Ask Lemmy

34076 readers

1259 users here now

A Fediverse community for open-ended, thought provoking questions

Rules: (interactive)

1) Be nice and; have fun

Doxxing, trolling, sealioning, racism, and toxicity are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them

2) All posts must end with a '?'

This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?

3) No spam

Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.

4) NSFW is okay, within reason

Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com. NSFW comments should be restricted to posts tagged [NSFW].

5) This is not a support community.

It is not a place for 'how do I?', type questions. If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.

6) No US Politics.

Please don't post about current US Politics. If you need to do this, try !politicaldiscussion@lemmy.world or !askusa@discuss.online

Reminder: The terms of service apply here too.

Partnered Communities:

Logo design credit goes to: tubbadu

founded 2 years ago

MODERATORS

Bluetreefrog@lemmy.world

TheSaneWriter@lemm.ee

TheSaneWriter@lemmy.thesanewriter.com

Asudox@lemmy.world

lemmy_bot@lemmy.world

beefbaby182@lemmy.world

ModeratorCan@lemmy.world

neidu3@sh.itjust.works

asudox@lemmy.asudox.dev

candyman337@lemmy.world

candyman337@sh.itjust.works

165

Why is open source software assumed to be secure? (lemmy.world)

submitted 4 days ago* (last edited 2 days ago) by Davriellelouna@lemmy.world to c/asklemmy@lemmy.world

68 comments fedilink hide all child comments

I support free and open source software (FOSS) like VLC, Qbittorrent, LibreOffice, Gimp...

But why do people say that it's as secure or more secure than closed source software?

From what I understand, closed source software don't disclose their code.

If you want to see the source code of Photoshop, you actually need to work for Adobe. Otherwise, you need to be some kind of freaking retro-engineering expert.

But open source has their code available to the entire world on websites like Github or Gitlab.

Isn't that actually also helping hackers?

you are viewing a single comment's thread
view the rest of the comments

[–] fmstrat@lemmy.nowsci.com 24 points 3 days ago (1 children)

Others have mentioned this, but to make sure all context is clear:

FOSS software is not inherently more secure.
New FOSS software is probably as secure as any closed source software, because it likely doesn't have many eyes on it and hasn't been audited.
Mature FOSS software will likely have more CVEs reported against it than a closed source alternative, because there are more eyes on it.
Because of bullet 3, mature FOSS software is typically more secure than closed source, as security holes are found and patched publicly.
This does not mean a particular closed source tool is insecure, it means the community can't prove it is secure.
I like proof, so I choose FOSS.
Most people agree, which is why most major server software is FOSS (or source available)
However that's also because of the permissive licensing.

[–] liquefy4931@lemmy.world 3 points 2 days ago

Also keep in mind that employees of companies that release closed source software are obligated to keep secret any gaping security vulnerabilities. This obligation usually comes with heavy legal ramifications that could be considered "life ruining" for many of us. e.g. Loss of your job plus a lawsuit.

Often, none of the contributors to open source software are associated with each other and therefore have no obligation to keep discovered vulnerabilities a secret. In fact, I would assume that many contributors also actively use the software and have a personal interest in getting security vulnerabilities fixed.