This is the big fallacy I see whenever someone uses open source just because the source code is public. Unless you're able to perform a full audit yourself, is it really any better than a closed offering like 1Password?

I suppose the theory is that open source is better (a) because you can audit it if you want to, and (b) it's more likely that someone out there has audited it.

In practice, (a) falls apart if the user doesn't have the knowledge, experience, or time necessary to perform an audit, which is quite likely for security software. And I feel like (b) isn't great either, as there are plenty of examples of major flaws in open source projects that went undetected for long periods - heartbleed is just one example.

I agree with that assessment, but how many vulnerabilities have been found in closed sourced software? If the software is popular enough, someone somewhere is going to find a vulnerability whether it's open or closed source. Look at all of vulnerabilities that Google has found in closed sourced software. It just takes more skill to find vulnerabilities and incentives. The black hats have found vulnerabilities in iOS that Apple still hasn't managed to patch - like the one that lets law enforcement break into a locked iPhone and bypass the fail login attempts.

I think the question is is the likelihood of the party finding the vulnerability being a “good guy” or a “bad guy” different between closed and open source. I’d suspect not, but who knows.

Stuxnet didn’t rely on open source software.

There are major unrevealed flaws in all software more complicated than “hello, world.”

Agree, open source is rights for the users, no matter they have the ability to audit or not.

If it was a matter of OS compatibility, I'd certainly be able to do it for iOS or macOS. Security, less so, but with luck there would be others to do that work, if the app had enough users. Surely it would be better than just implicitly trusting some company with a profit motive?

I'm not expecting anyone to do the work for free, by the way. You could still charge money for cloud sync or even app extensions and still keep the main repo open. Maybe the code could be a few revisions behind to incentivize people to pay.

In any case, from looking around, it seems that KeePass and possibly Bitwarden fit this bill.

Bitwarden has been great for me. After going from LastPass to 1Pass to KeePassXC to Bitwarden, I really appreciate the simplicity of a simple browser extension without the requirement for a local client.

Bitwarden just works and checks the boxes for me. I haven't tried it yet, but there is also a fork [1] that allows us to use our own hosting.

[1] https://github.com/jakeswenson/BitBetter

Of course, the answer to all your questions is "not necessarily". Sure, it's totally possible for people to not audit the code, or let it be abandoned–but open source makes this probability much lower, whereas with closed-source software you have no choice in the matter at all.

I think you’re making a lot of assumptions when assuming the probability is much lower. I’d trust a really proficient small team being paid to produce secure, closed software more than a team of disinterested volunteers. I’d also trust a small group of passionate volunteers over a paid team of crappy engineers. I guess the point is that source being open or not isn’t really the important part, at least in my opinion.