Open source is a term used for software whose source code is made available. Software distributed under Open source license allow the users to study, debug and improve the software with certain rights preserved for the copyright holder.

learn more… | top users | synonyms

6
votes
3answers
207 views

How much can we trust open source implementations of crypto (security) libraries?

In one of my projects I was choosing bcrypt or PBKDF2 for the KDF for passwords. I have read that bcrypt is generally more advanced and scrypt is even better. But I am using .NET platform where ...
1
vote
1answer
52 views

How to check third party code for Security? [closed]

This may be a very broad question. I am a software developer and from time to time we use third party components which may / may not be secure. Are there any basic things that I should check the ...
9
votes
1answer
4k views

What is real-world impact of CVE-2016-0728 (Linux Kernel Vulnerability)

Today emerged report about another serious vulnerability in opensource world, CVE-2016-0728. It is local privilege escalation in Linux kernel 3.8+. What are the the possible real-world exploitation, ...
1
vote
1answer
52 views

Opensource firmware for WiFi router

I have two routers from D-link which are DIR615 and 2750U. Both of the firmware are upgraded to latest versions. They don't have bandwidth control. Found there are lots of opensource firmware ...
-2
votes
1answer
78 views

Web application security vulnerability managment [closed]

Does anyone know of a way to manage Web application security vulnerabilities? Im looking for a tool that might integrate with selenium and or burp. I'm want to be able to run the tests over and over. ...
2
votes
2answers
36 views

Security updates FOSS/upstream policies: how are they chosen?

As you might know, with PEP 476, since Python 3.5 (backported to 3.4.3 and 2.7.9) tls certificates are now checked for their validity. Lack of validation leaves software exposed to mitm, so I think ...
1
vote
2answers
108 views

Way to find security bugs in Scala source code open-source way?

I looked on Web to find way for finding security bugs specially SQL Injection and XSS in Scala code with little success. Some posts recommended to write custom detectors for FindBugs plugin, others ...
0
votes
0answers
53 views

Unable to do transformation of findbugs xml reports due to integration issue with findsecbugs plugin

I am trying to integrate the find-security-bugs plugin for findbugs using maven. I am able to run findbugs with maven and perform transformation from xml to html without any issue. I am able to run ...
1
vote
0answers
77 views

Findbugs Source Code Analyzer not able to detect vulnerabilities in JSP file?

I am using FindBugs to do source code analysis along with Find Security Bugs plugin to specifically detect security vulnerabilities like SQL Injection, XSS, etc. I installed the FindBugs plugin for ...
0
votes
1answer
43 views

Having trouble with FindBugs exclude filter

I installed FindBugs plugin in Eclipse for Source Code Analysis with FindSecurityBugs plugin to find out security issues with the code. I want to filter out certain false positives and want to exclude ...
2
votes
0answers
183 views

Any worthy open source Java Source Code Analysis tool from finding Security Vulnerabilities perspective? [closed]

I have been breaking my head to find out real good Open-source Source Code Analysis tool which can uncover security vulnerabilities. I did an extensive search on web and found out three major links ...
5
votes
1answer
43 views

Quantitative Security Analysis of Open Source Repos like CRAN and NPM

Is anyone aware of any quantitative analysis or research on the security of CRAN or NPM? e.g. How much malware is hosted, rate of compromise, speed to close, number of attack vectors, CERT reports ...
3
votes
1answer
35 views

Solution for Enterprise SW Eng. with Github and NPM [closed]

Can anyone share an architecture or framework that supports the use of Open Source software in enterprise software development environments? I'm seeking solutions to manage and mitigate the risk of ...
7
votes
2answers
61 views

Searching vulnerabilities via similar code comparison. Is it a viable attack vector?

Consider the following scenario: the attacker scans (optimally automatically) open codebases (eg. GitHub) for vulnerable code fragments by checking bug reports and patches. the attacker scans for ...
0
votes
1answer
37 views

Can you give third-parties the power to supervise what code your server is running?

Web applications on servers often perform tasks in which users have to trust them, e.g. securely storing their passwords. Is there any way of letting the user convince himself that the server is ...
0
votes
1answer
200 views

What is a Truecrypt alternative with deniable encryption for linux? [closed]

Preferably an alternative that is Free Liberating Open-Source Software/ FLOSS. I would have used Truecrypt, but it has been discontinued.
3
votes
3answers
194 views

Browser as Honey-Pot, is there?

I'm watching all this movement around Metasploit project, the great number of different exploitation plugins, and thousands of exploit packs. Now, it is real truth, anyone could configure his own ...
1
vote
0answers
62 views

Open Source Software & Android Malware Campaigns [closed]

I am looking to find a report that lists malware campaigns launched against Open Source Software (OSS) and/or Android OS. Ideally, this report would have been published in 2014. I am trying to ...
1
vote
1answer
83 views

Penetration testing approach - Is there a better method? [closed]

Currently looking at getting some of our web sites pen tested but there are some many companies offering the same, and who are probably using the same tools (not to mention the same wordpress layouts) ...
-2
votes
1answer
148 views

Government policy toward open source software? [closed]

What are the government policies, specially security organizations, regarding open source? Are they using these types of software? Also, there are some papers related to this topic? I have found: ...
0
votes
0answers
18 views

I Use Precompiled Open Source Software. Is There a Backdoor? [duplicate]

I'm new to Linux world (3-4 months with Linux). But I did compile some programs from source and had one failed attempt to compile a custom Linux kernel. One thing that I'm wondering about is the ...
2
votes
0answers
208 views

Open source database of malware signatures [closed]

I'm looking for an open source database of malware signatures/hashes (if possible regularly updated and well documented) that I could use in one of my software for scanning a huge numbers of files ...
0
votes
1answer
67 views

What should I do if I get no response from a security mailing list I reported a vulneratility to?

Two weeks ago I reported a vulnerability to a security mailing list of a large open source software organization. I provided details of how to reproduce the issue and the exact place in the code where ...
1
vote
1answer
58 views

Can a compromised OpenSSHD server be used to upload a malicious payload to a client?

Since I'm fairly unfamiliar with the specific details of the SSH protocol, I was wondering if it was possible for a compromised SSHd server to upload a malicious payload (like a Trojan or some other ...
3
votes
4answers
1k views

Is it secure to have source code for website public? [duplicate]

I am working on a website and would like to have it under revision control. I have used git for earlier projects before and I like it. This project though is a website written in Django. I am totally ...
0
votes
2answers
49 views

To release as Open Source for Audit or to Keep “in house”

For cryptography, it is considered good practice to release the code so others can audit it...is this also true for penetration testing software?
2
votes
0answers
379 views

Fosshub as an alternative to sourceforge for osx open source project, is it safe to use? [closed]

I want to download a well known open source app for OSX (security/encryption related), but I don't want to use Sourceforge for my download because I'm worried about malware. This is the second time ...
2
votes
2answers
130 views

Is it possible for an open-source website be secure?

Lets say I want to develop a website with a community, and so I want it to be open source. However, this website isn't going to be static. However, it seems that revealing the database connections ...
0
votes
1answer
131 views

Is there vulnerabilities that are inherent to the concept of an open source antivirus? [closed]

I read that antivirus opensource software would be a good idea since the database could be informed and mainained by lots of capable people. However I have also read arguments to the contrary but none ...
1
vote
0answers
17 views

Get information about the audit state of software (for OSS)?

How does one go about to determine how well audited/checked a software is? To make this a much more specific question I am interested in ways to ascertain (mailing lists, rankings etc.) that a ...
-1
votes
2answers
351 views

Open Source Malware Scanner/Cleaner [closed]

What is the best Open Source Malware Scanner/Cleaner? Malware-bites is good but it requires licensing for companies.
-1
votes
4answers
169 views

How secure is it to use an open-source software [closed]

Is it possible for the developer of an open-source software to hide a backdoor without getting caught? Obviously open-source is superior to close-source when it comes to transparency, also I am aware ...
31
votes
0answers
2k views

Can you prove that an open source program is running the same code that it claims to be? [duplicate]

So if a group has made open source software, and the source code is available on github, and is bundled with an executable in their main download, can it be proven that the executable is compiled from ...
1
vote
3answers
116 views

Simplifying SMIME by re-using the Public & Private key across email accounts

I need to simplify (at the cost of security features) an SMIME deployment. How can I generate a CSR that reuses the same public and private key for more than one email address? In other words, I ...
0
votes
1answer
90 views

How can I prove to users of the software that the binaries I post match source code that's been inspected and verified by a third party? [duplicate]

If I have software that's like TrueCrypt where security is very important, but unlike TrueCrypt because mine won't mysteriously go offline for seemingly no reason at all, how can I prove that my ...
13
votes
3answers
881 views

What are the security implications of 'open-source' vs. 'source-available'?

In light of the current fiasco surrounding TrueCrypt, I have received considerable criticism from current clients and peers in the IT industry for my continued support of the open-source model. Such ...
1
vote
2answers
179 views

Open Source OS - code you see vs code you get

In this question I will use the example of Linux OS, but I am also interested in general situation. Linux OS distributions are famous for being open source and thus rather secure. But how can you be ...
1
vote
2answers
378 views

Static code analysis strategies [closed]

Imagine: We have been given the source code of several software programs, some open source, others proprietary. What's the best strategy to analyze the source code in each case? For example: We know ...
-1
votes
1answer
45 views

OpenSource considered harmfull?

What would you think about military strategist who is publishing full plans for all of important infrastructure? I think that person will be stupid. Can be this analogy case with OpenSource? Here is ...
2
votes
2answers
117 views

Risks associated with compiling open source projects

After reading this question about if it's safer to download and compile the source for an open source project or download and run the installer, I thought of another possible vulnerability: is it ...
1
vote
2answers
143 views

What can I do to increase security of a small open source application

I've been developing a small CRUDish Ruby on Rails application on my free time for a non-profit organization. The app is already running in a small scale in Heroku. Lately I've been thinking about ...
5
votes
4answers
769 views

Is compiling source code from github a big security risk?

I have several programs (Emacs el-get, oh-my-zsh and Homebrew) that occasionally load source code from github and compile it on my machine. Is this a big security concern? What can I do to prevent ...
5
votes
2answers
4k views

How secure is EncFS compared to TrueCrypt?

If I choose the paranoia option for EncFS and for TrueCrypt I create containers using the encryption algorithm AES-Twofish-Serpent and the Hash Algorithm Whirlpool. Are both methods equally secure, ...
11
votes
3answers
2k views

Security related code in Open Source projects?

I have recently heard that most of the PHP code is confidential, because if attackers know your database structure or the hash function used to encrypt the passwords, there is higher chances of a ...
3
votes
1answer
455 views

Is it bad practice to add an encrypted private key to source control?

I understand that it is bad practice to add passwords and secret tokens to source control, with obvious implications arising if you are working on an open-source or related project. Rather, you ...
2
votes
1answer
279 views

Use of openssl could be a weak point in an Android App?

I'm reviewing an Android app (consists of Java and C source). There are complicated obfuscation steps in the build process (for content protection). But it uses statically linked openssl library ...
9
votes
4answers
195 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
0
votes
3answers
316 views

How to store user credentials like Mint.com [duplicate]

If you have a website that need to store user's credentials for other sites, how do you store those credentials securely? An example is Mint.com where you give them your username/password for your ...
12
votes
3answers
8k views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
0
votes
1answer
887 views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...