Open-Source Software and Security Assessment

Open-source software is usually developed by and for the user community and is made available with a wide variety of licensing conditions to support widespread adoption and reuse. Advocates of opensource software believe that security can be improved when the source code is available to the public. This is expressed | in Linus's law, which basically says that with enough eyeballs looking at the code, all bugs within that software will become apparent. The idea is to let other developers and programmers review the code to help find the security vulnerabilities that may exist. It is hoped that this openness will lead to quick identification and repair of any issues, including those dealing with security.

Other developers disagree. The question is, will other programmers be able to find all the security vulnerabilities given enough time? Some may always remain no matter how many eyes have looked at the source code. Releasing the source code does not ensure that all security bugs and vulnerabilities will be found, and the automatic assumption of reliability can lead to a false sense of security.

Advocates of proprietary systems note that dishonest programmers may find security vulnerabilities but not disclose the problem to the general community, or at least not until they have exploited it. There have been instances where those in the black hat community tried to blackmail software vendors when they have found vulnerabilities in their software.

A final determination on this issue has not yet been made, and there are advocates for both sides of the argument, citing both advantages and disadvantages. However, in general, it is known that "security by obscurity" does not generally work. That is the idea that if a technology is not as wellknown, there is less likelihood that someone will discover how to break into it and find vulnerabilities. Whether programs are available in source or only as executable versions, it is known that observation, reverse engineering, disassembly, trial and error, and random chance may be able to find security vulnerabilities.