Nobody on my post asking for controversial privacy topics asked this question, but I feel I should cover it anyways. People sometimes assume that software is safe simply because it is open source. That is a misconception, and I would like to cover that in this post.

What does “open source” mean?

When software is “open source,” it means that the developers have made the source code for the software public and allows anyone to help contribute to the code, or create their own versions of the software based on the source code. By contrast, proprietary software is software that has not made the source code visible to the public. There are similar terms to open source, such as “source-available,” “open-core,” and “libre,” which I won’t cover in this post. For the sake of simplicity, any source-available software will be called “open source,” since the specifics don’t quite matter for the majority of this post.

What are the benefits open source software?

Open source software provides many benefits over proprietary software:

Code auditing: Because anyone can inspect the code, anybody can look for vulnerabilities or invasive code to make sure that the software is safe. With proprietary software, the developers would have to hire a third party auditor to inspect the code. That means you have to trust the auditor, and you have no way to verify first-hand that the code is safe.

Bug reporting: While both open source and proprietary software have bug reporting systems, open source software tends to have more thorough and transparent bug reporting. Bug reports are generally on a public issue tracker such as GitHub, which can also help prevent duplicate bugs from being reported. Having these reports public also makes the next benefit easier:

Bug fixing: Anyone can contribute to open source software, which means the workload is distributed. Instead of a small team of developers being the only ones working on the software, anyone can look at the public issues and code their own fixes for the software.

Resurrecting projects: Both open source and proprietary software can one day stop being developed. Even big companies such as Spotify can retire software, which can lead to hardware devices becoming unusable or insecure. (The code for Car Thing has been reconstructed, by the way.) Open source projects that fall out of development can easily be forked and maintained by a new developer. It’s rare to see proprietary software handed off to a new owner.

Accountability: Open source projects hold the developers directly accountable for any vulnerabilities or invasive code, meaning the developer’s interests are aligned with its users and not malicious purposes. This also incentivizes creating code without paywalls, since anyone could release a version of the code with the paid features “unlocked”.

However, even with all these benefits, open source software isn’t perfect.

Why has proprietary software become so popular?

Since ads and paywalls can generally be removed from open source software, it doesn’t make it a very appealing choice to for-profit organizations. Generally, these organizations want to monetize and control their software, which means injecting ads, paywalls, and other invasive elements. This is done most easily if the software is proprietary.

It’s also rare to see open source software becoming so popular, because generally open source software receives its funding from donations and doesn’t have the budget to advertise the software. There are exceptions, such as OBS Studio or Blender, which have mostly become the most popular software in their categories.

Is open source software safe?

There is another downside to open source software that many people don’t talk about: it is much easier to exploit than proprietary software. Because all the source code is visible to the public, it makes it easy for malicious parties to craft vulnerabilities. Proprietary software is generally a stab in the dark until a vulnerability is found, since you can’t see exactly how it was coded.

Software being open source does mean that it becomes more likely to find and fix vulnerabilities, but being open source doesn’t automatically make software safe. Which device do you think would be more likely to obtain a virus, a device running (stock) Android or a device running iOS? You’re most likely more inclined to say the device running (stock) Android is more likely. Android at its core is open source. While correlation is not causation, and there are other factors at play, it’s much easier for someone to try to craft a malicious app for Android than for iOS because of its open nature.

Proprietary software isn’t automatically safe, either. It can be just as vulnerable as any other software. However, open source software has the potential to become much more secure than proprietary software, simply because more people can find and fix vulnerabilities. That’s probably why Apple open sourced their Private Cloud Compute code before launching a bounty program for it.

Anyone can code malicious open source software. It’s riskier, since it’s more likely to be noticed, but it’s still possible. Microsoft could open source Windows one day, and it wouldn’t make it any more safe until somebody identified and fixed the issues. Open source software doesn’t automatically make something private or secure, but it does provide integrity, because the developer is showing that they will be accountable for any malicious or vulnerable code, and that anyone is free to look through the code.

Final notes

I hope this gives you a better idea of what it actually means if something is open source. Even unsafe proprietary software can be run safely under the right conditions. If your threat model requires you to use as much open source software as possible, I made my own list of open source software called Open Source Everything that you can look through. I hope you enjoyed reading this!

- The 8232 Project

  • masterofn001
    link
    fedilink
    -3
    edit-2
    7 days ago

    My humble opinion

    Example

    Locked in google services. DNS so google sees the sites you visit, tracks what you click, where you go, who you talk to, what you like, what services you use, where you spend your money, etc.

    Freedom - no log encrypted DNS rolling your own DNS server/proxy, seeing the config, the source; no tracking, no surveillance and profiles stored that are gladly shared with whatever other company or gov dept that wants it. No blobs or beacons. The ability to see what is happening, to choose what to allow or disallow, to be able to edit, modify, clone, fork, etc based on your needs and wants.

    Not the Almighty profit margin.

    Freedom to choose poison or antidote.

    Another eg.

    Nothing to hide may be true for now.

    But what you believe need not be hidden, may, by some future government (or dictator), be deemed a crime, or worthy of retribution.

    Allowing an unaccountable, unverifiable, monolith or shady actor is asking for problems.

    The less data you share (or is unknowingly siphoned off) the less data you have to worry about being leaked /breached.

    Knowing what is happening, being able to audit, being able to verify, freedom to choose vs blind trust.

    If someone you don’t know knocks on your door, do you let them in and make themselves at home?

    • lime!
      link
      fedilink
      English
      27 days ago

      that’s not what free software is.

      • masterofn001
        link
        fedilink
        2
        edit-2
        7 days ago

        Maybe the people at the heart of Foss can make it more clear.

        Gnu.org

        The free software movement campaigns to win for the users of computing the freedom that comes from free software. Free software puts its users in control of their own computing. Nonfree software puts its users under the power of the software’s developer


        Free software means the users have the freedom to run, copy, distribute, study, change and improve the software.

        Free software is a matter of liberty, not price. To understand the concept, you should think of “free” as in “free speech,” not as in “free beer.”

        More precisely, free software means users of a program have the four essential freedoms:

        The freedom to run the program as you wish, for any purpose (freedom 0). The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). Access to the source code is a precondition for this. The freedom to redistribute copies so you can help others (freedom 2). The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this.

        • lime!
          link
          fedilink
          English
          17 days ago

          so, what your first post describes is open source. this quote from the fsf also describes open source, but the important stuff is in the nuances of the wording. open source allows you to share your changes. free software forces it through legal means. sorry for being so curt at first, i elaborated in my other reply.

          • masterofn001
            link
            fedilink
            1
            edit-2
            7 days ago

            Isn’t that clear where I mentioned ability to fork, clone, modify, etc?

            Besides that they asked why, not what.

            I gave my opinion and examples.

            • lime!
              link
              fedilink
              English
              17 days ago

              well the important distinction is who is bound, right? your examples are all true of open source as well. the main difference between the two concepts is that if i withhold my changes to gpl-licensed code from you, you can sue me for breaching the license. if the software is mit, i am in my full right to deny you access. that’s not what i got from your wording.

              • masterofn001
                link
                fedilink
                1
                edit-2
                6 days ago

                You said what I posted was not Foss.

                It came from the very essence of Foss.

                It gave the very definition of Foss.

                From the people who started Foss movement .

                On the site run by the people who continue to promote and advocate for Foss.

                And explains the distinction between Foss and open source.

                What about that is unclear?

                Post something else about open souce, please.

                Tell me again how that is not what Foss is.

                Please, guide me.

                (What you cleverly replied with is in the link I posted ffs)

                  • masterofn001
                    link
                    fedilink
                    06 days ago

                    Really? Lol. You replied with a link from the same site which is linked within the page I posted. Look at the screenshot.

                    Jfc, I’m done with you.