> the software you can't inspect with reasonable effort/time before running

What was the last time you inspected any command or application you executed on your computer?

How would you spot malicious code? Are you a security expert who has knowledge of all of the programming languages that have been used to write the apps you are running?

You have absolutely unrealistic view on this subject. Btw. Apple and many companies have a trivial way of spotting malicious application by simple checksumming the executables.

I'm surprised how this discussion turns out: didn't expect those bits to be controversial at all, and sibling comments make it sound like it's almost better to not have access to sources.

> What was the last time you inspected any command or application you executed on your computer?

A few months ago, and didn't run new code from untrusted sources since.

> How would you spot malicious code? Are you a security expert who has knowledge of all of the programming languages that have been used to write the apps you are running?

So far I haven't run into languages I can't read. Spotting malicious code could indeed be tricky, a subtle but critical vulnerability would easily evade quick skimming, just as malware is still possible even when it comes from a somewhat trusted source. But I'm more certain that a program does what it says it does after skimming its code.

> Apple and many companies have a trivial way of spotting malicious application by simple checksumming the executables.

That's how basic antiviruses work, not specific to Apple. They have to first add that checksum into a database, which isn't viable when we're talking about a small hardware manufacturer shipping their custom software to dozens of clients.

It took only 13 years to spot this in a FOSS project:

https://linux.slashdot.org/story/22/01/25/2259214/major-linu...

>the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious.

And you cannot do that on open source either. Both cases require a chain of trust, and empirically, neither is significantly more secure.

For a whole computer stack, that's true enough.

Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.

> Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.

Case in point, the famous Borland InterBase backdoor that went unnoticed for about 7 years and 3 versions of the software but was discovered in 8 months by one developer after Borland released InterBase as Open Source.

https://www.zdnet.com/article/borland-interbase-backdoor-det...

> Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.

Citation needed.

On the other hand:

https://en.wikipedia.org/wiki/Dual_EC_DRBG

I don't think that's true. Care to pick some metric to check it?

If anything, having source also makes it easier to auto scan for flaws at the source level and find holes.

I know from CVEs that OS projects has a significant number of high profile long standing holes in it.

I think the context somehow gets lost in this discussion. You indeed need a chain of trust in general, and can't inspect all the software alone even if it's FLOSS, but I'm talking about odd specialized programs shipped by hardware manufacturers (like the one TFA talks about) and similar one-off ones that come from an untrusted source: there's no trust there, no reliance on others inspecting it, but if you have the source code, it's often reasonable to read. Also occasionally desirable to fix or otherwise modify, to integrate into your overall system (that's what I tend to do pretty much each time when interacting with such sotfware+hardware, sometimes reverse engineering and reimplementing it, so maybe my view is a bit skewed). So FLOSS is good, closed source and proprietary is less trustworthy and less usable.

>I'm talking about odd specialized programs shipped by hardware manufacturers (like the one TFA talks about

In that case, open source rarely has even one possible replacement, so there's no comparison.

>but if you have the source code, it's often reasonable to read

As someone working in code daily, I disagree. I find lots of open source projects once you get out of the few big ones to be a massive mess of code.

And most programs of much use are simply too big to do any sort of audit. I have lots of friends in open source - I doubt a single one has ever read over the source for an entire program to inspect.

Have you honestly read over an entire open source program to check it? Or is this a myth that gets repeated but no one does it....

As to modification, I've reverse engineered many, many programs to add hooks and interoperability. It's not that terribly difficult once you've done a few and get to know how to do it.

So sure, nice clean code is good. But open source software I find to be crappy for all but the few big uses. GIMP vs photoshop? No real good OS CAD, or finance, or comparing Octave to Mathematica? Buggy video editor of the week to DaVinci Resolve? Tax software? Inkscape vs AI? So as a result of lacking quality in OS, I prefer closed source solutions since paying for them gets me vastly better quality for a lot of things I want software for.

And in the rare case I want to hack something, I still can and do.

Open source is honestly a you-get-what-you-paid-for solution for most stuff.

Sounds like we had quite a different experience, and picturing different things too.

> In that case, open source rarely has even one possible replacement, so there's no comparison.

There's usually just one program shipped by a vendor in these cases, and most of the time it's indeed closed-source -- that's what I started with.

Big and widely used FLOSS projects are far from these programs shipped by small hardware manufacturers, I wasn't talking about those. Just as the established and polished commercial projects are far from those: you're getting some buggy and unsupported programs from unknown hardware vendors, possibly even with malware as in TFA, not Photoshop.

> Have you honestly read over an entire open source program to check it?

I have, pretty sure that many others read those too, but haven't read entire sources of large projects like GIMP; plenty of programs and libraries are just a few KLOC (or even just hundreds of LOC) long, easy to skim.

> As to modification, I've reverse engineered many, many programs to add hooks and interoperability. It's not that terribly difficult once you've done a few and get to know how to do it.

I have rather hard time imagining these being any major modifications and considered easy with arbitrary compiled binaries, while suspecting merely reading sources being something mythical. But once again, you're probably picturing a hairy mess of a huge project's source code, and I picture integration tasks like turning a buggy Windows GUI program into a working multi-threaded Linux daemon -- where having source code makes it easier (and I'm certainly reading at least decompiled code when that's an option), as well as making it practical/easier to see what the program is doing.

Something as small as a few kloc I can reverse back to compilable source in a day, so things that trivially small are not difficult to edit to your hearts content.

Heck, I suspect Ghidra nowadays makes that a single click task.

And if it's that small, it's also trivial to write. I doubt too many companies fret over stuff that small.

Proprietary or open sourced doesn't matter much if you're not verifying the checksums of all the binaries that come per-installed on your system. If the majority of tech savvy people can't be bothered to do it, then average joe is doomed.