Hacker News Reader

Comment by danbruc | Hacker News Reader

Open/closed source software and secure/unsecure software are orthogonal concepts. Yes, it may be easier to assess open source software with regard to security and privacy issues, but it is absolutely not necessary. And even with open source software the overwhelming majority of users still has to trust some third party because it is absolutely unrealistic that every user or organization audits their complete software (and hardware) stack. The only thing you really gain is that you are free to choose which third party or parties you have to trust.

View on HN

> Open/closed source software and secure/unsecure software are orthogonal concepts

No, they are not. It's fundamentally impossible to secure proprietary software because you have to trust its provider the software does what it says it does whereas with open-source you can always check for yourself. Any backdoor in open-source software is there to be exposed and corrected.

With proprietary software only one party can disclose vulnerabilities and in open-source anyone with the knowledge can do it. You can choose to trust a single party or choose to trust a myriad of different parties any one of which can blow the whistle if they find something fishy.

I find it highly unlikely a backdoor to a popular open-source application could remain there for long. I don't think it's unlikely at all with proprietary software where there is no incentive to fix a problem until someone outside the company learns about it.

It is not impossible. There is no reason why closed source software can not be secure. Yes, you can not convince yourself in the same way you can with open source software but again secure software and the ability to convince yourself that a software is secure are different things.

> There is no reason why closed source software can not be secure

True, but there is no way to prove it's secure. It's not about convincing myself or anyone else - it's about proof.

You get no proof for open source software either unless you perform a formal verification. And even then your proof may be wrong.

But maybe we can agree on the following. Closed source software can be secure but there is a broad spectrum of needs for convincing someone that a software is secure and this need may be better served with open source software in some circumstances. For some it is sufficient to trust a vendor. Some want to audit the source code (and this does not exclude closed source software). Some even need formal verification maybe even of the underlying hardware.

So you mean the Linux kernel was proven secure? When?

http://www.theregister.co.uk/2009/08/14/critical_linux_bug/

http://www.networkworld.com/community/blog/linux-finally-fix...

http://it.slashdot.org/story/11/06/20/2257229/13-year-old-pa...

You're trying to apply an impossible standard to closed source software that software that was that developed from the start to be open source and developed in the open cannot meet.

At least with FOSS, I get to choose the third party I trust to verify my software's security. And I don't have to take it on faith, I can get a second opinion, or audit the parts I care most about myself.

Added exactly this while you wrote you comment. I don't deny that open source software has advantages in this regard.

Reply on news.ycombinator.com