The right thing for the wrong reasons: FLOSS doesn't imply security

Comments

• X_Cli@lemmy.ml ⁨2⁩ ⁨years⁩ ago

  Good article. Thank you. You make some excellent points.

  I agree that source access is not sufficient to get a secure software and that the many-eyes argument is often wrong. However, I am convinced that transparency is a requirement for secure software. As a consequence, I disagree with some points and especially that one:

  It is certainly possible to notice a vulnerability in source code. Excluding low-hanging fruit, it’s just not the main way they’re found nowadays.

  In my experience as a developer, the vast majority of vulnerabilities are caught by linters, source code static analysis, source-wise fuzzers and peer reviews. What is caught by blackbox (dynamic, static, and negative) testing, and scanners is the remaining bugs/vulnerabilities that were not caught during the development process. When using a closed source software, you have no idea if the developers did use these tools (software and internal validation) and so yeah: you may get excellent results with the blackbox testing. But that may just be the sign that they did not accomplish their due diligence during the development phase.

  As an ex-pentester, I can assure you that having a blackbox security tools returning no findings is not a sign that the software is secure at all. Those may fail to spot a flawed logic leading to a disaster, for instance.

  And yeah, I agree that static analysis has its limits, and that running the damn code is necessarry because UT, integrations tests and load tests can only get you so far. That's why big companies also do blue/green deployments etc.

  But I believe this is not an argument for saying that a closed-source software may be secure if tested that way. Dynamic analysis is just one tool in the defense-in-depth strategy. It is a required one, but certainly not a sufficient one.

  Again, great article, but I believe that you may not be paranoid enough 😁 Which might be a good thing for you 😆 Working in security is bad for one's mental health 😂

  source

  • TheAnonymouseJoker@lemmy.ml ⁨2⁩ ⁨years⁩ ago

    As an ex-pentester, I can assure you that having a blackbox security tools returning no findings is not a sign that the software is secure at all. Those may fail to spot a flawed logic leading to a disaster, for instance.

    I am tired of people acting like blackbox analysis is same as whitebox analysis. It is like all these people never studied software testing and software engineering properly, and want to do some commentary just because internet fame and the rest of the internet audience is dumber.

    source
  • Seirdy@lemmy.ml ⁨2⁩ ⁨years⁩ ago

    Linters are a great thing I should've mentioned, esp. ones like ShellCheck. The phrase "low-hanging fruit" has been doing a lot of heavy lifting. I should mention that.

    I talked a lot about how to determine if software is insecure, but didn't spend enough time describing how to tell if software is secure. The latter typically involves understanding software architecture, which can be done by documenting it and having reverse engineers/pentesters verify those docs' claims.

    It's getting late (UTC-0800) so I think I'll edit the article tomorrow morning. Thanks for the feedback.

    source

    • Seirdy@lemmy.ml ⁨2⁩ ⁨years⁩ ago

      @X_Cli@lemmy.ml I updated the post to add a bit to one of the counter args, with a link to your comment. Here's a diff

      source

      • -> View More Comments
• TheAnonymouseJoker@lemmy.ml ⁨2⁩ ⁨years⁩ ago

  This serves as a springboard and a fallacy by omission that closed source is just as workable and trustable. I noticed this with r/PrivacyGuides and GrapheneOS Matrix room moderator Tommy_Tran/B0risGrishenko in this bullshit announcement post and comments regarding Rule 1 (no closed source software):

  https://teddit.net/r/PrivacyGuides/comments/siqc69/consideration_on_removing_rule_1/

  source
• federico3@lemmy.ml ⁨2⁩ ⁨years⁩ ago

  While the article provides good description of fuzzing, static analysis etc it focuses only on a set of threats and mitigations. There is much more:

  • "How security fixes work": Linux distributions do a ton of work to implement security fixes for stable releases without input from upstream developers. (And sometimes projects are completely abandoned by upstream developers). The ability for 3rd parties to produce security patches depends on having access to source code and it's absolutely crucial for high-security environments (e.g. banks, payment processors...). Some companies pay a lot of money for such service. This aspect is a bit understated under "Good counter-arguments".
  • Software supply chain attacks are a big issue. Open source mitigates the problem by creating transparency on what is used in a build. OS distributions solve the problem by doing reviews and freeze periods.
  • Some Linux distributions go even further and provide reproducible builds. This is not possible with closed source.
  • A transparent development process creates accountability and limits the ability for a malicious developer to insert backdoors/bugdoors. This is quite important.
  • Access to source code, commit history and bug trackers allows end users to quickly gain an understanding of the quality of the development process and the handling of security issues in the past.
  • ...it also enable authorship and trust between developers and users.
  • End users and 3rd parties can contribute security-related improvements e.g. sandboxing.
  • Companies can suddenly terminate or slow down development or security support. Community driven projects, and the ability to fork projects strongly mitigates such risk.

  I agree that claiming that something is secure just because it's FLOSS is an oversimplification. Security is a much bigger and broader process than just analyzing a binary or some sources.

  source
• blkpws@lemmy.ml ⁨2⁩ ⁨years⁩ ago

  Non FLOSS neither.

  source
• Jama@lemmy.ml ⁨2⁩ ⁨years⁩ ago

  Always happy to read your articles ❤️

  source
• Korba@lemmy.ml ⁨2⁩ ⁨years⁩ ago

  what FLOSS stands for ? i mean i know what's FOSS but this my first time hearing about FLOSS

  source

  • Jama@lemmy.ml ⁨2⁩ ⁨years⁩ ago

    Free Libre Open Source Software, since the word "free" is often misunderstood

    source

    • Korba@lemmy.ml ⁨2⁩ ⁨years⁩ ago

      thanks

      source
  • Seirdy@lemmy.ml ⁨2⁩ ⁨years⁩ ago

    You're not the first person to ask, which is why I updated the post to expand the acronym in the first sentence. Diff.

    source