I support free and open source software (FOSS) like VLC, Qbittorrent, LibreOffice, Gimp…

But why do people say that it’s as secure or more secure than closed source software?

From what I understand, closed source software don’t disclose their code.

If you want to see the source code of Photoshop, you actually need to work for Adobe. Otherwise, you need to be some kind of freaking retro-engineering expert.

But open source has their code available to the entire world on websites like Github or Gitlab.

Isn’t that actually also helping hackers?

  • Capricorn_Geriatric@lemmy.world
    link
    fedilink
    arrow-up
    12
    ·
    4 days ago

    It’s not “assumed” to be secure.

    It’s out there and visible for all to see. Hopefully, someone knowledgeable has taken it upon themselves to take a look at the software and assess its security.

    The largest projects, like all the ones you named are popular enough that there’s no shortage of people taking a peek.

    Of course, that doesn’t mean actual security audits are uncalled for. They’re necessary. And they’re being done. And with the code out there, any credible auditer will audit all the code, since it’s availiable.

    Compare that to closed-source.

    With closed-source, the code isn’t out there. Anyone can poke around, sure, but that’s like poking a black box with a stick. It’s not out there. You can infer some things, there are some source code leaks, but it isn’t all visible. This is also much less efficient and requires much more work for a fraction of the results.

    The same goes with actual audits. Usually not all source code is given over to the auditers, so some voulnerabilities remain uninspected and dormant.

    Sure, not having the code out there is “security”. If someone doesn’t see the code, it’s much harder to find the weakness. Harder, but not impossible.

    There’s a lot of open-source software. There’s also a lot closed-source software, much more than the open-source kind, in fact.

    What open-sourcing does is increase the number of eyes looking at the code. And each of those eyes could find a weakness. It might be a bad actor, but it’s most likely a good one.

    With open source, any changes are publically visible, and any attempt to sneak a backdoor in has a much higher chance of being seen, again due to the large number of eyes which can see it.

    Closed-source code also gives lazy programmers an easy way out of fixing or not introducing vulnerabilities - “no one will know”. With open source, again, there’s a lot of eyes on the code - not just the one programmer team making it and the other auditing it, as is often the case.

    That’s why open source software is safer in general. Percisely because it’s availiable, attacking it might seem easier. But for every bad actor looking at the code, there’s at least ten people who aren’t. And if they spotted a voulnerability, they’d report it.

    Security with open source is almost always proactive, while with closed source it’s hit-or-miss. Many voulnerabilities have to cause an issue before being fixed.

  • Tattorack@lemmy.world
    link
    fedilink
    arrow-up
    7
    ·
    edit-2
    4 days ago

    Closed source you have to take the word of the owner, who’s out to get your money.

    Open source you have to take the word of a whole community, or you could just go and look yourself.

    In the end there is also a personal responsibility; there is no promise or guarantee in the whole world that’ll prevent you from being stupid with what you download or install.

  • Captain Aggravated@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    33
    ·
    6 days ago

    You live in some Detroit-like hellscape where everyone everywhere 24/7 wants to kill and eat you and your family. You go shopping for a deadbolt for your front door, and encounter two locksmiths:

    Locksmith #1 says “I have invented my own kind of lock. I haven’t told anyone how it works, the lock picking community doesn’t know shit about this lock. It is a carefully guarded secret, only I am allowed to know the secret recipe of how this lock works.”

    Locksmith #2 says "Okay so the best lock we’ve got was designed in the 1980’s, the design is well known, the blueprints are publicly available, the locksport and various bad guy communities have had these locks for decades, and the few attacks that they made work were fixed by the manufacturer so they don’t work anymore. Nobody has demonstrated a successful attack on the current revision of this lock in the last 16 years.

    Which lock are you going to buy?

  • JackbyDev@programming.dev
    link
    fedilink
    English
    arrow-up
    7
    ·
    4 days ago

    A better question may be, why do you assume closed source software is secure? If nobody can see the code, how can we verify it is safe? Don’t they have to be some sort of reverse engineering expert to prove it’s safe?

  • MTK@lemmy.world
    link
    fedilink
    arrow-up
    7
    ·
    edit-2
    4 days ago

    What is more secure, a secret knock or an actual lock?

    The lock is something that everyone can lookup, research and learn about. Sure, it means that people can learn to lockpick, but a well designed lock can stumble even the best lockpicks.

    A secret knock is not secure at all, it sounds secure but in reality it is just obscure, and if anyone learns it or it’s simple enough to guess, it becomes meaningless. Even a bad lock will show signs that it was picked.

    So that’s an analogy, here is the actual explanation:

    Let’s assume we have a closed source product named C and an open source product named O and that the security and quality of the code is the same. Both products are compiled and have been in active development for years. Both products have a total of 2 different people going over the code change of each new version, one person writes it, another reviews the code and approves it. After years of development you probably have about 10 people in total who have actually seen the code, anything that they missed will go unnoticed, any corners that they decided to cut will be approved, any bad decisions that they made will not be criticized. Here is where C and O differ: C will forever stay in this situation, only getting feedback rarely from researchers who found vulnerabilities and decided to report them. O will get small parts of it reviewed by hundreds of developers, and maybe even fully reviewed by a few people. Any corners that O cuts will be criticized, any backdoor that O tries to implemented will be clear to see. C on the other hand has one small advantage, bad actors will have a harder time finding vulnerabilities in it because it is compiled and they would have to reverse engineer it, while O is clear for the bad actors to read. But, bad actors are a very small minority, any vulnerability in O is far more likely to be caught by good actors, while C is very unlikely to be reversed by any good actors at all and so if it has any vulnerabilities, they are far more likely to be found by bad actors first.

    And it is important to note the conflict of interests that often exists in closed source software. A company that sells a product for profit and believes that its code is hidden, has very little interest in security and almost no interest in end user security, but if the code is not hidden, the company has an interest to produce reasonably secure code to maintain a reputation.

    So almost always, open source leads to safer code for all parties involved.

  • Nibodhika@lemmy.world
    link
    fedilink
    arrow-up
    5
    ·
    5 days ago

    It’s simple really, you have two people selling you a padlock, one has a challenge for anyone who can break it to earn bragging rights, the other comes in a black cardboard box that you can’t remove. Would you lock your stuff with something that tells people “I’m secure, prove me wrong” or with what can be anything from a padlock that will close and never let you open it again to an empty cardboard box that anyone can break with their hands?

    It’s the same thing with software, you need to realize that for every black hat (what people refer to as hackers) out there there are dozens of white hats (security experts that earn their living by finding and reporting security flaws in software). So for open source software that means that the chance of a security issue being found by a white hat is much higher, and if it’s found by a black hat you have millions of people trying to figure out how he did it, where’s the vulnerability and how to fix it. Whereas for closed software you never know if it has been breached, and white hats can’t investigate and find a solution, so you depend on the security team from the company (which is most likely a small team of maybe 5 people of we’re being generous) to figure it out and make a fix.

  • Scott@sh.itjust.works
    link
    fedilink
    arrow-up
    18
    ·
    6 days ago

    With open source code you get more eyes on it. Issues get fixed quicker.

    With closed source, such as Photoshop, only Adobe can see the code. Maybe there are issues there that could be fixed. Most large companies have a financial interest in having “good enough” security.

  • assembly@lemmy.world
    link
    fedilink
    arrow-up
    19
    ·
    6 days ago

    One thing to keep in mind is that NO CODE is believed to be secure…regardless of open source or closed source. The difference is that a lot of folk can audit open source whereas we all have to take the word of private companies who are constantly reducing headcount and replacing devs with AI when it comes to closed source.

  • Canaconda@lemmy.ca
    link
    fedilink
    arrow-up
    19
    arrow-down
    1
    ·
    edit-2
    6 days ago

    Zero day exploits, aka vulnerabilities that aren’t publicly known, offer hackers the ability to essentially rob people blind.

    Open source code means you have the entire globe of developers collaborating to detect and repair those vulnerabilities. So while it’s not inherently more secure, it is in practice.

    Exploiting four zero-day flaws in the systems,[8] Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software. Stuxnet reportedly compromised Iranian PLCs, collecting information on industrial systems and causing the fast-spinning centrifuges to tear themselves apart.[3] Stuxnet’s design and architecture are not domain-specific and it could be tailored as a platform for attacking modern SCADA and PLC systems (e.g., in factory assembly lines or power plants), most of which are in Europe, Japan and the United States.[9] Stuxnet reportedly destroyed almost one-fifth of Iran’s nuclear centrifuges.[10] Targeting industrial control systems, the worm infected over 200,000 computers and caused 1,000 machines to physically degrade.

    Stuxnet has three modules: a worm that executes all routines related to the main payload of the attack, a link file that automatically executes the propagated copies of the worm and a rootkit component responsible for hiding all malicious files and processes to prevent detection of Stuxnet.

    Wikipedia - Stuxnet Worm

    • Frezik@lemmy.blahaj.zone
      link
      fedilink
      arrow-up
      2
      ·
      6 days ago

      The whole Stuxnet story is fascinating. A virus designed to spread to the whole Internet, and then activate inside a specific Iranian facility. Convinced me that we already live in a cyberpunk world.

  • ssillyssadass@lemmy.world
    link
    fedilink
    arrow-up
    3
    ·
    edit-2
    4 days ago

    Open source has more eyes looking over the code, more chances to catch some would-be loophole or exploit. Closed source stuff may have a team of qualified engineers, but there’s only so many on that team, and anyone can get tunnel vision.

  • Ephera@lemmy.ml
    link
    fedilink
    English
    arrow-up
    12
    ·
    6 days ago

    Somewhat of a different take from what I’ve seen from the other comments. In my opinion, the main reason is this:
    XKCD comic showing other engineers proud of the realibility of their products and then software engineers freaking out about the concept of computerized voting, because they absolute do not trust their entire field.

    Companies have basically two reasons to do safety/security: Brand image and legal regulations.
    And they have a reason to not do safety/security: Cost pressure.

    Now imagine a field where there’s hardly any regulations and you don’t really stand out when you do security badly. Then the cost pressure means you just won’t do much security.

    That’s the software engineering field.

    Now compare that to open-source. I’d argue a solid chunk of its good reputation is from hobby projects, where people have no cost pressure and can therefore take all the time to do security justice.
    In particular, you need to remember that most security vulnerabilities are just regular bugs that happen to be exploitable. I have significantly fewer bugs in my hobby projects than in the commercial projects I work on, because there’s no pressure to meet deadlines.

    And frankly, the brand image applies even to open-source. I will write shitty code, if you pay me to. But if my name is published along with it, you need to pay me significantly more. So, even if it is a commercial project that happens to be published under an open-source license, I will not accept as many compromises to meet deadlines.

  • DeathByBigSad@sh.itjust.works
    link
    fedilink
    arrow-up
    9
    ·
    6 days ago

    Because “some nerd out there probably would have found any exploits for the X years its been released” is the general assumption about open source software.

  • Zangoose@lemmy.world
    link
    fedilink
    arrow-up
    1
    ·
    4 days ago

    You don’t need to have access to the source code (reverse engineered or not) to find security holes. However, people need to audit the source code to prove it’s secure.

    So, closed source software is maybe slightly harder to find flaws in for a malicious actor, but significantly harder for users to audit (because you have to rely on the word of the company publishing the software, or a 3rd party security auditing company, or reverse engineer the code yourself)

    Additionally, it’s harder for malicious actors to hide the existence of vulnerabilities they find. They can’t just not tell anyone what they find because the code is all public anyway. If people are looking at it frequently enough (i.e. if the project is still active), someone else will probably notice it as well.

  • emb@lemmy.world
    link
    fedilink
    arrow-up
    11
    ·
    edit-2
    6 days ago

    The idea you’re getting at is ‘security by obscurity’, which in general is not well regarded. Having secret code does not imply you have secure code.

    But I think you’re right on a broader level, that people get too comfortable assuming that something is open source, therefore it’s safe.

    In theory you can go look at the code for the foss you use. In practice, most of us assume someone has, and we just click download or tell the package manager to install. The old adage is “With enough eyes, all bugs are shallow”. And I think that probably holds, but the problem is many of the eyes aren’t looking at anything. Having the right to view the source code doesn’t imply enough people are, or even meaningfully can. (And I’m as guilty of being lax and incapable as anyone, not looking down my nose here.)

    In practice, when security flaws are found in oss, word travels pretty fast. But I’m sure more are out there than we realize.

    • towerful@programming.dev
      link
      fedilink
      arrow-up
      6
      ·
      edit-2
      6 days ago

      It’s also easier to share vulnerability fixes between different projects.

      “Y” was using a similar memory management as “T”, T was hacked due to whatever, people that use Y and T report to Y that a similar vulnerability might be exploitable

      Edit:
      In closed source, this might happen if both projects are under the same company.
      But users will never have the ability to tell Y that T was hacked in a way that might affect Y

  • CrazyLikeGollum@lemmy.world
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    1
    ·
    6 days ago

    It’s not “assumed to be secure.” The source code being publicly available means you (or anyone else) can audit that code for vulnerabilities. The publicly available issue tracking and change tracking means you can look through bug reports and see if anyone else has found vulnerabilities and you can, through the change history and the bug report history, see how the devs responded to issues in the past, how they fixed it, and whether or not they take security seriously.

    Open source software is not assumed to be more secure, but it’s security (or lack thereof) is much easier to verify, you don’t have to take the word of the dev as to whether or not it is secure, and (especially for the more popular projects like the ones you listed) you have thousands of people with different backgrounds and varying specialties within programming, with no affiliation with and no reason to trust the project doing independent audits of the code.