1

I saw a lot of reports identifying security issues in big web applications based on some secret data deposited in Github public repositories.

AFAIK, Github is a repository hosting service in which individuals can publish the code of their tools or projects so others could contribute or get benefit from the source.

But if I have a big company that offers a service via a web application, what's then the purpose of publishing the source code?

closed as off-topic by Steffen Ullrich, Stephane, Tobi Nary, Matthew, Xiong Chiamiov Jan 2 '18 at 17:57

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, Stephane, Tobi Nary, Matthew, Xiong Chiamiov
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    This is basically asking the benefit of open source. I'm not sure this is a security question. – schroeder Jan 1 '18 at 0:56
  • 1
    One of the benefits is that people can review and inform you if there are security problems ... – schroeder Jan 1 '18 at 1:02
  • 1
    @schroeder I think the ease of identifying security problems is a disadvantage, especially that there is no guarantee that the finder will inform the company in question – Reda LM Jan 1 '18 at 1:09
  • 1
    Identifying vulnerabilities can be done regardless of whether or not it is open source. Open source improves the chances that someone will be able to report a vulnerability, by making it easier to analyze the underlying fault. Without the source, you may be able to discover a vulnerability and exploit it, but you won't necessarily be able to tell said company how to fix it. But @schroeder is right, this is basically asking about the difference between closed and open source software. – forest Jan 1 '18 at 1:44
  • the same as for any other type of application: so customers can verify, maintain, and customize. – dandavis Jan 1 '18 at 21:27
2

If I have a big company that sells a product, I might not want to disclose its source because people may just copy it and sell it, thus decreasing my profits.

But if my big company provides a service by means of a Web application, it's very likely that I can publish the source code, because the actual value of my service lies somewhere else (in a large and complex infrastructure, access to databases,...).

What's more, I could actually earn the trust of additional customers by showing them that my code can be audited by lots of people, including the customers themselves. For example, this may show to the customers that my code doesn't store their data in plaintext.

That said, any Web application is extremely likely to contain vulnerabilities that can be found by an attacker, with or without access to the source code. If you don't publish the code (barring bug bounties), the good guys can't disclose vulnerabilities to you. If you do, they can. Of course, bad guys exist in both cases.

Finally, realize the hacking world isn't split in purely good and purely bad guys. Some people want companies, and the whole world, to know they're good at finding vulnerabilities. Perhaps getting their name on a Hall of Fame (that's why bug bounties are good) or on the credits section of a Github repository is enough to satisfy this "need". If you don't publish your code, the only way these people have to get what they want is to attack your application or sell a working exploit against it.

1

Why would code be put on GitHub

GitHub acts as a git hosting provider, by hosting the project on a remote repository you get many benefits, including:

  • All code on the repo is backed up, so disk failure does not lose data
  • Multiple people can work on the repository at once
  • Code reviews can be performed before changes are merged in

Types of GitHub repositories

A repository can be either:

Public

Anyone can read the code and contribute to the code by contributing

Private

Only people invited to access the repo can access it

Why would you want a project open to everyone

As A. Darwin's answer says, opening a project allows code review, and can gain information about exploits before they are used against you.

As per Kerckhoffs's principle, a system should be secure even if the workings are known, so in theory you shouldn't be more vulnerable by releasing your source, if the system is designed well.

How systems get broken by secrets

If your repository is public then secrets should be kept out of it. This allowed as the secrets are allowed by Kerckhoffs's principle. If secrets end up in a public repo, then anyone can use them, causing problems like this:

Dev put AWS keys on Github. Then BAD THINGS happened

Not the answer you're looking for? Browse other questions tagged or ask your own question.