The open-source model

The open-source model, after all these years I'm still confident such is a potentially strong model for creating and maintaining secure software.

Here's my attempt at positioning open source within a security context, as a matter of completeness and brain-teasing the pro and contra are in mixed order below the topic.

Please make the exercise for yourself on how this may map to closed-source software. Do consider the list below is related to open-source specifically, besides a few really big companies closed-source is often maintained by few.

• Sourcecode is public
• + a bug or a security issue can be fixed by anyone 
• + having the sourcecode at hand may facilitate security
• compiling from source permits using a security oriented build strategy offering additional security based on compiler-flags and compiling with already hardened dependencies and libraries.
• tracking specific error messages and/or information flow can be an invaluable asset
• + a fix to the sourcecode can be shared independent from upstream
• the GPL license demands such a fix to be sent upstream, as such the upstream sourcecode may be considered updated
• ! take note for the upstream to actually implement a fix, your fix, is not a guarantee as many factors may come into play
• - someone with bad intentions can study and test until all weaknesses are mapped, diagnosed and exploits have been written for full effect.
• This is a risk impossible to fully mitigate against but by using complex best-effort security software or funding continuous sourcecode auditing.
• a notable company is BlackDuckSoftware but others exist
• Just today ( 23 dec, 2014 ) the E.U. has thrown over 1 Million Euro's for auditing open-source sofware.
• - it is tempting to "believe" someone has or will review the code anyway, this has led to a number of undesirable mishaps.
• - most people are not capable of reviewing sourcecode
• - many forks ( versions ) of the source may introduce a forest of possibilities which make it hard to maintain automated protections such as with a Web Application Firewall, IDS, IPS, SIEM.
• + this is at times compensated for with such products supporting a limited set of distributions for which these are certified as well.
• + given the many versions of a single binary/source the practice of mapping, diagnosing and writing exploits for specific releases may be mitigated by the many different versions in use, in turn reducing the world-wide attack surface
• + Automated compliance and auditing can be done for source-code used in production, even if this code has been customized
• recently DevOPS is counting on this to offer added security
• - offering sourcecode for anyone to see also invites a sense of moral and ethics, on the flipside offering sourcecode for hostile software tools is an inherent threat. This is impossible to mitigate against and a growing source of concern.
• this also means the 'blueprint' of this hostile code can be analyzed and mitigation developed and eventually put in place.
• The sourcecode is under review 'by many eyes'
• + an undeniable strength of open-source, even less-talented programmers may pinpoint where a problem originates and forward a valuable report upstream. This may reduce the find-to-fix period significantly.
• -  the 'many eyes' principle has failed miserably a few times in the recent past leaving severe vulnerabilities undetected for years
• a number of openssl bugs are as bad as they come and have existed for many years, not in the least due to a lack of funding
• + since open-source is being used by many corporations ( both small and large ) Collectively funding software auditing actually reduces the overall cost for secure software auditing in a way hard or even impossible to achieve with closed-source software.

The above list and this post is by no means complete but should give some food for thought if you're concerned with open-source and security.

Writing this down has removed a few doubts i started to have when weighing open-source vs closed-source development models. It may be counter intuitive at first but i firmly hold my belief open-source is the road to the most secure software and possibly ICT Infrastructure possible.

It goes withough saying but is cannot be stressed enough security depends on the community and it's members effectively communicating, sharing, improving.