From Fedora Project Wiki

< FWN‎ | Beats

Revision as of 01:32, 16 February 2009 by Bressers (talk | contribs)

Security Week

In this section, we highlight the security stories from the week in Fedora.

Contributing Writer: JoshBressers

Is Open Source Software Secure?

This week there was a story posted to Slashdot titled How To Argue That Open Source Software Is Secure?[1]. Quoting the post:

... saying that they were warned that they are dangerously insecure because they run open source
operating systems or software, because 'anyone can read the code and hack you with ease.'

This issue seems to keep coming up from time to time. This argument is of course silly and one of those "Prove it ... you can't? So it's true!" There is no way to prove that a piece of closed source software is more or less secure than a given piece of Open Source Software. If you can't see the source, you can't be certain that the vendor did or didn't fix issues. You need to unconditionally trust your vendor. If the source code is wide open for anyone to see, it keeps the vendor honest. You can't sweep issues under a transparent rug. You can try, and maybe hide a few piles of dust, but the really scary piles of dirt will stick out like sore thumbs.

The issue at hand isn't is application A more secure than application B, but do you trust vendor A more than vendor B?