Hello everyone, and sorry for my bad english. So lets start with a usual topic about Open Source, and that is “everybody can see the code of a OpenSource programm to see if it is malware”. And my question is: how people that cannot read a single line of a programming language manage to do that? I mean, they can just trust in everybody that say which software is secure or not. If the software is a virus or malware, or poses security risks, people won’t know that unless they’re programmers, and so the same thing happens to these kinds of people as used to happen with proprietary software: they have to rely on those who “know” to find out if something. I find this quite problematic because, as I said, anyone who doesn’t understand the code wouldn’t be able to verify whether such a program is secure or not, and would have to place their trust in third parties. That aside, it’s also worth noting that most software has hundreds, if not thousands, of lines of code, which would make it take longer to parse all that code—and even more tedious than reading a typical “EULA.” Can you think of any way to fix this?
I guess the main thing is that it’s not just one person saying “I looked at the code and didn’t find any malware” - depending on the size of the project it could be millions of people saying that. Also, changes to programs generally have to be approved by the maintainer, so it can be pretty difficult to slip malicious changes in unnoticed.
The arrangement isn’t perfect, but keep in mind that closed-source software also requires trust on the part of the users - It’s just that in that case nobody can vet the code.
yeah i use floss software for that too! but maybe somethere is a malicious code hidden by a very good programmer (or a group of these) in critical software…
For a good case study: https://en.wikipedia.org/wiki/XZ_Utils_backdoor
If this had been closed source, the attacker would not have been able to use the technique to commit the changes in the first place.
However, if they HAD snuck the changes in, nobody would have caught them, and only the developer would have been able to identify something was wrong before full deployment.
But we should all assume that while the xz trojan never made it out, others likely have, both in open and closed source.
No need for speculation we have such a real equivalent.
The SolarWinds Cyberattack Explained: Hack, Victims, and Key Facts
Both are supply chain attacks and the proprietary world let it go farther. They both highlight vulnerabilities. There are going to be small and important FOSS projects that have burnt out maintainers, and possibly few eyes on. In principal someone should be getting paid to keep things safe in closed land, but security is a cost center and an easy cut for the MBAs in charge of things.
It is always possible. The point is that while open source software doesn’t solve this problem, it gives you a non-zero chance of someone detecting it and raising the alarm. Non-zero may be large or may be small, it is probably never 100% chance, but large non-zero is very good, and even small non-zero it is much better than the 0% detection chance that closed source offers.
Sorry but i dont understand what do you mean with “non-zero”