Comment by b1daly | Hacker News Reader

Comment by b1daly | Hacker News Reader

Parent Full thread

This argument about code inspection does not make sense to me. The number of people who are going to even have the ability to inspect the code of the applications they use is infitesimal and of that small number the people who have time and inclination to do so is microscopic. Given that applications are complex, written by groups of programmers over extended time what is the chance of meaningful code review by an individual? It could take years for a single application.

I don’t know if Free software makes software less secure but I don’t see how it makes it more secure? Especially given that security might not be a high priority for the authors.

I’m not a programmer so it’s hard for me to understand the arguments, but from what I gather is that any popular software could be a vector for threats and that users themselves remain the biggest vector.

The author suggests greater use of code signing could help. It also seems to me that progress towards computer security needs to be the province of large, well resourced organizations.

Our own (US) government seems to not be prioritizing this correctly, preferring to maintain their own exploits at the cost of defense. This is a political problem. It is of a piece with the historical arrogance of the US security-military apparatus that is being badly outplayed, mistaking pure military superiority as the most important type of security.

> This argument about code inspection does not make sense to me.

It's about doing things in public. Not many people fit in a public courthouse, but court reporters can write down what happened and broadcast it to the public. Compare that to the FISA court.

> I don’t know if Free software makes software less secure but I don’t see how it makes it more secure

Without the source code, one can't even have an opinion on whether it's secure or not. I simply have to take the vendor's word for it.

> The author suggests greater use of code signing could help.

This is probably part of the solution. But who is signing what, and why? If Microsoft gives me a signed binary, all that tells me is that Microsoft vouches for their own binary.

It also means that if I modify it, it's no longer signed. And if the system is configured so that only binaries signed by Microosoft (or by a signer that Microsoft trusts) can run, then the modified software won't run.

Code signing is A Good Thing, in principle. But it's easily hijacked by bad actors to further monopolistic goals.

It also gives a false sense of security. There have been supply chain attacks in the past that succeeded because the attackers got their hands on a cert and signed malicious code.

Personally, I see the arguments about software security to be a bit distracting. In my experience, users of free/open source software don't generally inspect the code (there are definitely exceptions of course.)

What it can provide is things like the ability to customise, to avoid vendor lock-in, and things like that. Most users aren't developers, but those that aren't can still get benefits from those who are. For example, if I provide software X to someone, and they use me for support (set up, config, development, whatever), they can choose to move to someone else to provide their support if they want. If I start charging too much, or provide bad service, or just want to get out of the industry and go into woodworking, I as a developer am replaceable. If I don't want to do something, they can get someone else to do it.

I used to work on a free software project where this was a big draw for the users. They usually didn't have their own expertise to do the support, but there was a big pool of people and companies they could choose from to take over. And, some did have someone internal to do it, which meant they could change things to suit their own needs as they saw fit. We occasionally got patches and QA reviews from our customers, through the public bugtracker for the project.

It does get more complicated with SaaS stuff, but that is solvable also (for example, requiring that data and code is provided.)

This is of course only one aspect, and is a bit more commercially oriented (because that's a lot of my experience), but I just think that the security aspects, while valid, often distract from some of the core reasons behind the free and open source models.

There is a reason why companies often buy licenses to third-party software that include source code. It's not because their programmers have a burning desire to slog through other people's code. It's because they want the OPTION to do it, if the sky is falling. (I've fixed crashes in other people's code because we couldn't afford to wait three months for a patch.)

Reply on news.ycombinator.com