So with open source software more on my mind lately I was wondering - while I get the benefits of transparency and such, how safe is it? If the source code is available to all, isn’t it easier to breach for people (like the recent cookies hack)? If I’d have an open source password manager, would it be easier for people to get my passwords somehow than if I use something not open source? Do I just not understand how software works in general?

And what are other benefits that may be not so obvious to someone not so knowledgable about this?

Edit: thank you all for really insightful answers! Among other things I also learned just how much I don’t know :)

  • @[email protected]English
    15•1 year ago

    “Given enough eyeballs, all bugs are shallow.” - Linus Torvalds

    Open Source software is (caveat, qualifier) safer than proprietary software. (And I’ll get to the caveats and qualifiers later.)

    Software exploits are possible only because of mistakes, oversights, negligence, or mistaken assumptions on the part of the developer of user of the code. More eyes on the code help suss out those mistakes, oversights, negligence, and mistaken assumptions, creating a more secure (and bug-free) piece of software.

    Besides that, companies that make proprietary software have incentives to put evil things into said proprietary software that endanger you to enrich them. (For instance, phone apps collecting personal data about you only to sell to advertising companies.) Companies that contribute to open source software also have incentives to put evil things into open source software, but when everyone has access to view the source code, it’s a lot harder to get away with that. (Not to say it’s never happened that purposeful vulnerabilities have gotten into open source software, but it’s a lot easier to catch such vulnerabilities in open source software than proprietary software.)

    As others have said, the way algorithms related to security are designed, the security doesn’t depend on keeping the algorithm secret. (But rather, keeping a “key” – a bit of data generated by the algorithm – secret.)

    Now, caveats.

    I do believe there is some extent to which open source software is trusted to be safe even when the “chain of custody” is questionable. There are ways to ensure integrity, but there are repositories such as NPM that carry large amounts of open source software that is used by huge numbers of people on a regular basis that don’t utilize sufficient integrity checking techniques. As a result, there have been a few cases where malicious code has sneaked into NPM and then into codebases.

    There are also cases where governments have gotten malicious code into open source projects. (Though, I’d expect that’s more of a problem with proprietary software, not less.)