Latest / DevQuestions with Tim Corey / 191 Is Open Source More Secure Than Closed Source?

Transcript

191 Is Open Source More Secure Than Closed Source? · DevQuestions with Tim Corey

• 0:00
  SPEAKER_00: Welcome to the Dev Questions Podcast with Tim Corey.
• 0:03
  SPEAKER_00: Join us each episode as we tackle the questions you are asking about a career in software development, understanding the industry, and new technology.
• 0:12
  SPEAKER_00: If you're just starting out or you want to grow stronger as a developer, this is the place to get your questions answered.
• 0:19
  SPEAKER_00: Now, here's your host, expert developer and online educator, Tim Corey.
• 0:26
  SPEAKER_02: Is open source more secure than closed source?
• 0:30
  SPEAKER_02: I bet you know my answer.
• 0:32
  SPEAKER_02: Let's talk about it in today's episode of Dev Questions.
• 0:35
  SPEAKER_02: Now, this comes from the suggestion site.
• 0:37
  SPEAKER_02: If you have a suggestion, go to suggestions.imtimcorey.com and leave your suggestion there.
• 0:42
  SPEAKER_02: So is open source more secure than closed source?
• 0:46
  SPEAKER_02: Well, it depends.
• 0:47
  SPEAKER_02: So let's talk about the golden scenario of open source, okay?
• 0:53
  SPEAKER_02: The golden dream of what it could be.
• 0:57
  SPEAKER_02: So because the code is open, people review it.
• 1:02
  SPEAKER_02: And because people review it, bugs are found.
• 1:06
  SPEAKER_02: And because bugs are found, the bugs get fixed.
• 1:09
  SPEAKER_02: And because the bugs get fixed, the code is more secure.
• 1:13
  SPEAKER_02: That's kind of like the dream of open source, and it can work that way.
• 1:18
  SPEAKER_02: In some cases, it does.
• 1:20
  SPEAKER_02: So that sounds really secure and really awesome.
• 1:23
  SPEAKER_02: And there's a lot of cases where that has made for better software.
• 1:28
  SPEAKER_02: But here's the reality.
• 1:30
  SPEAKER_02: The reality is just because code is open doesn't mean people have reviewed it.
• 1:36
  SPEAKER_02: Just because people have reviewed it doesn't mean they found the bugs.
• 1:42
  SPEAKER_02: And just because the bugs have been found doesn't mean they're fixed.
• 1:47
  SPEAKER_02: So there's some flaws in that logic, right?
• 1:52
  SPEAKER_02: And the people most incentivized to find bugs aren't the ones that are scanning it for good purposes.
• 2:01
  SPEAKER_02: The people most incentivized to find bugs are the people who want to exploit them.
• 2:06
  SPEAKER_02: So your code may be scanned, bugs may be found, and exploits identified, but are they identified by people who are looking to make your code better?
• 2:19
  SPEAKER_02: Or are they identified by people who are looking to take advantage of those exploits?
• 2:26
  SPEAKER_02: So let's look at closed source software.
• 2:29
  SPEAKER_02: So for closed source software, the fear is that bugs are there, but no one's found them.
• 2:35
  SPEAKER_02: And as a result, the software is less secure.
• 2:38
  SPEAKER_02: And the people incentivized to find bugs are the people who want to exploit them.
• 2:44
  SPEAKER_02: So that can be true.
• 2:46
  SPEAKER_02: It can be true that if you have, if you write software, let's just pretend you're the one creating the software.
• 2:52
  SPEAKER_02: If you write software, you might have a small team.
• 2:56
  SPEAKER_02: No one has a team that's overly large.
• 2:58
  SPEAKER_02: It doesn't feel like it.
• 2:59
  SPEAKER_02: I don't see any developers out there complaining that they have too many developers and not enough work.
• 3:05
  SPEAKER_02: That just doesn't seem to be the case.
• 3:06
  SPEAKER_02: Instead, what happens is you have short time frames, you have limited budgets, you have limited time to do things, and you're crunching to get as much as possible done in as short a time as possible because you just don't have the resources to do everything you want to do.
• 3:24
  SPEAKER_02: So with that, things get missed.
• 3:28
  SPEAKER_02: And yeah, that can happen.
• 3:29
  SPEAKER_02: That easily can happen.
• 3:31
  SPEAKER_02: And what can happen then is there's vulnerabilities that you didn't notice because your team is only however big your team is as compared to the rest of the world.
• 3:42
  SPEAKER_02: So there's a lot less eyes on that code.
• 3:47
  SPEAKER_02: But it's also true that it's harder to find bugs to exploit in a black box.
• 3:53
  SPEAKER_02: So there is kind of that balance too.
• 3:55
  SPEAKER_02: There is something called obfuscation where you kind of hide something because it's obscure.
• 4:03
  SPEAKER_02: So there's some benefit there.
• 4:06
  SPEAKER_02: But there's kind of a a weighted reality here, right?
• 4:09
  SPEAKER_02: So the reality is just because the code is closed sourced doesn't mean people haven't reviewed it, too.
• 4:15
  SPEAKER_02: It may have been reviewed by a third-party company, it may have been reviewed by really good developers.
• 4:21
  SPEAKER_02: And just because it's open doesn't mean that people have reviewed it.
• 4:27
  SPEAKER_02: So software, regardless of open or closed source, is vulnerable.
• 4:32
  SPEAKER_02: That's something you have to remember is that it does not matter if it's open source or closed source, it is potentially vulnerable to, well, they're all vulnerable.
• 4:42
  SPEAKER_02: They're all vulnerable to exploits because we just don't know all the exploits and we don't know every possibility, and there's always going to be bugs they find in software.
• 4:53
  SPEAKER_02: So everything is vulnerable.
• 4:55
  SPEAKER_02: And that includes, by the way, you're talking about third-party resources.
• 5:00
  SPEAKER_02: So should I use this third-party library because it's open source or this other one because it's closed source?
• 5:05
  SPEAKER_02: Well, your code too is vulnerable.
• 5:09
  SPEAKER_02: So we can't just look at somebody else and say, hey, you gotta make sure that yours is a locked vault without also looking at yours and talking about yours being a locked vault.
• 5:19
  SPEAKER_02: Because often what happens is people say, I need to work with only open source because only open source is secure enough.
• 5:28
  SPEAKER_02: I'm gonna put it in my closed source application.
• 5:32
  SPEAKER_02: Well, yeah, but I I don't want to give away my company secrets and my company.
• 5:37
  SPEAKER_02: So you're creating a black box and saying, but I don't want to use anybody else's black box.
• 5:42
  SPEAKER_02: There's a little bit of a double standard there, right?
• 5:46
  SPEAKER_02: So basing your security strategy on hope that a faceless group of people will do a security audit for you, that's a bad idea.
• 5:56
  SPEAKER_02: Basing your security strategy on hope that you did it right is a bad idea.
• 6:01
  SPEAKER_02: Hope in general is not a security strategy.
• 6:05
  SPEAKER_02: So what you want to do is you want to have more of an actual plan for how to make your application secure, not just say, oh, well, open source is more secure.
• 6:18
  SPEAKER_02: Now, there is one big exception to all of this, and that is authentication and encryption.
• 6:25
  SPEAKER_02: So kind of like two exceptions.
• 6:28
  SPEAKER_02: I really prefer to see authentication systems and encryption systems be open source.
• 6:35
  SPEAKER_02: They greatly benefit from being open source.
• 6:38
  SPEAKER_02: The incentives are there for the right people to validate and test for bugs and exploits.
• 6:45
  SPEAKER_02: Plus, there's not a ton of them, and so it makes it a more manageable task.
• 6:50
  SPEAKER_02: I mean, you think about it, how many resources are out there, third-party dependencies that your application can take?
• 6:56
  SPEAKER_02: Let's just say just in C, if you want to look, go to NuGet and just start scrolling.
• 7:02
  SPEAKER_02: Don't filter it, just start scrolling.
• 7:04
  SPEAKER_02: You'll be there forever because there are millions of resources out there.
• 7:10
  SPEAKER_02: So trying to expect that even the ones that, even the millions that are open source, expecting that they will be reviewed by somebody, it's not going to happen necessarily.
• 7:22
  SPEAKER_02: But there are certain things that are more reviewed.
• 7:26
  SPEAKER_02: And authentication and encryption are two of those things that are more likely to be reviewed.
• 7:31
  SPEAKER_02: And you can even look and say, hey, who has reviewed this and what they find?
• 7:38
  SPEAKER_02: So there's pluses and minuses to open source.
• 7:43
  SPEAKER_02: Okay, it can be reviewed, but it's also easier to exploit because it's all right there.
• 7:49
  SPEAKER_02: You can you can look at all the code.
• 7:51
  SPEAKER_02: Now, on the other side of it, closed source, it's a little harder to exploit because it's a little bit of a black box, although again, you can decrypt and well, they can then obfuscate and there's a whole bunch of dance you can go around there.
• 8:04
  SPEAKER_02: But closed source, you know, that's reviewed by less people, probably.
• 8:09
  SPEAKER_02: Which means that it's probably possible to have more bugs in there.
• 8:15
  SPEAKER_02: Again, who wrote the code?
• 8:17
  SPEAKER_02: Is it great developers who have a great review team?
• 8:20
  SPEAKER_02: Well, that's less likely to have bugs versus sloppy developers with a sloppy review team.
• 8:26
  SPEAKER_02: Okay, even though the sloppy ones are open source.
• 8:30
  SPEAKER_02: So there's really a balance here.
• 8:32
  SPEAKER_02: So, number one conclusion we can reach from all of this, don't make a decision about security based solely on whether the software is open or closed source.
• 8:44
  SPEAKER_02: That's foolish.
• 8:45
  SPEAKER_02: It really is.
• 8:46
  SPEAKER_02: Because just saying it's open source does not convey any additional security.
• 8:54
  SPEAKER_02: Now, you could say, well, we can review it.
• 8:57
  SPEAKER_02: Great.
• 8:58
  SPEAKER_02: Have you?
• 8:59
  SPEAKER_02: Have you really?
• 9:01
  SPEAKER_02: Or have you just said we could?
• 9:03
  SPEAKER_02: Have you just browsed through a few of the files, or do you actually do a real security review?
• 9:08
  SPEAKER_02: Have you broken it down and trying to find every potential way of getting around it?
• 9:14
  SPEAKER_02: You probably just looked at the code.
• 9:16
  SPEAKER_02: And maybe not even that.
• 9:18
  SPEAKER_02: So be careful of that.
• 9:20
  SPEAKER_02: Be careful of any dependency that you take on.
• 9:24
  SPEAKER_02: It doesn't matter if it's open source or closed source.
• 9:26
  SPEAKER_02: The more dependencies you have, the the broader your attack surface can be.
• 9:32
  SPEAKER_02: This is um something that you be very careful of, is just taking dependencies because it's easier.
• 9:39
  SPEAKER_02: You know, for a long time, the entire industry for JavaScript depend on a little left pad library.
• 9:47
  SPEAKER_02: All it did is do left pad strings.
• 9:51
  SPEAKER_02: But since everyone depended on it, then there was tens of thousands of libraries that depend on that one little library.
• 10:01
  SPEAKER_02: And that library had an exploit at one point.
• 10:04
  SPEAKER_02: Well, there's a problem, and it brings down a whole bunch of our libraries.
• 10:10
  SPEAKER_02: So that's a problem.
• 10:13
  SPEAKER_02: Now, number three, evaluate every dependency on a case-by-case basis rather than on a blanket policy.
• 10:22
  SPEAKER_02: So instead of saying, hey, you know what, we're gonna say all open source is okay.
• 10:26
  SPEAKER_02: Or here's another one I find a lot.
• 10:28
  SPEAKER_02: We're gonna say everything from Microsoft is okay, but nobody else.
• 10:33
  SPEAKER_02: Why?
• 10:34
  SPEAKER_02: I mean, I trust Microsoft for the most part.
• 10:37
  SPEAKER_02: Um, and I don't think they're gonna do anything to exploit us, and I think that they are reviewing our code, and I think they do have great developers that are working on it.
• 10:45
  SPEAKER_02: So, you know, it's a reasonable assumption, but just saying that everything from Microsoft's okay, that's not okay.
• 10:51
  SPEAKER_02: And saying nothing from anybody else is okay, also not okay.
• 10:56
  SPEAKER_02: That's not a that's not a wise thing to do.
• 10:58
  SPEAKER_02: So having a blanket policy is unwise.
• 11:02
  SPEAKER_02: You need to evaluate every dependency on a case-by-case basis.
• 11:07
  SPEAKER_02: Yes, that means it's going to take more time to evaluate your dependencies.
• 11:12
  SPEAKER_02: Good.
• 11:13
  SPEAKER_02: Because you want to do that.
• 11:15
  SPEAKER_02: You want to make adding dependencies a little tough, a little painful.
• 11:20
  SPEAKER_02: Because if it's super easy, you just say, well, I'll just do this, I'll just do that, I'll just do this.
• 11:26
  SPEAKER_02: As opposed to, ooh, I got to do some work on this.
• 11:29
  SPEAKER_02: Maybe I just need two methods and I could just write those myself.
• 11:34
  SPEAKER_02: Well, great.
• 11:35
  SPEAKER_02: Write those two methods because that's a whole lot better than taking a dependency.
• 11:40
  SPEAKER_02: It's gonna make your upgrade process easier too.
• 11:43
  SPEAKER_02: All right, number four, understand that all of software development is risk management.
• 11:52
  SPEAKER_02: So even your own software increases your risk.
• 11:57
  SPEAKER_02: So if you think of it as we're secure, we need to make sure everybody else is secure, that's not great.
• 12:04
  SPEAKER_02: If you think we've got to make sure that everything is secure, great.
• 12:09
  SPEAKER_02: You've made a step in the right direction.
• 12:12
  SPEAKER_02: If you're evaluating your software as strictly as you're evaluating everybody else's, that's a really good thing.
• 12:18
  SPEAKER_02: If you're taking your code on a case-by-case basis rather than just doing a rubber stamp check mark for every pull request, that's a good thing.
• 12:28
  SPEAKER_02: So making sure that you manage your risk.
• 12:32
  SPEAKER_02: You will always have risk when you write software.
• 12:35
  SPEAKER_02: Whenever you almost every piece of software in the world deals with data.
• 12:41
  SPEAKER_02: And for most companies, that data is their lifeblood.
• 12:45
  SPEAKER_02: So when you write software, you'll be directly interacting with the most vital part of your company.
• 12:55
  SPEAKER_02: That's a scary proposition.
• 12:56
  SPEAKER_02: And it's something you need to treat very, very seriously.
• 12:59
  SPEAKER_02: And so you need to be thinking about what your code does as well and making sure that you aren't doing something to make your code more vulnerable.
• 13:07
  SPEAKER_02: I've seen lots of people who have left their database vulnerable with their code and then been overly cautious about somebody else's code.
• 13:15
  SPEAKER_02: So make sure that you're working through that and balancing checking somebody else as well as checking yourself, making sure that you're doing a lot of reviews because it's all about risk management and allowing no risk in one area, but doing nothing to mitigate risk somewhere else is just unwise.
• 13:35
  SPEAKER_02: Okay, so those are my thoughts.
• 13:37
  SPEAKER_02: I hope that's helpful.
• 13:38
  SPEAKER_02: Thanks for listening.
• 13:39
  SPEAKER_02: And as always, I am Tim Corey.
• 13:41
  SPEAKER_01: Thank you for joining us for this episode of Def Questions.
• 13:44
  SPEAKER_01: Tim is committed to making it easier for you to become a developer.
• 13:48
  SPEAKER_01: If you would like to help make more content like this possible, please like, subscribe, rate, and share Deaf Questions.
• 13:55
  SPEAKER_01: You can also send your questions to questions at IamTimcorey.com.
• 14:00
  SPEAKER_01: Until next time, remember, you are too smart and your time too valuable to waste it making all the mistakes Tim did.
• 14:07
  SPEAKER_01: When you're ready to learn to think and code like a professional developer, head over to imtimcore.com and enroll in a course.