Is Open Source Really So Much More Secure By Nature
-
@Pete-S I think if you look at that list and think about it, you'd see just how dramatically that list is telling us that open source is winning on vulnerabilities. Now, I still stand by my statement that the list is utter gibberish and means literally nothing whatsoever, BUT, let's assume that it means something and that the numbers are all true and directly comparable.
Now, let's look at the numbers that are bad enough to make the 2019 list (notice Linux isn't even on the list, it's all Windows and OMG cPanel!!!) with Fedora at 184 and Windows Server 2016 at 360. Fedora includes Linux, plus lots of other things, and includes every version of Fedora (about 31 releases in 2019.) Windows Server 2016 is a single release by comparison.
Now let's look at the size of the two. Fedora isn't just the tiny footprint that Windows is, no. It includes databases, video games, multiple products in every category... Windows Server 2016 is between 2-6GB. Each release of Fedora is around 250GB. It's apples to oranges. Windows is a tight OS with very few "extra packages" included in the OS. Sure it has Notepad, but the amount of bloat is small (in the OS itself.) Fedora may not install much by default if you don't want it to, but the entire OS is as much as 100x the size of Windows. Windows Server doesn't include Exchange or SQL Server. But Fedora includes several competitors to Exchange and myriad competitors to SQL Server, as examples. Plus half a dozen commercial video editors. Multiple web browsers, and on and on. Windows Server is also just the server release, but Fedora has Workstation, Cloud, and Server all lumped together as well.
That a single release of Windows Server has even 2% the vulnerabilities of the entire Fedora ecosystem collectives would be something. But that it has twice as many, lol. With some perspective, it's downright staggering how many more vulnerabilities Windows has per line of code.
-
@scottalanmiller I was reading an article (someone posted here) from a MS dev, who said they just refuse to update because they are forced to maintain their one piece of the pie. So even big vulnerability issues, they "find a reason to not accept or allow any changes"
Which is way more surprising.
-
@DustinB3403 said in Is Open Source Really So Much More Secure By Nature:
@scottalanmiller I was reading an article (someone posted here) from a MS dev, who said they just refuse to update because they are forced to maintain their one piece of the pie. So even big vulnerability issues, they "find a reason to not accept or allow any changes"
Which is way more surprising.
Not really surprising. In an org of that size, no one has ownership of the big picture. Everyone is tasked with getting their one little piece out the door, meeting deadlines, doing as they are told. Their devs make their money by obeying marching orders, not being rockstars. There's no glamour there, because they are not listed publicly. Do a good job, no one cares. Do something wrong that you weren't told to do, lose your job. At that scale, it's all but impossible to not have politics and playing to the middle not be what drives the organization. They are just too big to attempt excellence, and they know that.
MS doesn't, and never has, made their money off of being a good product. They make it off of market momentum and marketing. Always have. Their customers have never chosen them because they are fast, secure, or feature rich. Primarily, they are pushed by vendors who resell their software and can't make the same margins on something free. So no Linux distro gets the same love from sales people, because Linux lacks both the initial sales margins (as well as the licensing consulting fees) and as many follow up support hours.
-
@scottalanmiller said in Is Open Source Really So Much More Secure By Nature:
@Pete-S I think if you look at that list and think about it, you'd see just how dramatically that list is telling us that open source is winning on vulnerabilities. Now, I still stand by my statement that the list is utter gibberish and means literally nothing whatsoever, BUT, let's assume that it means something and that the numbers are all true and directly comparable.
Now, let's look at the numbers that are bad enough to make the 2019 list (notice Linux isn't even on the list, it's all Windows and OMG cPanel!!!) with Fedora at 184 and Windows Server 2016 at 360. Fedora includes Linux, plus lots of other things, and includes every version of Fedora (about 31 releases in 2019.) Windows Server 2016 is a single release by comparison.
Now let's look at the size of the two. Fedora isn't just the tiny footprint that Windows is, no. It includes databases, video games, multiple products in every category... Windows Server 2016 is between 2-6GB. Each release of Fedora is around 250GB. It's apples to oranges. Windows is a tight OS with very few "extra packages" included in the OS. Sure it has Notepad, but the amount of bloat is small (in the OS itself.) Fedora may not install much by default if you don't want it to, but the entire OS is as much as 100x the size of Windows. Windows Server doesn't include Exchange or SQL Server. But Fedora includes several competitors to Exchange and myriad competitors to SQL Server, as examples. Plus half a dozen commercial video editors. Multiple web browsers, and on and on. Windows Server is also just the server release, but Fedora has Workstation, Cloud, and Server all lumped together as well.
That a single release of Windows Server has even 2% the vulnerabilities of the entire Fedora ecosystem collectives would be something. But that it has twice as many, lol. With some perspective, it's downright staggering how many more vulnerabilities Windows has per line of code.
Well, you said vulnerabilities doesn't mean it less secure! Awesome! And you don't know how many lines of code there is in Windows. Or do you have access to the source? Some Windows customers do.
As far as I know there is NO research that shows that open source products are more or less secure than close source products. The only research I've seen shows that there is no advantage to either system over the other.
So the correct answer to the OPs question is "No, there is no evidence that suggests open source is more or less secure by nature".
And before you start hammering on the keyboard - arguments and opinion is not proof.
-
@Pete-S said in Is Open Source Really So Much More Secure By Nature:
And you don't know how many lines of code there is in Windows. Or do you have access to the source?
You can tell from the size of the compiled code within reason. So yes, we do know in a practical sense, very much so.
-
@Pete-S said in Is Open Source Really So Much More Secure By Nature:
As far as I know there is NO research that shows that open source products are more or less secure than close source products. The only research I've seen shows that there is no advantage to either system over the other.
LOL, no, that's not what research says. And you just provided great examples that demonstrate why.
Closed source can be secure, but it always is at a security disadvantage as closed source is inherently harder to secure than open source.
-
@scottalanmiller said in Is Open Source Really So Much More Secure By Nature:
@Pete-S said in Is Open Source Really So Much More Secure By Nature:
And you don't know how many lines of code there is in Windows. Or do you have access to the source?
You can tell from the size of the compiled code within reason. So yes, we do know in a practical sense, very much so.
Then windows is have much more lines of code in it. Install a minimal base system and compare.
-
@Pete-S said in Is Open Source Really So Much More Secure By Nature:
So the correct answer to the OPs question is "No, there is no evidence that suggests open source is more or less secure by nature".
It's the opposite. All logic, common sense, industry observation and the example you gave all show the opposite.
-
@scottalanmiller said in Is Open Source Really So Much More Secure By Nature:
Closed source can be secure, but it always is at a security disadvantage as closed source is inherently harder to secure than open source.
Just arguments and no proof yet again
-
@Pete-S said in Is Open Source Really So Much More Secure By Nature:
Then windows is have much more lines of code in it. Install a minimal base system and compare.
Not a minimal base system... the whole OS. Windows is around 5GB. Fedora is around 250GB. Are you not reading the examples?
-
@Pete-S said in Is Open Source Really So Much More Secure By Nature:
@scottalanmiller said in Is Open Source Really So Much More Secure By Nature:
Closed source can be secure, but it always is at a security disadvantage as closed source is inherently harder to secure than open source.
Just arguments and no proof yet again
No, we provided the proofs. Just because the closed source camp withholds the proof that you decide we need doesn't change the facts. It only supports them.
-
@scottalanmiller said in Is Open Source Really So Much More Secure By Nature:
@Pete-S said in Is Open Source Really So Much More Secure By Nature:
@scottalanmiller said in Is Open Source Really So Much More Secure By Nature:
Closed source can be secure, but it always is at a security disadvantage as closed source is inherently harder to secure than open source.
Just arguments and no proof yet again
No, we provided the proofs. Just because the closed source camp withholds the proof that you decide we need doesn't change the facts. It only supports them.
That's a sad argument and false. You have provided zero proof, because there are none.
Just show us just one simple peer reviewed research paper that shows us that open source is more secure by nature.
PS. And I'm the open source camp btw.
-
Here's the basics....
The only side that demands a certain style of proof, is the same side that refuses to provide it - using the withholding of their chosen proof as foundation for the claim that there isn't any proof and therefore their stated "they are the same" stands until such time as they provide whatever proof they claim is required.
In the real world, we don't need that proof. All evidence, all common sense, all honest evaluation points 100% to open source being the better license for security.
There can be no "proof" in code for reasons anyone that knows anything about IT or software would know and would never need explained - because no code can be developed the same in both for comparison. We can only use logic and common sense to show what is fact, and then check that observation shows these factors to play out as expected, which Pete provided dramatic evidence to support, as an example.
There's so much proof it's no longer worth discussing. Trying to claim that there isn't overwhelming proof is absurd. The whole point is that closed source can't be trusted because it's using obscurity not only against malicious actors, but against its own clients!
-
@Pete-S said in Is Open Source Really So Much More Secure By Nature:
That's a sad argument and false. You have provided zero proof, because there are none.
YOU provided proof yourself!
-
@Pete-S said in Is Open Source Really So Much More Secure By Nature:
Just show us just one simple peer reviewed research paper that shows us that open source is more secure by nature.
Show us one that isn't sponsored by a vendor or VAR that says closed source can approach open source in security.
-
The problem here is that the argument isn't something that peer review is going to tackle, because the question is akin to asking why the sky is blue. Open source is so obviously the more secure process, that's no one would understand what needs to be explained.
It's like asking for a peer review as to why locking your door is more secure than leaving it ajar. People would be flabbergasted if you asked them such a thing. As I'm shocked now.
The question is actually that you want a peer reviewed research paper showing that taking security seriously and providing mechanisms to encourage security both technically and through human/business/peer/market pressure rather than using obscurity to hide mistakes and remove pressure to be secure is more secure?
Literally the big difference between the two is "one is about promoting security, and one is about undermining it." That's what we are actually discussing.
-
Here's another great way to look at it...
The desire for a peer reviewed article to prove the point is telling. When it comes to security, you want peer review.
But that's the point of open source: peer review.
-
@scottalanmiller said in Is Open Source Really So Much More Secure By Nature:
Here's another great way to look at it...
The desire for a peer reviewed article to prove the point is telling. When it comes to security, you want peer review.
But that's the point of open source: peer review.
Just write secure code, problem solved.
-
I did find a peer reviewed paper, but it was written by Microsoft and peer reviewed by a university that they fund. And it just said that they didn't have any means by which to evaluate the two because there's no viable metric.
"In conclusion, open source does not pose any significant barriers to secu-
rity, but rather reinforces sound security practices by involving many people
that expose bugs quickly, and offers side-effects that provide customers and the
community with concrete examples of reusable, secure, and working code."However, they also came to this utterly garbage conclusion that only Microsoft could come to: "...many security attacks are independent of the source code, so neither open source or proprietary software is less secure."
So let me get this straight, Microsoft's employee claims that since many attacks come through other vectors, that code security is irrelevant anyway? That's literally what they said in the paper. So their claim is that something like the Solarwinds event is irrelevant since, for example, ransomware is common in other arenas.
-
The underlying issue is that Microsoft (or any closed source software company) aren't motivated to make their software securely, because it cost a ton of money to do that.
And instead of writing secure software, they pay for "peer reviews" saying that nothing can be secure because of other random reasons. . . .
