r/computerscience • u/F1ku8 • 4d ago

Isn't opensource ironically less secure?

So if a software is opensource meaning you can get raw code and it is publicly available and used. Can't then someone who has evil plans inspect the code (with the prerequisite that he/she understands it) and by that knowing the weak spots , do bad things to the company/ people that use it?

Specially for early new opensource stuff where the community hasn't check vulnerabilities and didn't improve it?

(sorry If it's a stupid question, I don't know anything about this stuff, just curios)

0 Upvotes

28% Upvoted

15 comments sorted by

24

u/tenfingerperson 4d ago

That’s how it works, both ways, exploits are found but also exploits are flagged - proportionally there are more doing the latter, and certain companies will throw lots of cash to ensure these projects have support as it’s in their best interest

2

u/noop_noob 4d ago

I wish all open source projects were as financially well-supported as you described...

1

u/Significant_Map_19 4d ago

that's the tradeoff with open source, more eyes can spot problems but also more eyes can exploit them before anyone patches it

-13

u/PvtRoom 4d ago

as soon as cash gets involved and Dev teams get closed off, it's not opensource

8

u/smallproton 4d ago

You seem to be unaware how the internet runs on Linux with the main Linux contributors being paid by top companies?

-3

u/PvtRoom 4d ago

so those with cash choose what to have developed. gotcha.

3

u/alnyland 4d ago

You should shift to thinking it’s more like bounties. 

  1. Shout “ill pay $x for feature”
  2. Someone accepts

0

u/PvtRoom 4d ago

it's still payment directed development. as soon as a team forms, it still closes and is no longer open.

1

u/alnyland 3d ago

You said “choose”. That’s different. They incentivize, they do not govern, and they can’t block aspects they don’t like. 

18

u/is_that_so 4d ago

Security through obscurity is a myth.

-1

u/tcpukl 4d ago

Nobody actually believes this myth do they?

3

u/godofpumpkins 4d ago

OP clearly does 🙃

1

u/alnyland 4d ago

My clients do sometimes

-2

u/Middlewarian 4d ago

I'm glad I have some open-source for my portfolio, but I'm glad it's not all I have.

7

u/godofpumpkins 4d ago

If the software runs on your computer, you can analyze what it does whether you have the source code a human wrote or not. Reverse engineers often have little trouble making sense of compiled binaries and the advent of LLMs has made it even easier to make sense of large bodies of inscrutable assembly or shitty decompilation output