Nobody on my post asking for controversial privacy topics asked this question, but I feel I should cover it anyways. People sometimes assume that software is safe simply because it is open source. That is a misconception, and I would like to cover that in this post.
What does “open source” mean?
When software is “open source,” it means that the developers have made the source code for the software public and allows anyone to help contribute to the code, or create their own versions of the software based on the source code. By contrast, proprietary software is software that has not made the source code visible to the public. There are similar terms to open source, such as “source-available,” “open-core,” and “libre,” which I won’t cover in this post. For the sake of simplicity, any source-available software will be called “open source,” since the specifics don’t quite matter for the majority of this post.
What are the benefits open source software?
Open source software provides many benefits over proprietary software:
Code auditing: Because anyone can inspect the code, anybody can look for vulnerabilities or invasive code to make sure that the software is safe. With proprietary software, the developers would have to hire a third party auditor to inspect the code. That means you have to trust the auditor, and you have no way to verify first-hand that the code is safe.
Bug reporting: While both open source and proprietary software have bug reporting systems, open source software tends to have more thorough and transparent bug reporting. Bug reports are generally on a public issue tracker such as GitHub, which can also help prevent duplicate bugs from being reported. Having these reports public also makes the next benefit easier:
Bug fixing: Anyone can contribute to open source software, which means the workload is distributed. Instead of a small team of developers being the only ones working on the software, anyone can look at the public issues and code their own fixes for the software.
Resurrecting projects: Both open source and proprietary software can one day stop being developed. Even big companies such as Spotify can retire software, which can lead to hardware devices becoming unusable or insecure. (The code for Car Thing has been reconstructed, by the way.) Open source projects that fall out of development can easily be forked and maintained by a new developer. It’s rare to see proprietary software handed off to a new owner.
Accountability: Open source projects hold the developers directly accountable for any vulnerabilities or invasive code, meaning the developer’s interests are aligned with its users and not malicious purposes. This also incentivizes creating code without paywalls, since anyone could release a version of the code with the paid features “unlocked”.
However, even with all these benefits, open source software isn’t perfect.
Why has proprietary software become so popular?
Since ads and paywalls can generally be removed from open source software, it doesn’t make it a very appealing choice to for-profit organizations. Generally, these organizations want to monetize and control their software, which means injecting ads, paywalls, and other invasive elements. This is done most easily if the software is proprietary.
It’s also rare to see open source software becoming so popular, because generally open source software receives its funding from donations and doesn’t have the budget to advertise the software. There are exceptions, such as OBS Studio or Blender, which have mostly become the most popular software in their categories.
Is open source software safe?
There is another downside to open source software that many people don’t talk about: it is much easier to exploit than proprietary software. Because all the source code is visible to the public, it makes it easy for malicious parties to craft vulnerabilities. Proprietary software is generally a stab in the dark until a vulnerability is found, since you can’t see exactly how it was coded.
Software being open source does mean that it becomes more likely to find and fix vulnerabilities, but being open source doesn’t automatically make software safe. Which device do you think would be more likely to obtain a virus, a device running (stock) Android or a device running iOS? You’re most likely more inclined to say the device running (stock) Android is more likely. Android at its core is open source. While correlation is not causation, and there are other factors at play, it’s much easier for someone to try to craft a malicious app for Android than for iOS because of its open nature.
Proprietary software isn’t automatically safe, either. It can be just as vulnerable as any other software. However, open source software has the potential to become much more secure than proprietary software, simply because more people can find and fix vulnerabilities. That’s probably why Apple open sourced their Private Cloud Compute code before launching a bounty program for it.
Anyone can code malicious open source software. It’s riskier, since it’s more likely to be noticed, but it’s still possible. Microsoft could open source Windows one day, and it wouldn’t make it any more safe until somebody identified and fixed the issues. Open source software doesn’t automatically make something private or secure, but it does provide integrity, because the developer is showing that they will be accountable for any malicious or vulnerable code, and that anyone is free to look through the code.
Final notes
I hope this gives you a better idea of what it actually means if something is open source. Even unsafe proprietary software can be run safely under the right conditions. If your threat model requires you to use as much open source software as possible, I made my own list of open source software called Open Source Everything that you can look through. I hope you enjoyed reading this!
- The 8232 Project
Why does "free software (as in freedom) matter?
so, free software is a philosophy. software is judged to be free based on it’s adherence to the philosophy based on what they call the four freedoms: freedom to use, read, modify and share the software without restriction. based on those freedoms are free software licenses that enforce this. the most famous one, the gpl, also says that any modification must adhere to the same freedoms. this is what makes “free software” distinct from “open source”. (see also: “copyleft”)
the gpl means that you are entitled to receive the source code of any company that runs modified GPL software upon request. note that this does not prevent them from making money on the software, only that you as a (potentially paying) user must be able to get the sources without jumping through extra hoops.
this matters because all improvements are shared as a matter of course, and all source code can be audited. in theory. in reality this does not always happen, of course, which is why the fsf and similar organizations exist to drive these cases through courts. it matters because it acts as a brake on large actors using community-developed software without reciprocating.
tldr: it keeps us in control over our computing.
Want privacy? Throw away your control and see how that goes.
My humble opinion
Example
Locked in google services. DNS so google sees the sites you visit, tracks what you click, where you go, who you talk to, what you like, what services you use, where you spend your money, etc.
Freedom - no log encrypted DNS rolling your own DNS server/proxy, seeing the config, the source; no tracking, no surveillance and profiles stored that are gladly shared with whatever other company or gov dept that wants it. No blobs or beacons. The ability to see what is happening, to choose what to allow or disallow, to be able to edit, modify, clone, fork, etc based on your needs and wants.
Not the Almighty profit margin.
Freedom to choose poison or antidote.
Another eg.
Nothing to hide may be true for now.
But what you believe need not be hidden, may, by some future government (or dictator), be deemed a crime, or worthy of retribution.
Allowing an unaccountable, unverifiable, monolith or shady actor is asking for problems.
The less data you share (or is unknowingly siphoned off) the less data you have to worry about being leaked /breached.
Knowing what is happening, being able to audit, being able to verify, freedom to choose vs blind trust.
If someone you don’t know knocks on your door, do you let them in and make themselves at home?
that’s not what free software is.
Maybe the people at the heart of Foss can make it more clear.
Gnu.org
so, what your first post describes is open source. this quote from the fsf also describes open source, but the important stuff is in the nuances of the wording. open source allows you to share your changes. free software forces it through legal means. sorry for being so curt at first, i elaborated in my other reply.
Isn’t that clear where I mentioned ability to fork, clone, modify, etc?
Besides that they asked why, not what.
I gave my opinion and examples.
well the important distinction is who is bound, right? your examples are all true of open source as well. the main difference between the two concepts is that if i withhold my changes to gpl-licensed code from you, you can sue me for breaching the license. if the software is mit, i am in my full right to deny you access. that’s not what i got from your wording.
This is free software, libre software. These quotes never say ‘open source’, only FS, never FOSS. gnu.org/philosophy/open-source-misses-the-point.en.html
From itsfoss
It’s foss
https://itsfoss.com/what-is-foss/
Because GNU is Foss because Foss is gnu. Because the guy that started the fsf movement is Richard stallman who wrote that.
https://www.gnu.org/philosophy/free-sw.html
gnu.org/philosophy/open-source-misses-the-point.en.html
Edit: They are trolling. Don’t feed. Wait for mods.
You said what I posted was not Foss.
It came from the very essence of Foss.
It gave the very definition of Foss.
From the people who started Foss movement .
On the site run by the people who continue to promote and advocate for Foss.
And explains the distinction between Foss and open source.
What about that is unclear?
Post something else about open souce, please.
Tell me again how that is not what Foss is.
Please, guide me.
(What you cleverly replied with is in the link I posted ffs)
Wrong, read your own source.