We know of Linus\' law: With enough eyeballs all bugs are shallow In general, pe

Question

We know of Linus' law:

With enough eyeballs all bugs are shallow

In general, people seem to say that open-source software is more secure because of that very thing, but...

There are many small OSS projects with just 1 or 2 developers (the cathedral model, as described by ESR). For these projects, does releasing the source-code actually lower the security? For projects like the Linux kernel there are thousands of developers and security vulnerabilities are quite likely going to be found, but when just some few people look through the source code, while allowing crackers (black hat hackers) to see the source as well, is the security lowered instead of increased?

I know that the security advantage closed-source software has over OSS is security through obscurity, which isn't good (at all), but it could help to some degree, at least by giving those few devs some more time (security through obscurity doesn't help with the if but with the when).

Explanation / Answer

I think it probably does lower security a bit, for an open source project that's so small or obscure that nobody but its authors are really looking at it. In that case, you aren't getting any help with security from a community, but if someone did for some reason target your small obscure project, they'd have an easier time since they'd have the source. Not that they'd have an impossible time without source, but having the source speeds up understanding, whether your intent is friendly or malicious.

A lot of the most common web vulnerabilities (HTML escaping issues, SQL injection, etc.) are pretty easy to check for without having source, too, so it's not like keeping things closed will mean you're safe.

I'd tend to think you're better off just doing what makes sense on the license (open or closed) independent of security concerns, and then treat security as something to worry a lot about either way.

Related Questions

Navigate

• Browse (All)
• Browse W
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.