Nobody on my post asking for controversial privacy topics asked this question, but I feel I should cover it anyways. People sometimes assume that software is safe simply because it is open source. That is a misconception, and I would like to cover that in this post.
What does “open source” mean?
When software is “open source,” it means that the developers have made the source code for the software public and allows anyone to help contribute to the code, or create their own versions of the software based on the source code. By contrast, proprietary software is software that has not made the source code visible to the public. There are similar terms to open source, such as “source-available,” “open-core,” and “libre,” which I won’t cover in this post. For the sake of simplicity, any source-available software will be called “open source,” since the specifics don’t quite matter for the majority of this post.
What are the benefits open source software?
Open source software provides many benefits over proprietary software:
Code auditing: Because anyone can inspect the code, anybody can look for vulnerabilities or invasive code to make sure that the software is safe. With proprietary software, the developers would have to hire a third party auditor to inspect the code. That means you have to trust the auditor, and you have no way to verify first-hand that the code is safe.
Bug reporting: While both open source and proprietary software have bug reporting systems, open source software tends to have more thorough and transparent bug reporting. Bug reports are generally on a public issue tracker such as GitHub, which can also help prevent duplicate bugs from being reported. Having these reports public also makes the next benefit easier:
Bug fixing: Anyone can contribute to open source software, which means the workload is distributed. Instead of a small team of developers being the only ones working on the software, anyone can look at the public issues and code their own fixes for the software.
Resurrecting projects: Both open source and proprietary software can one day stop being developed. Even big companies such as Spotify can retire software, which can lead to hardware devices becoming unusable or insecure. (The code for Car Thing has been reconstructed, by the way.) Open source projects that fall out of development can easily be forked and maintained by a new developer. It’s rare to see proprietary software handed off to a new owner.
Accountability: Open source projects hold the developers directly accountable for any vulnerabilities or invasive code, meaning the developer’s interests are aligned with its users and not malicious purposes. This also incentivizes creating code without paywalls, since anyone could release a version of the code with the paid features “unlocked”.
However, even with all these benefits, open source software isn’t perfect.
Why has proprietary software become so popular?
Since ads and paywalls can generally be removed from open source software, it doesn’t make it a very appealing choice to for-profit organizations. Generally, these organizations want to monetize and control their software, which means injecting ads, paywalls, and other invasive elements. This is done most easily if the software is proprietary.
It’s also rare to see open source software becoming so popular, because generally open source software receives its funding from donations and doesn’t have the budget to advertise the software. There are exceptions, such as OBS Studio or Blender, which have mostly become the most popular software in their categories.
Is open source software safe?
There is another downside to open source software that many people don’t talk about: it is much easier to exploit than proprietary software. Because all the source code is visible to the public, it makes it easy for malicious parties to craft vulnerabilities. Proprietary software is generally a stab in the dark until a vulnerability is found, since you can’t see exactly how it was coded.
Software being open source does mean that it becomes more likely to find and fix vulnerabilities, but being open source doesn’t automatically make software safe. Which device do you think would be more likely to obtain a virus, a device running (stock) Android or a device running iOS? You’re most likely more inclined to say the device running (stock) Android is more likely. Android at its core is open source. While correlation is not causation, and there are other factors at play, it’s much easier for someone to try to craft a malicious app for Android than for iOS because of its open nature.
Proprietary software isn’t automatically safe, either. It can be just as vulnerable as any other software. However, open source software has the potential to become much more secure than proprietary software, simply because more people can find and fix vulnerabilities. That’s probably why Apple open sourced their Private Cloud Compute code before launching a bounty program for it.
Anyone can code malicious open source software. It’s riskier, since it’s more likely to be noticed, but it’s still possible. Microsoft could open source Windows one day, and it wouldn’t make it any more safe until somebody identified and fixed the issues. Open source software doesn’t automatically make something private or secure, but it does provide integrity, because the developer is showing that they will be accountable for any malicious or vulnerable code, and that anyone is free to look through the code.
Final notes
I hope this gives you a better idea of what it actually means if something is open source. Even unsafe proprietary software can be run safely under the right conditions. If your threat model requires you to use as much open source software as possible, I made my own list of open source software called Open Source Everything that you can look through. I hope you enjoyed reading this!
- The 8232 Project
I always recieve negative votes, posting that it is absoluye wrong to think that OpenSource is synonym of privacy and security. There a lot of people wich confuse it. OpenSource is very important in a free internet and for developing new software, but for the user is way more important the intentions of the dev, the ethics and PP of the product. That it has an active community and devs, absolte risky to use outdated and abandoned FOSS.
OpenSource is preferable whenever possible, but as in anything else, fanaticism is harmful when a good proprietary soft offers a better solution
Yes, OpenSource permits to see the Source, but this is only interesting for devs, but not for an user normal whose programming skills no reach even to Hello World level, less in complex app with thousends of lines and extern references.
The most important for a normal user, read well TOS and PP, because they are legal documents and mandatory for both parties and that they are up to date, regardless of whether it is (F)OSS or Proprietary.
ToS never work. Libre software does.
ToS always work, it is a legally binding document, a contract which, if not respected, can be reported in court. These can be just as abusive in FOSS, even more so, than in FOSS. In terms of security and privacy, FOSS is no guarantee, it depends solely on the dev and his ethics regarding the user, not on anything else. Proprietary products from small companies or private developers may have better conditions and privacy than others that are OpenSource.
Example
https://www.ssuitesoft.com/privacypolicy.htm
On OpenSource it depends on the license it has ( a lot diferent ones) and the one of third party API’s they use. https://opensource.org/licenses
Get a fork or go to court, hard choice. /s
Anti-libre software guarantees we not control it.
You can and it is also done as in any fraudulent contract. This is independent if it is FOSS or not. Do you trust FOSS made by Google or M$ (a huge part of the catalogue) respect privacy? They aren’t private, but they especific in their Tos exactly what they do with your data, not their fault if you don’t read it. Same with FOSS which use APIs from these data hogs (also a lot). FOSS is more secure and private as proprietary is often correct, but you have to take it with a grain of salt, it’s not a synonym and also often wrong.
Trust is a scam. Libre software puts us in control.
I think an engineering perspective is useful: we want to solve problems, but different people have different problems, and each person cares about each of their problems to a different extent. If one person thinks their problem is that a relevant amount of their income depends on proprietary software, then the solution is substituting free software to replace proprietary software they depend upon. If another person doesn’t depend on proprietary software for their income, but thinks it’s a problem that their thermostat runs proprietary software, then the solution is still to substitute free software to replace proprietary software (or to replace the thermostat entirely). However, if someone wants to increase their income tenfold and using proprietary software will accomplish that (and using free software will not), then the solution is to use proprietary software.
It’s probably better to help people learn and understand how to use free software than to encourage them to use proprietary software, since free software is probably easier to maintain as someone’s situation changes, but there might be some situations where the best solution for someone involves using proprietary software.