Open source is a term used for software whose source code is made available. Software distributed under Open source license allow the users to study, debug and improve the software with certain rights preserved for the copyright holder.

learn more… | top users | synonyms

28
votes
8answers
1k views

Is it safer to use less heard of software than popular software?

Is it good policy to use non-mainstream applications, or does it depend? For example is it better to use a less popular browser, media player or operating system as it is less likely a target for ...
25
votes
5answers
2k views

Open Source vs Closed Source Systems

My understanding is that open source systems are commonly believed to be more secure than closed source systems. Reasons for taking either approach, or combination of them, include: cultural norms, ...
15
votes
2answers
8k views

FOSS Enterprise Password Management Solution

Can anyone recommend a F/OSS enterprise password management solution on/around the same level as something like Cyber-Ark? Specifically, something along the lines of a standard password manager, ...
10
votes
3answers
2k views

Security related code in Open Source projects?

I have recently heard that most of the PHP code is confidential, because if attackers know your database structure or the hash function used to encrypt the passwords, there is higher chances of a ...
10
votes
3answers
244 views

open source software security rating — 3rd-party authority

A client is asking my company to write up internal standards that open source software must meet before we will approve it for use on our workstations. Our policy has always been subjective and hard ...
9
votes
7answers
1k views

How are open-sourced operating systems and software kept secure?

I have been wondering about his for awhile. I have Linux running on a PC at home. I had a jailbroken iPhone. They both have attributes that make them very attractive, and they are also FREE! But I ...
7
votes
4answers
6k views

How is Tor secure?

If Tor is open source and thus its process of concealing your IP is known, then how does it keep anything secure? Couldn't someone look at the source code and figure out how to reverse the routing ...
7
votes
3answers
358 views

Is it safer to compile open source code vs simply running the binary?

I understand that with OpenSource software, my milage may vary based on the trust of the author and the distribution platform they use (Codeplex, Git, or private server). Oftentimes a FOSS website ...
7
votes
4answers
1k views

Tool for public key cryptography where password is the private key?

Is there any free & open source tool for public key cryptography, where the private key is just a chosen password? Here is what I need: I want to make backups every hour using a script I want ...
7
votes
2answers
697 views

Looking for an open risk assessment methodology

I'm looking for a fully open quantitative risk assessment methodology. Most of the methodologies have usage or licensing restrictions placed upon them. I define open as methodology covered by ...
6
votes
2answers
882 views

How do open source projects handle secure artifacts?

Specifically, how are things like keystores handled, or other items needed to build or run an app? In my case, I have a Chrome OS app that requires a keystore to build and publish to the Chrome Web ...
6
votes
3answers
300 views

I work on an open source project. Is there a “standard” to reporting security vulnerabilities that we can use?

I work on an (intentionally undisclosed) open source project. To the best of my knowledge, we do not have a discoverable policy on reporting security vulnerabilities. Rails has their own policy ...
6
votes
3answers
168 views

How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?

Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store? You might for example have an open source ...
6
votes
1answer
999 views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
5
votes
3answers
648 views

Open source web application penetration testing community

I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause ...
5
votes
3answers
94 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
5
votes
3answers
166 views

Trust Issues Relative to Open Source

Two separate discussions have very recently opened my eyes to an issue I had not considered – how to confirm the Open Source binary one uses is based on the published source code. There is a large ...
5
votes
2answers
479 views

What are good free opensource tools for helping in manual source code reviews? [closed]

I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
4
votes
3answers
446 views

Does (J-)SOX Forbid the Use of Open Source Software?

With Regard to Sarbanes Oxley and particularly The Japanese version thereof: Is it true that in order to comply with (J-)SOX you must have a support contract - and therefore a responsible party - for ...
4
votes
3answers
144 views

How can you know what is distributed with your Linux

I'm curious, in theory, how can one know if for example kernel that is distributed with Ubuntu Linux is really what is on https://github.com/torvalds/linux and not some modified kernel which contains ...
4
votes
1answer
148 views

auditing open source compiler binaries for trojans

It is a well known vulnerability that a properly altered compiler binary can transfer itself to new binaries of the compiler, and still be entirely absent from the source code. But how real is this ...
4
votes
2answers
285 views

Drupal Disputed CVE Five Year Tempest – Open Source Security Shortfall?

Can someone add context to the subject issue? At first glance it appears to me this issue represents a fundamental shortfall in the forces encouraging secure coding in open source development. Is ...
4
votes
1answer
3k views

openssl verify signature

For S/MIME, I now know I can verify PKCS#7 detached signatures with: openssl smime -verify -in detachedsign.pem -content content.txt But what about non-MIME messages? So if I sign the message ...
3
votes
5answers
1k views

Building a Security Training Simulation environment

My university is keen to build a security training simulation environment/platform and it will be a good learning experience for students. I Googled around to find out how it is built, but I only ...
3
votes
3answers
97 views

Is compiling source code from github a big security risk?

I have several programs (Emacs el-get, oh-my-zsh and Homebrew) that occasionally load source code from github and compile it on my machine. Is this a big security concern? What can I do to prevent ...
3
votes
3answers
146 views

OAuth in open-source plugin

I'm designing an API server and client pair. Typically, I want the client to be in a WordPress plugin. I'd like to use OAuth or something similar to secure the requests. However, as you know, OAuth ...
3
votes
1answer
78 views

Is it more or less secure when an entity shares it's security procedures?

Right now I'm doing a work term through my school and they want me to write a report on something I've worked on. They are really serious about "proprietary reports" and reports requiring destruction ...
3
votes
2answers
575 views

failed login attempts analysis

Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same, the login failure is at windows or unix or mac user authentication ...
2
votes
7answers
727 views

Chrome vs Explorer - how to explain in plain words that open-source is better?

Why open-source is better in plain words? Yesterday I had a talk at a DIY bicycle workshop. There is a PC (running XP) that main application is checking emails (nothing really serious). I found it ...
2
votes
3answers
1k views

Could I delete .csr files when the key is signed by CA

I'm creating my own openvpn server. The Certificat authority is located on a separated host. There is two kind of clients: which that just send a .csr and to which i send the .crt as an answer and ...
2
votes
1answer
214 views

How much are security tools audited?

Just an open question to the security community at large because... well... the phpMyAdmin thing has made me more paranoid than usual... Specifically, I'm thinking about Kali Linux (ex-BackTrack). ...
2
votes
5answers
1k views

Website vulnerability scanner in Java && Open Source

I am working on a Web platform that must-need-should have a good level of security. Therefore, I am interested in a good quality tool to test my Web platform QA on security. My main programming ...
2
votes
2answers
186 views

In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?

I'm looking at the source code of some potentially hostile code. As usual, VS 2012 is giving me the security warning: "You should only open projects from a trustworthy source" ... "ask me for every ...
2
votes
2answers
3k views

Are there any free static analysis tools for C# / .NET code

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
2
votes
1answer
105 views

Use of openssl could be a weak point in an Android App?

I'm reviewing an Android app (consists of Java and C source). There are complicated obfuscation steps in the build process (for content protection). But it uses statically linked openssl library ...
2
votes
1answer
222 views

Good tools for reverse engineering colaboratively?

Does anybody know a good set of tools for doing reverse engineering of binaries in a collaborative way?. My original idea is to disassemble a binary, allowing to add information about functions, ...
1
vote
3answers
202 views

Is a web application being built on an open-source platform less secure because it is open-source?

With the recent news that microsoft are releasing the source code for their ASP.NET Web API and web pages 1 I'm wondering, Does having access to the source code of the underlying libraries a web ...
1
vote
2answers
117 views

What was done to gain a list of home directory accounts?

Today some sites were defaced in our WHM/cpanel VPS. I understand that the common cause of this is outdated scripts/plugins/etc. However as I was checking the file manager of one of the accounts I saw ...
1
vote
2answers
382 views

How secure is EncFS compared to TrueCrypt?

If I choose the paranoia option for EncFS and for TrueCrypt I create containers using the encryption algorithm AES-Twofish-Serpent and the Hash Algorithm Whirlpool. Are both methods equally secure, ...
1
vote
1answer
500 views

Open source firewall with multi wan support [closed]

I use smoothwall express and also used IPCop. But now I need to have multi WAN support as I want to use a DSL and Cable internet connection together to increase my speed, specifically upload speed. ...
1
vote
1answer
431 views

Is there any way to use Nuget securely?

Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget" The problem I have is that anyone can pretend to be ...
1
vote
0answers
41 views

What can I do to increase security of a small open source application

I've been developing a small CRUDish Ruby on Rails application on my free time for a non-profit organization. The app is already running in a small scale in Heroku. Lately I've been thinking about ...
0
votes
2answers
414 views

Any open source software firewall with country based ip blocking feature? [closed]

I am looking for an open source firewall with country based ip blocking feature for Linux OS.
0
votes
1answer
125 views

Allow read-only access to server-side pages for security review?

This answer: http://security.stackexchange.com/a/37319/10574 Mentions the issue of host-based security. To the end user, the web server is an untrustable black box. Would it provide to needed ...
0
votes
1answer
74 views

Is it bad practice to add an encrypted private key to source control?

I understand that it is bad practice to add passwords and secret tokens to source control, with obvious implications arising if you are working on an open-source or related project. Rather, you ...
0
votes
0answers
22 views

Suggestion for developing project that is related to android [on hold]

I want to contribute open source projects for improve my skills. There's not many android open source projects that is related to security. I developed some project but I have no experience with open ...
0
votes
1answer
36 views

Legality of adding malice to an open source software? [closed]

With the heartbleed bug in the news recently and after reading Bruce Schneier's commentary on the issue I started wondering if there would be any legal implications for intentionally adding malice to ...
0
votes
0answers
7 views

Fragroute in Windows 7? [migrated]

Has anyone had any luck running fragroute in windows 7, or is there any other application you can recommend which does the same? I notice that the last compatible windows was 2000 which makes me think ...
0
votes
3answers
192 views

How to store user credentials like Mint.com [duplicate]

If you have a website that need to store user's credentials for other sites, how do you store those credentials securely? An example is Mint.com where you give them your username/password for your ...
0
votes
1answer
63 views

Security principle regarding softwares

Security through obscurity isn't real security. That's why theoretically, closed source software is a wrong solution. A software, example an operating system still needs to be secure when ...