Open Source Software

Lenny_The_Loiner

Due to it being "open source" is there anyway of making sure free open source software is "safe"?

amosworks

?? The more eyes prying on the source, the shallower the bugs.

You will find any day that open source is much safer than closed source. With closed source you can't check for bugs, coding errors, back doors, and a range of other security problems.

I'm interested to know why you think that closed source is safer than open source? Just general curiosity

Bob63

Lenny_The_Loiner wrote:

Due to it being "open source" is there anyway of making sure free open source software is "safe"?

Google is your friend!

Just search for opinions on the software and see what people think of it. Any unsafe software will quickly be exposed due to the large number of people that have it installed and/or have seen the source.

Example: If you are interested in Azureus, the bittorrent client, then google for "opinion azureus" and see what people say about it. Then make your own informed decision based on what you read.

Mike

irnbru_2

amosworks wrote:

You will find any day that open source is much safer than closed source. With closed source you can't check for bugs, coding errors, back doors, and a range of other security problems.

Yes, people spend hours just reading source code to check for errors :rolleyes:

Any software, whether received as binary or source, can be checked for errors or security weaknesses.

If the OP is concerend that downloaded source software has been tampered with then they should seek to to get it from an approved mirror and compare the downloaded archive with a md5 or SHA-1 sum, usually available for the same archive.

If the OP means people committing malicious code to a project then developers (open or closed) go through several stages before code is committed to the *public* version.

amosworks

irnbru wrote:

Any software, whether received as binary or source, can be checked for errors or security weaknesses.

I'm intrigued to know how you go about checking for security weaknesses in binaries?

Darksun

amosworks wrote:

I'm intrigued to know how you go about checking for security weaknesses in binaries?

There are plenty of ways to find security weaknesses. Disassembly/decompilation, examining disk or memory read/write operations, studying file formats, monitoring network traffic generated by the software.

amosworks

Of course they're all good points, but for fun I'd rather slam my fingers shut in car doors than check the security of a binary.

I doubt even closed-source companies would hand over just the binaries for testing though :-\ (Unless they have more money than sense)

wolfman

cheesy.mike wrote:

Google is your friend!

Just search for opinions on the software and see what people think of it. Any unsafe software will quickly be exposed due to the large number of people that have it installed and/or have seen the source.

It's a double edged sword in my opinion. People can come up with plenty of arguments on both sides.

Microsoft is a huge example, but that doesn't mean closed source is less secure. Just look at Opera.

And open source isn't necessarily proven to be more secure. It's generally just less targeted. Linux is a classic example, especially in comparison to Windows.

Bob63

wolfman wrote:

Microsoft is a huge example, but that doesn't mean closed source is less secure. Just look at Opera.

At least get your facts right. Opera is free but it is not open source.

And I'm not saying that you never get bugs in open source software, just fewer and generally ones that are less disastrous.

Mike

wolfman

cheesy.mike wrote:

At least get your facts right. Opera is free but it is not open source.

Eh? Wasn't talking about cost. Double check my post, all I was saying is that Microsoft and Opera are both closed source, but just because one (Microsoft) isn't seen to be very secure, it doesn't mean the other (Opera) is too.

cheesy.mike wrote:

And I'm not saying that you never get bugs in open source software, just fewer and generally ones that are less disastrous.

It's a double edged sword. There's some great open source apps out there, but there's also some really badly written apps. Can see where you're coming from, and I wasn't targetting your post earlier, just saying people will give a range of opinions on the subject because it's such a general topic.