Open-source code is not in fact easier to exploit than closed-source code is. Security and openness are mostly orthogonal.
If I’m in the situation where I have a binary of a server without the source, I have to pay the cost of using ghidra or IDA for a few hours or days (or weeks) to figure out how the software is structured before I can come up with an exploit. If I’m dealing with an open source target that’s a cost I don’t have to pay.
Not sure if I agree with this. Obscure systems are usually harder to hack as they require an extra effort on discoverability that open systems don't have.
Easier to exploit != more exploitable. One is about the threshold to discover an exploit, the other is about the total exploitable bugs.
In my view, the "hackability level" is the same for both open and closed-source projects. Making something close it doesn't make it less hackeable, it just makes the threshold to discover bugs higher.
Also, one may argue that with open-source projects you may be able to fix more bugs since those are in the open and more people can report them (thus, more secure). I think it really depends on the contribution level and where the codebase is at to see if security might be a concern or not.
> Security and openness are mostly orthogonal.
But I mostly agree with this ;)
We’ve known since the 70s that you (provably) can’t trust source code. We know experientially that it’s easier to diagnose code than programs. We also know experientially that the teams involved have a dramatic effect on the security of the outcomes.
How will we ever decide which of our three contestants will win?
One way of seeing it is that it's mostly orthaganal at a level of all software out there, but that for those who make a serious effort to be secure, there is a lot of benefit to being open source.
There's Linus's Law, "given enough eyeballs, all bugs are shallow". I think if the maintainers of Linux didn't meaningfully address security concerns, it would just mean they were doing a bit better at whack-a-mole. You see this in popular open source projects like WordPress.
So I think that's why a reader might think tptacek's two comments don't jibe with each other. If you are given a choice between an open source and a closed source application, you wouldn't just assume one is more secure than another. However, if you were starting off to make a secure system, it would be a good idea to make it open source.
It proved that FOSS isn't infallible, which I hope isn't that great a shock. To argue that it weakens the general argument, you would need to present a similar TLS library which avoided exploits by being closed source.
I myself have on occasion found high priority bugs (not security issues) in open source projects with many eyeballs, simply by turning on additional compiler warnings. The fruit out there hangs very low.
Openness counts for nothing if nobody is reading the code. Open is better than being closed source but the difference is marginal. The real difference is made by having the code reviewed by security professionals, and by how the project is maintained/lead, and those are orthogonal to open/closed source.