0 Members and 1 Guest are viewing this topic.
The security of knowing it's open sourceWhat, then, about the security of open source software? Open source software, by definition, is any program or application that is freely distributed, non-platform specific -- and in which the programming code is open and visible. All else being equal, isn't a closed program more secure than an open one?"Not just no, but h--- no," says open source advocate and author of The New Hacker's Dictionary and "The Cathedral and the Bazaar", Eric S. Raymond. "Closed source leads not to true security but to a false sense of security," says Raymond. "You don't know what's in there, you can't verify it, you can't check the assumptions or honesty of the people who wrote it."In cryptography circles, there is a saying: The security of an algorithm should not depend on its secrecy. This maxim can be especially well-applied to open source software. "The apparent paradox that openness about your methods leads to better security is not unique to computer software -- military and diplomatic cryptographers have known for a century that it is folly to depend on the secrecy of your encoding method rather than the secrecy of your keys," says Raymond. According to Raymond and fellow open source supporters, open source is the only real option for secure operating systems. For one thing, closed source applications and operating systems can't be examined and verified for secure coding. A revelation of previously secret code almost always leads to the discovery of additional flaws and security holes. In addition, closed proprietary code makes it difficult to distribute trustworthy fixes when a hole or mistake is revealed. Just take the April 2000 event that had webmasters and systems administrators shaking in their shoes. After four years it was discovered that Microsoft programmers had inserted a back door in their popular FrontPage Web server software. It was the very fact that the software code was "concealed" in opaque binary form that kept this security breach unknown to the public for so long. Since open source software guarantees the "right to read, redistribute, modify, and use the software freely," a secret back door would be highly unlikely to escape detection. Most experts believe that the odds of a such a back door slipping in are nil. After all, the logic goes, who would risk his or her reputation by putting a back door in source that is openly available for others to discover? "Anybody who trusts their security to closed-source software is begging to have a back door slipped on to their system," says Raymond, who is also president of the Open Source Initiative. "Apache has never had an exploit like this, and never will. Nor will Linux, or the BIND library, or Perl, or any of the other open source core software available."
