Is Foss really safe?

Submitted ⁨⁨1⁩ ⁨year⁩ ago⁩ by ⁨Socialphilosopher@lemm.ee⁩ to ⁨nostupidquestions@lemmy.world⁩

I’m note a programmer. I Don’t Understand Codes. How do I Know If An Open Source Application is not Stealing My Data Or Passwords? Google play store is scanning apps. It says it blocks spyware. Unfortunately, we know that it was not very successful. So, can we trust open source software? Can’t someone integrate their own virus just because the code is open?

source

Comments

Sort:hotnew top

moobythegoldensock@geddit.social ⁨1⁩ ⁨year⁩ ago
How do you know if a closed source application is stealing your data?

With open source, you can learn to read it, or talk to a community of people who know how to read it. If even just 1 in 500 people who downloads the software looks at the source, there are external eyes on it. Whereas with closed source, no one but the creator is looking.

Biggest thing is to still only install software you trust.

source
CthulhuDreamer@lemmy.world ⁨1⁩ ⁨year⁩ ago
One more note about safety when it comes to open source or FOSS, is that you should use only the main repository and distributions provided by the official team. Often people clone existing repo, insert malicious code and publish it as their app on play store etc.

source
Whirlybird@aussie.zone ⁨1⁩ ⁨year⁩ ago
No, open source code is no safer than closed source code by default. What it does is gives the opportunity for people to verify that it’s safe, but it doesn’t mean it is safe. Also just because some people have “verified” that it is safe doesn’t mean they didn’t just miss the vulnerabilities or nasty code.

source
- 1847953620@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Software companies are not known for their accountability over hacky code though, foss leads to better quality because it solves the accountability conflict of interest in an efficient way.
  
  source
- GlowHuddy@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Agreed. I’d say with open source it is harder to ‘get away’ with malicious features, since the code is out in the open. I guess if authors were to put those features, open nature of their code also serves as a bit of a deterrent sice there is a much bigger possibility of people finding out compared to closed source. However as you said it is not impossible, especially since not many people look through the code of everything they run. And even then it is not impossible to obfuscate it well enough for it not to be spotted on casual read-through.
  
  source
- RightHandOfIkaros@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Accounts that post “verifying code” can also be sock puppet accounts, so it is always good to double check for yourself if you know the programming language, or check the account history to see if they have verified other software from different writers that aren’t all connected to each other. Nothing sketchier than a verification ring, where accounts all verify for each other.
  
  source
  - pjhenry1216@kbin.social ⁨1⁩ ⁨year⁩ ago
    This is only an issue if it's only been reviewed by one or two coders with zero history on the repo's host. This is rare for anything that is remotely popular.
    
    source
pjhenry1216@kbin.social ⁨1⁩ ⁨year⁩ ago
You mention the Google Play issue. That is an example of a disadvantage of closed source (Android is open, the Google Play Protect is not). Google Play Protect is essentially static code analysis. Think of it almost like antivirus. It tries to look for anomalies in the code itself. But it's not great. It can be tricked. And we don't even know how good it is or what kind of checks it does.

FOSS code has many people looking at it. You can compile it yourself. It's extremely unlikely for something that's remotely popular to have explicitly malicious code in it. Is it impossible? No. But just as you get folks deep diving video game code assets, you get people looking at code of many FOSS projects. Likely because they either want to contribute or make changes.

It comes down to it being easier to find malicious actors in FOSS. Its just more difficult to hide than closed source.

Why would you think closed source is any safer for any of the same reasons but worse? Closed source can just as easily (arguably more easily) steal your info (and many did but bury it in EULAs).

source
- zencat@kbin.social ⁨1⁩ ⁨year⁩ ago
  How come users don't have root access on Android even though Android is open?
  
  source
  - pjhenry1216@kbin.social ⁨1⁩ ⁨year⁩ ago
    Because of the handset makers and wireless carriers (honestly more the latter than the former). It's not because of Google or Android.
    
    source
  - exscape@kbin.social ⁨1⁩ ⁨year⁩ ago
    Most phones use customized versions of Android and decide you shouldn't have root access. It opens up security issues and makes it easier to bypass ads and DRM which they don't like.
    
    You can get it on some phones, including Google's.
    
    source
    -> View More Comments
  - DeRp_DaWg@lemmy.world ⁨1⁩ ⁨year⁩ ago
    Because the vast majority of users does not need root access.
    
    source
    -> View More Comments
Draces@lemm.ee ⁨1⁩ ⁨year⁩ ago
Even cots/non-foss likely uses foss libraries somewhere. Also keep in mind that foss doesn’t mean the software can be changed at any time in the version that gets distributed. There’s usually checks and reviews when someone wants to contribute. A commercial software also isn’t immune to bad actors. I trust a reputable piece of foss far more than a sketchy company’s code

source
rufus@discuss.tchncs.de ⁨1⁩ ⁨year⁩ ago
Depends on the project. Look how many people use it. If it’s a bunch, chances are other people also keep an eye on it. Even better if you get that sofware packaged. That means from the package manager of your linux disteibution or - in your case, using Android - from F-Droid. This way somebody from that theam has a look at it, and F-Droid even strips all those Trackers from Apps. I’d say chances for a virus/spyware getting through the F-Droid process are close to none.

Play Store doesn’t do anything against excessive tracking.

source
- zencat@kbin.social ⁨1⁩ ⁨year⁩ ago
  I'm curious, how does F-Droid detect malicious codes within an app?
  
  source
PM_ME_VINTAGE_30S@lemmy.sdf.org ⁨1⁩ ⁨year⁩ ago
Tl;Dr: you shouldn’t trust anyone or anything blindly or unconditionally. However, open source software and its community offer compelling reasons to trust it over proprietary software.

Technically, if you do not read all of the source code of an application and all its dependencies, you can never be 100% sure that it isn’t doing nefarious things. For things that require a connection to the internet, you could monitor all connections to and from the application and its dependencies and see if it is making objectionable connections.

However, in my view, open-source software is in general safer than closed-source software. Open-source software can be audited by any who knows the languages the program is coded in, whereas closed-source software can only be audited by the developer or the few parties they might authorize to see it. Closed-source apps can easily hide spyware because the source code is completely unavailable. Spyware could possibly be missed by the community, but it’s still a whole hell of a lot less likely to occur with so many eyes on the program.

And practically, whenever an open-source software gets even close to including nefarious stuff, the community generates a huge hoopla about it.

Also, Google Play Store is not open source! A better example would be F-Droid, which is an app store that is open-source. While I am not aware of F-Droid delivering spyware ala Google, it is still theoretically possible that they could screw up or be corrupted in the distant future. Therefore, we must stay vigilant, even with groups and people we trust. Practically, this just means… check their work once in a while. It wouldn’t kill you to learn a programming language; try Python for quick results. What I do is whenever an open-source software is written in a language I understand, I’ll pick a few files that look the most important and skim them to see that the program “does what it says on the tin”. Otherwise, I’ll check through the issues on GitHub for any weirdness.

I haven’t even mentioned free and open-source software (free as in speech). I genuinely do not know how to convince people who are disinterested in their own freedom to consider FOSS options, or to do very nearly anything at all. For everyone else…FOSS software respects your freedom to compute as you please. We can quibble about different licenses and if and how effective they are at safeguarding user freedom, but at the end of the day, FOSS licenses are at least intended to give users back your freedom. In my view, it is mightily refreshing to finally take some freedom back!

source
jesterraiin@lemmy.world ⁨1⁩ ⁨year⁩ ago

Is FOSS really safe?

It’s not an attempt at edginess, but the answer is that in the long run, IT NOTHING is safe. It might be now, it might be for some time, but theres no guarantee that even the most dependable piece of software will get some new update that will break some of its functionality, or the OS will interfere with it, thus breaking it.

FOSS? It’s safe as a principle. If anyone has the access to the code, then any suspicious inclusion to it will be spotted quickly and patched up.

…but the reality isn’t as straightforward.

source
the_kalash@lemmy.world ⁨1⁩ ⁨year⁩ ago
Well, the source code is open, that means everyone can look at the code and check what it does.

source
Amcro@lemm.ee ⁨1⁩ ⁨year⁩ ago
A question i always ask myself is, if we can see code on github for example, it still doesn’t mean their release has the same code right? They could actually compile their program with some extra stuff that sends data and just add that version on github release page, but the code itself would be clean on github right?

source
- Nibodhika@lemmy.world ⁨1⁩ ⁨year⁩ ago
  Yes, however there are ways of verifying that. Compiled programs are not black boxes, they’re just complicated enough that we can consider them beyond human comprehension (at least complicated programs), but they’re very much readable. Which means programs can check differences between what should be there and what is. Not to mention that you can also compile the code they said they put there and check for differences with what they’re distributing.
  
  Is anyone doing that? Don’t know, but because it’s possible to be verified it’s unlikely that people would try to do something nasty.
  
  source
  - zalack@kbin.social ⁨1⁩ ⁨year⁩ ago
    It's worth pointing out that reproducible builds aren't always guaranteed if software developers aren't specifically programming with them in mind.
    
    imagine a program that inserts randomness during compile time for seeds. Reach build would generate a different seed even from the same source code, and would fail being diffed against the actual release.
    
    Or maybe the developer inserts information about the build environment for debugging such as the build time and exact OS version. This would cause verification builds to differ.
    
    Rust (the programing language) has had a long history of working towards reproducible builds for software written in the language, for instance.
    
    source
- crastoman@lemm.ee ⁨1⁩ ⁨year⁩ ago
  Yes you can tamper the executables if it’s you on your pc compiling the code and upload it to the release page…
  
  BUT if you use ci/cd pipelines, you can almost be sure it’s not a human who is in charge of compiling. It’s a robot who automatically clones the repo, launch the build and upload the artifact to release. It’s much more transparent this way
  
  source
moreeni@lemm.ee ⁨1⁩ ⁨year⁩ ago
Here’s an article

source
elxeno@lemm.ee ⁨1⁩ ⁨year⁩ ago
You wouldn’t know unless it’s checked by you or someone you trust, but IMO open source should generally be better cause if you’re doing shady stuff you’re probably less likely to make it public. Also projects with lots of activity by different people are usually safer.

source
Reva@startrek.website ⁨1⁩ ⁨year⁩ ago
Nobody can be 100% sure of some program’s security. However, the fact that anyone can look into the internal workings of a FOSS project means that a lot of people much smarter than you and I have their eyes on every detail of the code at all times. Plus, these projects are maintained by competent people who monitor everything that gets added to it thoroughly, so there is a very little chance of something malicious getting into a major project like that.

In comparison, nobody but the people working at Microsoft knows what Microsoft projects really do, since nobody can look inside. We just have to “trust” them. Which I do not want to do.

source
TheKarion@lemmy.world ⁨1⁩ ⁨year⁩ ago
Would you be comfortable eating food without being able to see the ingredients?

source
BlueEther@no.lastname.nz ⁨1⁩ ⁨year⁩ ago
There are some very good comments here, here are a few to think on:

With FOSS anybody cant just modify the code that you use, say in my lemmy instance. The code I run comes from the dev’s own github account, and they manage the code that comes into the project - this doesn’t mean that the underlying code is immune to bugs any bore than closed platforms though, just that more eyes can look for bugs and exploits

With FOSS I can fork a code base and publish that, like I have done with the Alexandrite UI for lemmy. I could insert password sniffers in that cade, and someone could build from that source - but the code changes that I have made are laid out for any one to look at. Again, it doesn’t mean the base code is any better than closed, just that more eyes can look

source