local git repo. That way you can at least rollback when you make a mistake. –  Zachary K Nov 24 '12 at 18:59
add comment

5 Answers 5

up vote 21 down vote accepted

I'm I missing something here?

Yes. Relying on people not knowing your source code to prevent them from finding security exploits in it is known as security through obscurity.

The problem: it doesn't work. Skilled hackers don't need the source code to find and exploit vulnerabilities. They'll do some fuzzing to find input that causes problems and then use their knowledge of how the underlying OS/language/framework works to identify a vulnerability.

It is widely agreed that having the source code public increases security by enabling well-meaning people to find vulnerabilities and fix them, or at least tell the developer about them. There are two important reasons why this works:

  • There are generally more well-meaning than malicious people
  • Any vulnerability found by a well-meaning person will be fixed for everyone; hackers are far less likely to collaborate

Of course it doesn't work with pet projects that have few active users, but those are also exceedingly unlikely to be targeted by a hacker.

share|improve this answer
    
Not that I agree or disagree, but "widely agreed" by whom? This is not a sentiment that I've actually heard expressed. –  Steve Evers Nov 24 '12 at 10:22
    
Thanks for the quick response man! And it does make sense when I think about it, it's a trade-off between sharing something that would have already been found by skilled hackers and getting proper input from well-intentioned programmers. Clearly I hadn't though about it this way.. Thanks again! –  fedeetz Nov 24 '12 at 10:25
    
@SnOrfus: see Linus' Law and Kerckhoffs's principle. Admittedly, "widely agreed" may be a bit of an exaggeration, but I'd wager that the majority of experienced programmers would agree. –  Michael Borgwardt Nov 24 '12 at 10:36
add comment

First off, you can use (distributed) version control without making the repository public. You can just create a repo on your local computer, and push to/pull from other computers. You can also upload the repository (giving you more backups and easier collaboration) without making it public. GitHub offers private repos for a fee, Bitbucket does the same and makes small (5 persons or something) private repos free. Of course, then you don't get the other benefits you mentioned.

The security aspect is rather small. There are many, many worthwhile attack vectors which can be tested out easily without looking at the (server-side) source code (like being attentive to GET and POST parameters, checking cookies and session handling, adding inputs that ought to get escaped and check if they are, etc.). If you're vulnerable to any of them, a determined attacker can exploit them reasonably quickly without looking at the source code. More obscure and harder-to-exploit errors are (probably) also harder to spot in the source code, so again, you don't lose much.

On the other hand, making it public and accepting contributions may attract people who can spot exploits, without ill meaning, and tell you about them (or even fix them themselves). This goes doubly if it's really popular but you're not a security expert (no offense, but you don't sound like one; for example, you didn't mention security through obscurity and how your concern is not a case of it).

share|improve this answer
    
Like I told @Michael Borgwardt this makes complete sense. I'm guessing the benefit of publishing the code is even bigger when more people know about the project and provide contributions to fix exploits. And if it wasn't popular, most likely the potential hackers wouldn't care enough about it either. Thanks for the answer! –  fedeetz Nov 24 '12 at 10:30
    
As far as I can tell, github doesn't offer free private repos (a minor correction, not a nitpick). –  scrwtp Nov 24 '12 at 10:33
    
@scrwtp: 'for a fee' is not the same as free. –  Martijn Pieters Nov 24 '12 at 10:34
    
Ah, true, I misread. –  scrwtp Nov 24 '12 at 10:34
add comment

Setting aside the issue of security and whether making your code public would enhance it or not, you can setup a source control system on your machine yourself. In case of git it's trivial, just initialize a local repository and you're done, but setting an SVN also isn't a daunting task. Maybe an hour or two following the tutorials, if you have little prior knowledge on how to setup SVN.

So you can still benefit from source control, regardless whether you end up using an online service or not.

share|improve this answer
add comment

BitBucket has free private repos and supports both git and mercurial.

share|improve this answer
add comment

Most malicious hacking is done anonymously. Some person in Russia running a script that scans hosts for open ports, or what-have-you. No one is going to explicitly pour over your code just to find a way to hack in to do harm. Not unless you really piss someone off.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.