[1] https://en.wikipedia.org/wiki/Proprietary_software
Edit: wording.
What was the last time you inspected any command or application you executed on your computer?
How would you spot malicious code? Are you a security expert who has knowledge of all of the programming languages that have been used to write the apps you are running?
You have absolutely unrealistic view on this subject. Btw. Apple and many companies have a trivial way of spotting malicious application by simple checksumming the executables.
> What was the last time you inspected any command or application you executed on your computer?
A few months ago, and didn't run new code from untrusted sources since.
> How would you spot malicious code? Are you a security expert who has knowledge of all of the programming languages that have been used to write the apps you are running?
So far I haven't run into languages I can't read. Spotting malicious code could indeed be tricky, a subtle but critical vulnerability would easily evade quick skimming, just as malware is still possible even when it comes from a somewhat trusted source. But I'm more certain that a program does what it says it does after skimming its code.
> Apple and many companies have a trivial way of spotting malicious application by simple checksumming the executables.
That's how basic antiviruses work, not specific to Apple. They have to first add that checksum into a database, which isn't viable when we're talking about a small hardware manufacturer shipping their custom software to dozens of clients.
https://linux.slashdot.org/story/22/01/25/2259214/major-linu...
And you cannot do that on open source either. Both cases require a chain of trust, and empirically, neither is significantly more secure.
Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.
If anything, having source also makes it easier to auto scan for flaws at the source level and find holes.
I know from CVEs that OS projects has a significant number of high profile long standing holes in it.
Case in point, the famous Borland InterBase backdoor that went unnoticed for about 7 years and 3 versions of the software but was discovered in 8 months by one developer after Borland released InterBase as Open Source.
https://www.zdnet.com/article/borland-interbase-backdoor-det...
Citation needed.
On the other hand:
In that case, open source rarely has even one possible replacement, so there's no comparison.
>but if you have the source code, it's often reasonable to read
As someone working in code daily, I disagree. I find lots of open source projects once you get out of the few big ones to be a massive mess of code.
And most programs of much use are simply too big to do any sort of audit. I have lots of friends in open source - I doubt a single one has ever read over the source for an entire program to inspect.
Have you honestly read over an entire open source program to check it? Or is this a myth that gets repeated but no one does it....
As to modification, I've reverse engineered many, many programs to add hooks and interoperability. It's not that terribly difficult once you've done a few and get to know how to do it.
So sure, nice clean code is good. But open source software I find to be crappy for all but the few big uses. GIMP vs photoshop? No real good OS CAD, or finance, or comparing Octave to Mathematica? Buggy video editor of the week to DaVinci Resolve? Tax software? Inkscape vs AI? So as a result of lacking quality in OS, I prefer closed source solutions since paying for them gets me vastly better quality for a lot of things I want software for.
And in the rare case I want to hack something, I still can and do.
Open source is honestly a you-get-what-you-paid-for solution for most stuff.
> In that case, open source rarely has even one possible replacement, so there's no comparison.
There's usually just one program shipped by a vendor in these cases, and most of the time it's indeed closed-source -- that's what I started with.
Big and widely used FLOSS projects are far from these programs shipped by small hardware manufacturers, I wasn't talking about those. Just as the established and polished commercial projects are far from those: you're getting some buggy and unsupported programs from unknown hardware vendors, possibly even with malware as in TFA, not Photoshop.
> Have you honestly read over an entire open source program to check it?
I have, pretty sure that many others read those too, but haven't read entire sources of large projects like GIMP; plenty of programs and libraries are just a few KLOC (or even just hundreds of LOC) long, easy to skim.
> As to modification, I've reverse engineered many, many programs to add hooks and interoperability. It's not that terribly difficult once you've done a few and get to know how to do it.
I have rather hard time imagining these being any major modifications and considered easy with arbitrary compiled binaries, while suspecting merely reading sources being something mythical. But once again, you're probably picturing a hairy mess of a huge project's source code, and I picture integration tasks like turning a buggy Windows GUI program into a working multi-threaded Linux daemon -- where having source code makes it easier (and I'm certainly reading at least decompiled code when that's an option), as well as making it practical/easier to see what the program is doing.
Heck, I suspect Ghidra nowadays makes that a single click task.
And if it's that small, it's also trivial to write. I doubt too many companies fret over stuff that small.