this post was submitted on 04 Feb 2022
15 points (85.7% liked)

Security

5005 readers
2 users here now

Confidentiality Integrity Availability

founded 4 years ago
MODERATORS
gary_host_laptop@lemmy.ml
15
The right thing for the wrong reasons: FLOSS doesn't imply security (seirdy.one)
submitted 2 years ago by Seirdy@lemmy.ml to c/security@lemmy.ml
18 comments fedilink hide all child comments
 

I find people who agree with me for the wrong reasons to be more problematic than people who simply disagree with me. After writing a lot about why free software is important, I needed to clarify that there are good and bad reasons for supporting it.

You can audit the security of proprietary software quite thoroughly; source code isn't a necessary or sufficient precondition for a particular software implementation to be considered secure.

you are viewing a single comment's thread
view the rest of the comments
[–] Seirdy@lemmy.ml 3 points 2 years ago* (last edited 2 years ago) (1 children)

And… you cannot study the closed source software.

Sure you can. I went over several example.

I freely admit that this leaves you dependent on a vendor for fixes, and that certain vendors like oracle can be horrible to work with (seriously check out that link, it's hilarious). My previous articles on FLOSS being an important mitigation against user domestication are relevant here.

Can you, with complete certainty, confidently assert the closed source software is more secure? How is it secure? Is it also a piece of software not invading your privacy? Security is not the origin of privacy, and security is not merely regarding its own resilience as standalone code to resist break-in attempts. This whole thing is not just a simple two way relation, but more like a magnetic field generated by a magnet itself. I am sure you understand that.

I can't confidently assert anything with complete certainty regardless of source model, and you shouldn't trust anyone who says they can.

I can somewhat confidently say that, for instance, Google Chrome (Google's proprietary browser based on the open-source Chromium) is more secure than most Webkit2GTK browsers. The vast majority of Webkit2gtk-based browsers don't even fully enable enable sandboxing (webkit_web_context_set_sandbox_enabled).

I can even more confidently say that Google Chrome is more secure than Pale Moon.

To determine if a piece of software invades privacy, see if it phones home. Use something like Wireshark to inspect what it sends. Web browsers make it easy to save key logs to decrypt packets. Don't stop there; there are other techniques I mentioned to work out the edge cases.

Certain forms of security are necessary for certain levels of privacy. Other forms of security are less relevant for certain levels of privacy, depending on your threat model. There's a bit of a venn-diagram effect going on here.

FLOSS being less secure when analysed with whitebox methods assures where it stands on security.

Sure, but don't stop at whitebox methods. You should use black-box methods too. I outlined why in the article and used a Linux vuln as a prototypical example.

This will always be untrue for closed source software, therefore the assertation that closed source software is more secure, is itself uncertain.

You're making a lot of blanket, absolute statements. Closed-source software can be analyzed, and I described how to do it. This is more true for closed-source software that documents its architecture; such documentation can then be tested.

Moreover, FOSS devs are idealistic and generally have good moral inclinations towards the community and in the wild there are hardly observations that tell FOSS devs have been out there maliciously sitting with honeypots and mousetraps. This has long been untrue for closed source devs, where only a handful examples exist where closed source software devs have been against end user exploitation. (Some common examples in Android I see are Rikka Apps (AppOps), Glasswire, MiXplorer, Wavelet, many XDA apps, Bouncer, Nova Launcher, SD Maid, emulators vetted at r/emulation.)

I am in full agreement with this paragraph. There is a mind-numbing amount of proprietary shitware out there. That's why, even if I was only interested in security, I wouldn't consider running proprietary software that hasn't been researched.