Open source is a term used for software whose source code is made available. Software distributed under Open source license allow the users to study, debug and improve the software with certain rights preserved for the copyright holder.
6
votes
3answers
189 views
I work on an open source project. Is there a “standard” to reporting security vulnerabilities that we can use?
I work on an (intentionally undisclosed) open source project. To the best of my knowledge, we do not have a discoverable policy on reporting security vulnerabilities.
Rails has their own policy ...
5
votes
2answers
123 views
What are good free opensource tools for helping in manual source code reviews? [closed]
I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
1
vote
2answers
403 views
Are there any free static analysis tools for C# / .NET code
A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
2
votes
5answers
185 views
Website vulnerability scanner in Java && Open Source
I am working on a Web platform that must-need-should have a good level of security.
Therefore, I am interested in a good quality tool to test my Web platform QA on security.
My main programming ...
2
votes
1answer
127 views
How much are security tools audited?
Just an open question to the security community at large because... well... the phpMyAdmin thing has made me more paranoid than usual...
Specifically, I'm thinking about Kali Linux (ex-BackTrack).
...
2
votes
3answers
74 views
OAuth in open-source plugin
I'm designing an API server and client pair. Typically, I want the client to be in a WordPress plugin. I'd like to use OAuth or something similar to secure the requests. However, as you know, OAuth ...
7
votes
3answers
221 views
Is it safer to compile open source code vs simply running the binary?
I understand that with OpenSource software, my milage may vary based on the trust of the author and the distribution platform they use (Codeplex, Git, or private server).
Oftentimes a FOSS website ...
2
votes
3answers
110 views
Could I delete .csr files when the key is signed by CA
I'm creating my own openvpn server.
The Certificat authority is located on a separated host.
There is two kind of clients: which that just send a .csr and to which i send the .crt as an answer and ...
4
votes
3answers
151 views
How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?
Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store?
You might for example have an open source ...
2
votes
1answer
167 views
Good tools for reverse engineering colaboratively?
Does anybody know a good set of tools for doing reverse engineering of binaries in a collaborative way?. My original idea is to disassemble a binary, allowing to add information about functions, ...
5
votes
4answers
2k views
How is Tor secure?
If Tor is open source and thus its process of concealing your IP is known, then how does it keep anything secure? Couldn't someone look at the source code and figure out how to reverse the routing ...
3
votes
5answers
482 views
Building a Security Training Simulation environment
My university is keen to build a security training simulation environment/platform and it will be a good learning experience for students. I Googled around to find out how it is built, but I only ...
0
votes
2answers
203 views
Any open source software firewall with country based ip blocking feature? [closed]
I am looking for an open source firewall with country based ip blocking feature for Linux OS.
0
votes
0answers
1k views
Open Source (Software Firewall + Unified Threat Management - UTM) for an Linux Dedicated Server Hosting [closed]
I am newbie in managing Linux Dedicated server. I am looking for Best Open source Unified Threat Management solution with Firewall Support and it should need to be managing through an web GUI ...
7
votes
4answers
460 views
Tool for public key cryptography where password is the private key?
Is there any free & open source tool for public key cryptography, where the private key is just a chosen password?
Here is what I need:
I want to make backups every hour using a script
I want ...
27
votes
8answers
1k views
Is it safer to use less heard of software than popular software?
Is it good policy to use non-mainstream applications, or does it depend? For example is it better to use a less popular browser, media player or operating system as it is less likely a target for ...
3
votes
1answer
59 views
Is it more or less secure when an entity shares it's security procedures?
Right now I'm doing a work term through my school and they want me to write a report on something I've worked on. They are really serious about "proprietary reports" and reports requiring destruction ...
1
vote
2answers
110 views
What was done to gain a list of home directory accounts?
Today some sites were defaced in our WHM/cpanel VPS.
I understand that the common cause of this is outdated scripts/plugins/etc.
However as I was checking the file manager of one of the accounts I saw ...
20
votes
5answers
1k views
Open Source vs Closed Source Systems
My understanding is that open source systems are commonly believed to be more secure than closed source systems.
Reasons for taking either approach, or combination of them, include: cultural norms, ...
3
votes
2answers
460 views
failed login attempts analysis
Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same,
the login failure is at windows or unix or mac user authentication ...
12
votes
2answers
6k views
FOSS Enterprise Password Management Solution
Can anyone recommend a F/OSS enterprise password management solution on/around the same level as something like Cyber-Ark?
Specifically, something along the lines of a standard password manager, ...
1
vote
3answers
169 views
Is a web application being built on an open-source platform less secure because it is open-source?
With the recent news that microsoft are releasing the source code for their ASP.NET Web API and web pages 1 I'm wondering,
Does having access to the source code of the underlying libraries a web ...
4
votes
2answers
215 views
Drupal Disputed CVE Five Year Tempest – Open Source Security Shortfall?
Can someone add context to the subject issue? At first glance it appears to me this issue represents a fundamental shortfall in the forces encouraging secure coding in open source development. Is ...
1
vote
1answer
329 views
Open source firewall with multi wan support [closed]
I use smoothwall express and also used IPCop. But now I need to have multi WAN support as I want to use a DSL and Cable internet connection together to increase my speed, specifically upload speed.
...
3
votes
2answers
374 views
How do open source projects handle secure artifacts?
Specifically, how are things like keystores handled, or other items needed to build or run an app?
In my case, I have a Chrome OS app that requires a keystore to build and publish to the Chrome Web ...
6
votes
7answers
704 views
How are open-sourced operating systems and software kept secure?
I have been wondering about his for awhile. I have Linux running on a PC at home. I had a jailbroken iPhone. They both have attributes that make them very attractive, and they are also FREE! But I ...
2
votes
7answers
583 views
Chrome vs Explorer - how to explain in plain words that open-source is better?
Why open-source is better in plain words?
Yesterday I had a talk at a DIY bicycle workshop. There is a PC (running XP) that main application is checking emails (nothing really serious).
I found it ...
4
votes
1answer
2k views
openssl verify signature
For S/MIME, I now know I can verify PKCS#7 detached signatures with:
openssl smime -verify -in detachedsign.pem -content content.txt
But what about non-MIME messages?
So if I sign the message ...
1
vote
1answer
274 views
Is there any way to use Nuget securely?
Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget"
The problem I have is that anyone can pretend to be ...
4
votes
3answers
523 views
Open source web application penetration testing community
I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause ...
10
votes
3answers
199 views
open source software security rating — 3rd-party authority
A client is asking my company to write up internal standards that open source software must meet before we will approve it for use on our workstations. Our policy has always been subjective and hard ...
7
votes
2answers
533 views
Looking for an open risk assessment methodology
I'm looking for a fully open quantitative risk assessment methodology.
Most of the methodologies have usage or licensing restrictions placed upon them.
I define open as methodology covered by ...
4
votes
3answers
354 views
Does (J-)SOX Forbid the Use of Open Source Software?
With Regard to Sarbanes Oxley and particularly The Japanese version thereof: Is it true that in order to comply with (J-)SOX you must have a support contract - and therefore a responsible party - for ...
