Open source closes backdoors

When a software company will not make the source code for a product available, one must put one's faith in something called security through obscurity. The argument for security through obscurity is simple. If crackers could get to the source code, it would be easy for them to find ways to exploit weaknesses in the product.

While that sounds like a logical argument, it is easily refuted. If you are not already convinced by the numerous Windows, Internet Explorer, and Microsoft Outlook exploits, then pay a visit to Game Copy World (see Resources for a link) sometime. You'll see just how easy it is for people to break the copy protection for games without having to see the source code. The site often publishes copy protection workarounds the same day a game is released. (By the way, I believe Game Copy World is actually providing a legitimate and valuable service. As someone with young children, I can confirm the need to make backup copies of games that get scratched and ruined by reckless little fingers.)

Ironically, we open source advocates have confidence in the security of open source software for the same reason others defend security through obscurity -- open source code actually does make it easier to spot weaknesses in a product. We simply take the next step in the logic. If having the source code makes it easy to spot weaknesses, then the best way to find and plug security holes is to make the source code as widely available as possible and solicit the input of those who use it.

NSA key revisited

A greater security risk than system cracking concerns me, one that is only possible through source code obscurity: intentional backdoors.

Post a comment

Your name: *

E-mail: *

The content of this field is kept private and will not be shown publicly.

Subject:

Comment: *

• Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
• Lines and paragraphs break automatically.

Incorrect please try again

Try another

Vision impaired

Word challenge

Help

* Type both words below, separated by a space

Security Check provided by reCAPTCHA.
© 2008 Carnegie Mellon University, All rights reserved.

Brian Proffitt
Microsoft/Novell: Breaking Down the Coupon Numbers

Esther Schindler
Drupal's Dries Buytaert on Building the Next Drupal

Tom Henderson
Top Ten General Operating Systems Rants

pasmith
PS3 motion controller delayed; goes up against Project Natal

sjvn
Neolithic Windows security hole alive and well in Windows 7

claird
Perl source code comparison makes for good reading

mikelgan
Cell phones don't create stress or interrupt much

Sandra Henry-Stocker
How to: The Unix Interview

This month we're giving away 5 copies of each of these great books. Enter today for your chance to win!

	Friends With Benefits: A Social Media Marketing Handbook Tips, tricks, and real-world case studies to help you increase your online visibility.Enter now!
	Ubuntu Unleashed 2010 Edition Detailed information on installing, using, and administering Ubuntu. Enter now!
	VMware vSphere 4 Implementation Best practices for deploying the vSphere product in real-world enterprise environments.Enter now!