Open source is a term used for software whose source code is made available. Software distributed under Open source license allow the users to study, debug and improve the software with certain rights preserved for the copyright holder.

learn more… | top users | synonyms

1
vote
1answer
56 views

Making an encrypted SMS app (Android) [closed]

From my limited googling I've noticed that a lot of the mainstream encrypted messaging apps all are either (or a combination of!) closed-source, run through an uncontrolled third-party server, use a ...
5
votes
1answer
81 views

Is the OpenPGP implementation of the YubiKey 4 Open Source?

Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
1
vote
1answer
56 views

Can open source software be digitally signed?

I've read that installing Linux on UEFI PCs requires additional steps to disable the requirement for digitally signed bootloaders. But I thought that open source software can be digitally signed by ...
0
votes
2answers
105 views

Is open source a good option for cryptography libraries? [closed]

I am trying to find good cryptography library to use with my project. I found open source options like openSSL and many more and also proprietory options like Intel Integrated Performance Primitives ...
6
votes
3answers
594 views

Making database code open source

I am building a web app. It is currently not open source, but I am considering making it open source, so that others can fix bugs, improve it, so that others are not suspicious of my motives (fun to ...
1
vote
2answers
62 views

Is the Linux / Debian software and package-management ecosystem secure?

My basic question is this: When we are using the Linux / Debian apt-get or yum package system, we're placing a lot of faith in that the packages we're downloading and installing are secure. For that ...
2
votes
1answer
69 views

What is the benefit of using lastpass authenticator on android compared to other similar applications?

Lastpass recently (march 2016) released a new app called lastpass authenticator. Reading their blog post and the description of the app features, it looks like to me that the app does nothing more ...
26
votes
11answers
4k views

What is the point of using an open source and secure OS if you are running it on a machine with closed source firmware?

I'm very interested in the OpenBSD OS, as it currently seems to me to be the option that takes security more seriously than its contemporaries. But as I was reading about it, it occurred to me that ...
6
votes
3answers
283 views

How much can we trust open source implementations of crypto (security) libraries?

In one of my projects I was choosing bcrypt or PBKDF2 for the KDF for passwords. I have read that bcrypt is generally more advanced and scrypt is even better. But I am using .NET platform where ...
1
vote
1answer
70 views

How to check third party code for Security? [closed]

This may be a very broad question. I am a software developer and from time to time we use third party components which may / may not be secure. Are there any basic things that I should check the ...
9
votes
1answer
5k views

What is real-world impact of CVE-2016-0728 (Linux Kernel Vulnerability)

Today emerged report about another serious vulnerability in opensource world, CVE-2016-0728. It is local privilege escalation in Linux kernel 3.8+. What are the the possible real-world exploitation, ...
1
vote
1answer
87 views

Opensource firmware for WiFi router

I have two routers from D-link which are DIR615 and 2750U. Both of the firmware are upgraded to latest versions. They don't have bandwidth control. Found there are lots of opensource firmware ...
-2
votes
1answer
104 views

Web application security vulnerability managment [closed]

Does anyone know of a way to manage Web application security vulnerabilities? Im looking for a tool that might integrate with selenium and or burp. I'm want to be able to run the tests over and over. ...
2
votes
2answers
67 views

Security updates FOSS/upstream policies: how are they chosen?

As you might know, with PEP 476, since Python 3.5 (backported to 3.4.3 and 2.7.9) tls certificates are now checked for their validity. Lack of validation leaves software exposed to mitm, so I think ...
1
vote
2answers
191 views

Way to find security bugs in Scala source code open-source way?

I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others ...
0
votes
0answers
114 views

Unable to do transformation of findbugs xml reports due to integration issue with findsecbugs plugin

I am trying to integrate the find-security-bugs plugin for findbugs using maven. I am able to run findbugs with maven and perform transformation from xml to html without any issue. I am able to run ...
1
vote
0answers
124 views

Findbugs Source Code Analyzer not able to detect vulnerabilities in JSP file?

I am using FindBugs to do source code analysis along with Find Security Bugs plugin to specifically detect security vulnerabilities like SQL Injection, XSS, etc. I installed the FindBugs plugin for ...
0
votes
1answer
79 views

Having trouble with FindBugs exclude filter

I installed FindBugs plugin in Eclipse for Source Code Analysis with FindSecurityBugs plugin to find out security issues with the code. I want to filter out certain false positives and want to exclude ...
2
votes
0answers
375 views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
5
votes
1answer
54 views

Quantitative Security Analysis of Open Source Repos like CRAN and NPM

Is anyone aware of any quantitative analysis or research on the security of CRAN or NPM? e.g. How much malware is hosted, rate of compromise, speed to close, number of attack vectors, CERT reports ...
3
votes
1answer
39 views

Solution for Enterprise SW Eng. with Github and NPM [closed]

Can anyone share an architecture or framework that supports the use of Open Source software in enterprise software development environments? I'm seeking solutions to manage and mitigate the risk of ...
7
votes
2answers
71 views

Searching vulnerabilities via similar code comparison. Is it a viable attack vector?

Consider the following scenario: the attacker scans (optimally automatically) open codebases (eg. GitHub) for vulnerable code fragments by checking bug reports and patches. the attacker scans for ...
0
votes
1answer
38 views

Can you give third-parties the power to supervise what code your server is running?

Web applications on servers often perform tasks in which users have to trust them, e.g. securely storing their passwords. Is there any way of letting the user convince himself that the server is ...
0
votes
1answer
237 views

What is a Truecrypt alternative with deniable encryption for linux? [closed]

Preferably an alternative that is Free Liberating Open-Source Software/ FLOSS. I would have used Truecrypt, but it has been discontinued.
2
votes
3answers
223 views

Browser as Honey-Pot, is there?

I'm watching all this movement around Metasploit project, the great number of different exploitation plugins, and thousands of exploit packs. Now, it is real truth, anyone could configure his own ...
1
vote
0answers
73 views

Open Source Software & Android Malware Campaigns [closed]

I am looking to find a report that lists malware campaigns launched against Open Source Software (OSS) and/or Android OS. Ideally, this report would have been published in 2014. I am trying to ...
1
vote
1answer
90 views

Penetration testing approach - Is there a better method? [closed]

Currently looking at getting some of our web sites pen tested but there are some many companies offering the same, and who are probably using the same tools (not to mention the same wordpress layouts) ...
-2
votes
1answer
160 views

Government policy toward open source software? [closed]

What are the government policies, specially security organizations, regarding open source? Are they using these types of software? Also, there are some papers related to this topic? I have found: ...
2
votes
0answers
243 views

Open source database of malware signatures [closed]

I'm looking for an open source database of malware signatures/hashes (if possible regularly updated and well documented) that I could use in one of my software for scanning a huge numbers of files ...
0
votes
1answer
69 views

What should I do if I get no response from a security mailing list I reported a vulneratility to?

Two weeks ago I reported a vulnerability to a security mailing list of a large open source software organization. I provided details of how to reproduce the issue and the exact place in the code where ...
1
vote
1answer
61 views

Can a compromised OpenSSHD server be used to upload a malicious payload to a client?

Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
3
votes
4answers
2k views

Is it secure to have source code for website public? [duplicate]

I am working on a website and would like to have it under revision control. I have used git for earlier projects before and I like it. This project though is a website written in Django. I am totally ...
0
votes
2answers
49 views

To release as Open Source for Audit or to Keep “in house”

For cryptography, it is considered good practice to release the code so others can audit it...is this also true for penetration testing software?
2
votes
0answers
432 views

Fosshub as an alternative to sourceforge for osx open source project, is it safe to use? [closed]

I want to download a well known open source app for OSX (security/encryption related), but I don't want to use Sourceforge for my download because I'm worried about malware. This is the second time ...
2
votes
2answers
157 views

Is it possible for an open-source website be secure?

Lets say I want to develop a website with a community, and so I want it to be open source. However, this website isn't going to be static. However, it seems that revealing the database connections ...
0
votes
1answer
143 views

Is there vulnerabilities that are inherent to the concept of an open source antivirus? [closed]

I read that antivirus opensource software would be a good idea since the database could be informed and mainained by lots of capable people. However I have also read arguments to the contrary but none ...
1
vote
0answers
17 views

Get information about the audit state of software (for OSS)?

How does one go about to determine how well audited/checked a software is? To make this a much more specific question I am interested in ways to ascertain (mailing lists, rankings etc.) that a ...
-1
votes
2answers
404 views

Open Source Malware Scanner/Cleaner [closed]

What is the best Open Source Malware Scanner/Cleaner? Malware-bites is good but it requires licensing for companies.
-1
votes
4answers
191 views

How secure is it to use an open-source software [closed]

Is it possible for the developer of an open-source software to hide a backdoor without getting caught? Obviously open-source is superior to close-source when it comes to transparency, also I am aware ...
31
votes
0answers
2k views

Can you prove that an open source program is running the same code that it claims to be? [duplicate]

So if a group has made open source software, and the source code is available on github, and is bundled with an executable in their main download, can it be proven that the executable is compiled from ...
1
vote
3answers
124 views

Simplifying SMIME by re-using the Public & Private key across email accounts

I need to simplify (at the cost of security features) an SMIME deployment. How can I generate a CSR that reuses the same public and private key for more than one email address? In other words, I ...
0
votes
1answer
98 views

How can I prove to users of the software that the binaries I post match source code that's been inspected and verified by a third party? [duplicate]

If I have software that's like TrueCrypt where security is very important, but unlike TrueCrypt because mine won't mysteriously go offline for seemingly no reason at all, how can I prove that my ...
13
votes
3answers
900 views

What are the security implications of 'open-source' vs. 'source-available'?

In light of the current fiasco surrounding TrueCrypt, I have received considerable criticism from current clients and peers in the IT industry for my continued support of the open-source model. Such ...
1
vote
2answers
184 views

Open Source OS - code you see vs code you get

In this question I will use the example of Linux OS, but I am also interested in general situation. Linux OS distributions are famous for being open source and thus rather secure. But how can you be ...
1
vote
2answers
445 views

Static code analysis strategies [closed]

Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case? For example: We know ...
-1
votes
1answer
48 views

OpenSource considered harmfull?

What would you think about military strategist who is publishing full plans for all of important infrastructure? I think that person will be stupid. Can be this analogy case with OpenSource? Here is ...
2
votes
2answers
122 views

Risks associated with compiling open source projects

After reading this question about if it's safer to download and compile the source for an open source project or download and run the installer, I thought of another possible vulnerability: is it ...
0
votes
3answers
175 views

What can I do to increase security of a small open source application [on hold]

I've been developing a small CRUDish Ruby on Rails application on my free time for a non-profit organization. The app is already running in a small scale in Heroku. Lately I've been thinking about ...
5
votes
4answers
918 views

Is compiling source code from github a big security risk?

I have several programs (Emacs el-get, oh-my-zsh and Homebrew) that occasionally load source code from github and compile it on my machine. Is this a big security concern? What can I do to prevent ...
5
votes
2answers
4k views

How secure is EncFS compared to TrueCrypt?

If I choose the paranoia option for EncFS and for TrueCrypt I create containers using the encryption algorithm AES-Twofish-Serpent and the Hash Algorithm Whirlpool. Are both methods equally secure, ...