Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

We know of Linus' law:

With enough eyeballs all bugs are shallow

In general, people seem to say that open-source software is more secure because of that very thing, but...

There are many small OSS projects with just 1 or 2 developers (the cathedral model, as described by ESR). For these projects, does releasing the source-code actually lower the security? For projects like the Linux kernel there are thousands of developers and security vulnerabilities are quite likely going to be found, but when just some few people look through the source code, while allowing crackers (black hat hackers) to see the source as well, is the security lowered instead of increased?

I know that the security advantage closed-source software has over OSS is security through obscurity, which isn't good (at all), but it could help to some degree, at least by giving those few devs some more time (security through obscurity doesn't help with the if but with the when).

EDIT: The question isn't whether OSS is more secure than non-OSS software but if the advantages for crackers are greater than the advantages for the developers who want to prevent security vulnerabilities from being exploited.

share|improve this question
add comment

4 Answers

up vote 0 down vote accepted

I think it probably does lower security a bit, for an open source project that's so small or obscure that nobody but its authors are really looking at it. In that case, you aren't getting any help with security from a community, but if someone did for some reason target your small obscure project, they'd have an easier time since they'd have the source. Not that they'd have an impossible time without source, but having the source speeds up understanding, whether your intent is friendly or malicious.

A lot of the most common web vulnerabilities (HTML escaping issues, SQL injection, etc.) are pretty easy to check for without having source, too, so it's not like keeping things closed will mean you're safe.

I'd tend to think you're better off just doing what makes sense on the license (open or closed) independent of security concerns, and then treat security as something to worry a lot about either way.

share|improve this answer
add comment

Open Source just means commonly available code/apps, that help you get started. Do not by default assume because it's open source it is good or bad code, you must always double check any code. For quality, commenting, documentation, how easy is it to upgrade/change.

Use a security checklist to identify all possible problems, and use that for whatever language/server/os you use, whether the code is open or closed source

share|improve this answer
    
I don't assume that, I have seen many and many open-source programs which weren't even remotely of good quality. What I asked was whether the decreased time for finding vulnerabilities is a greater advantage to the good or bad guys for OSS projects with a very small dev base –  Anto Feb 25 '11 at 16:32
    
Fair point. Just seen too many people just go blind, and that always encourages less effort into code quality. –  crosenblum Feb 25 '11 at 16:49
add comment

Security of code is ensured only by implementing a proven security algorithm correctly. This is in fact easier to verify with open source code, i.e. bugs get sorted out faster. I believe the widely used security algorithms like SHA et al. are published, still their availability doesn't make it any easier for crackers to crack them. It is the proven mathematical theory behind them which makes them secure.

As for small open source projects, I guess it doesn't make sense to publish code anyway when it is only half baked and not functional. From the security perspective, this means it should be thoroughly reviewed, preferably by as many security expert(s) as possible, and/or against a security checklist as @crosenblum suggests.

share|improve this answer
    
But what if the program is vulnerable to say a buffer overflow, finding that helps crackers –  Anto Feb 25 '11 at 16:33
    
@Anto, please see the update I added in the meantime. –  Péter Török Feb 25 '11 at 16:39
    
I see your edit, but some small vulnerability might still have slipped through, it happens very often in fact, just look at Windows ;) –  Anto Feb 25 '11 at 16:39
1  
It's not about publishing code which is half baked, it's about the fact we all make mistakes. In a closed source project those mistakes are there but they're better hidden. In a small open source project on the other hand they're there for everyone to see. If the project is small enough that there aren't going to be lots of developers finding and correcting those mistakes, the question is does the risk outweigh the potential benefits? –  Jon Hopkins Feb 25 '11 at 16:43
1  
@Jon, I understand. But maybe if the project is so small that not many developers are interested in it, this also lowers the risk of crackers being interested isn't it? –  Péter Török Feb 25 '11 at 17:13
add comment

You can think of Security as a state. A given piece of software has some level of security, but unless mathematically proven.. that level is unknown.

Publishing source code doesn't make your code any more or less secure, all it does is change the amount of information that is known about your software.

What publishing your code can do is make it easier for someone to exploit a vulnerability. That vulnerability is there, whether or not you publish the code. It's just as insecure. The question comes down to how much effort it takes to create and exploit.

As an example, 10+ years ago, it was very difficult to exploit buffer overflows. In fact, not much attention was given to them as a security issue because it was thought to be too difficult to exploit.

Since that time, people have figured out ways to easily exploit those vulnerabilities, and have even written software to do so automatically. Did those applications that were vulnerable to these exploits become less secure? No, they were always that insecure. All that changed was the knowledge of how to exploit it.

So, to summarize... Not publishing your code won't make you more secure, but it can make it a little more difficult for someone to exploit you. And, over time, that advantage will likely go away.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.