federico3
@federico3@lemmy.ml
This is a remote user, information on this page may be incomplete. View at Source ↗
- Comment on The right thing for the wrong reasons: FLOSS doesn't imply security 2 years ago:
While the article provides good description of fuzzing, static analysis etc it focuses only on a set of threats and mitigations. There is much more:
- "How security fixes work": Linux distributions do a ton of work to implement security fixes for stable releases without input from upstream developers. (And sometimes projects are completely abandoned by upstream developers). The ability for 3rd parties to produce security patches depends on having access to source code and it's absolutely crucial for high-security environments (e.g. banks, payment processors...). Some companies pay a lot of money for such service. This aspect is a bit understated under "Good counter-arguments".
- Software supply chain attacks are a big issue. Open source mitigates the problem by creating transparency on what is used in a build. OS distributions solve the problem by doing reviews and freeze periods.
- Some Linux distributions go even further and provide reproducible builds. This is not possible with closed source.
- A transparent development process creates accountability and limits the ability for a malicious developer to insert backdoors/bugdoors. This is quite important.
- Access to source code, commit history and bug trackers allows end users to quickly gain an understanding of the quality of the development process and the handling of security issues in the past.
- ...it also enable authorship and trust between developers and users.
- End users and 3rd parties can contribute security-related improvements e.g. sandboxing.
- Companies can suddenly terminate or slow down development or security support. Community driven projects, and the ability to fork projects strongly mitigates such risk.
I agree that claiming that something is secure just because it's FLOSS is an oversimplification. Security is a much bigger and broader process than just analyzing a binary or some sources.