Open-source crypto is no better than closed-source crypto

Re:Open-source crypto is no better than closed-source crypto by hyperman1 on Thursday October 04, 2018 @04:23PM (#18143335)

This is a strange way of thinking:

  For this kind of bug, OSS doesn’t necessarily win, when 82% of projects on Github have fewer
  than 45 stars (a figure I just made up, but you get the idea).

It is true, but also irrelevant. Most OSS are orphaned hobby projects, and that's what he sees here. But when comparing to CSS, the relevant OSS is the small parts of it that has users, builds a community, etc.. For these projects, Linus' law is a serious win for OSS. This won't help the last category of hard bugs, but is a great booster for OSS that' missing from CSS.

He's probably dead right about the hard bugs, BTW

Additionally, OSS has another less visible bonus: Everybody tests their tooling on OSS simply because they can. If you write something like AFL, coverity, ... , you load tons of code from github and see how your tool behaves on it. Then you write a blog post with your great results. So you either have to file bugs against the OSS projects you scanned, or the community will think yo're an asshole.

On the other hand, CSS has a less visible malus: The horrible quality of in-house tooling at governments, banks, etc...

I've seen a case where a government Architect decided to encrypt every person's personal data with AES, using the birth date + a few extra digits as password, and write this in a spec posted on their site. An auditor saw AES and declared the protocol secure enough for transport over the public Internet. It took most of a year before our team got through to him that this amounts to about 20 bits of key space, i.e. brute force-able in a few minutes on a phone with its some interpreted language, live coded before his eyes in a meeting. (He then decided to pad the key with zeros until he got it to 256 bits. For some reason you're not allowed to whack government officials with their own spec, even when their IQ is below that of an average doorknob. But after long meetings we eventually got to a minimally sane encryption). And we were the only organization that 'caused so much trouble', the others either didn't understand the issue or simply didn't care.

I am really really really scared about the security of anything governemental now.

[ Parent | on HN ]

Re:Open-source crypto is no better than closed-source crypto by dejaime on Saturday October 06, 2018 @01:51PM (#18156345)

I would say he misses a big point on the hard bugs though. Saying something is proprietary does not mean it makes enough money to hire such high caliber professionals, on the contrary.

I have worked with a lot of extremely competent developers on open source, but my experience with proprietary software was quite the opposite: professionals are untrained (to the point where they can't even use versioning properly) and would be incapable of finding such bugs anyway.

Now assuming that a proprietary cryptocurrency has the resources to hire a respectable audit firm... it is more far fetched than assuming that such star developers will just work on an open source one for fun.

[ Parent | on HN ]