-4

I am a learner of FOSS licensing, security and privacy. I ask this question because one of the arguments persuading users to use or switch to FOSS is the fact that since the code is open, an expert can review the code for security issues and hence FOSS is good for security. However, I had this doubt whether code obfuscation is common in FOSS and whether that would be an impediment while reviewing FOSS source code. Has anyone encountered the issue that I mentioned? Does any of the popular FOSS licenses say anything about code obfuscation explicitly?

  • 3
    Your question might be better received here if you could show examples of FOSS that is only available obfuscated. Otherwise, your question seems redundant. Additionally, asking an open question with "Any thoughts?" usually isn't received well and not a good fit for a Q/A-Site. – Tobi Nary Jun 17 at 6:18
  • Oh, okay.Thanks for your comment. Could you edit the question and make it more relevant? It would be appreciated. – gracedlamb Jun 17 at 6:38
  • Rules for editing do not allow for substantial changes to the original meaning of the question. It'd be best if you edited your question yourself. – Tobi Nary Jun 17 at 7:11
  • 1
    For some FOSS licenses, like the GPL at least, prohibits source code obfuscation. – forest Jun 17 at 7:45
  • I googled your question and got this as the top hit: softwareengineering.stackexchange.com/questions/62885/… and opensource.stackexchange.com/questions/5759/… – schroeder Jun 17 at 9:12
2

...because one of the arguments persuading users to use or switch to FOSS is the fact that since the code is open, an expert can review the code for a security issues and hence FOSS is good for security.

Be aware that being FOSS only allows for the potential scrutiny by experts. Simply being FOSS does not necessarily imply experts have scrutinized it. Obviously, high-profile, popular packages are likely to have been extensively "pulled apart" by experts, but a little-known package (or an obscure fork of a popular package) might never have been "studied", and therefore would come with no "reassurance" about its security.

While there is nothing to stop someone releasing "freely available" code only in obfuscated form, (a) it seems to go against the "point" of making it freely-available if it's hard to read, and (b) as noted by others, some of the more common FOSS licenses/initiatives prohibit releasing source in an obfuscated form1.

As such, if you encounter any software that is "freely available", but only in obfuscated form, I'd assume even less about its security than the most obscure (as in little-used) piece of easy-to-read code. Indeed, the very fact that it was obfuscated would be a considerable red flag.


1 Clause 2 of The Open Source Definition from the Open Source Initiative includes (my emphasis):

2. Source Code

[...] The source code must be the preferred form in which a programmer would modify the program. Deliberately obfuscated source code is not allowed. Intermediate forms such as the output of a preprocessor or translator are not allowed.

While the GPL does not explicitly mention obfuscation, section 1 of the GPL v3 includes:

1. Source Code.

The “source code” for a work means the preferred form of the work for making modifications to it.

and I think you would be hard-pressed to find anyone who prefers editing obfuscated code!

1

In general, security oriented open source software relies on Kerckhoff's Principle.

In short, assume that absolutely nothing is a secret except for the key itself. Any and all attackers should be able to decipher and reason through any attempt to obfuscate your code because, above all, a computer will also need to be able to execute it.

The only strength that a computer has over humans, is its ability to make calculations at a higher rate. They can't guess or infer anything; you have to tell it explicitly how to accomplish every step. You have to put in the steps to de-obfuscate your secrets into the algorithm itself, or the computer can not and will not be able to handle your data.

The very phrase "open source" means that every single instruction to de-obfuscate your secrets is available to everyone who is able to understand it.

So no, obfuscation is not common in software that is licensed under an open source license.

  • Do you have any personal experience of ever coming across obfuscated code in FOSS? – gracedlamb Jun 17 at 6:43
  • @gracedlamb, in open source? No. In proprietary software? Very rarely, in very old software that was barely being maintained, and was planned to be replaced. – Ghedipunk Jun 17 at 7:29
0

I had this doubt whether code obfuscation is common in FOSS

No. The purpose of open-source code is to make the source code available and modifiable by users. Obfuscating code prevents either of these goals from being achieved.

I have occasionally seen plugins to open-source software (like WordPress plugins) released in an obfuscated form to provide technical compliance with the terms of the GPL license (which requires addons to GPL software, like WordPress, to also be released under the GPL) while obstructing users from making modifications to the code. However, it's unclear that this is even compliant with the license, as the code isn't being distributed in its original form, and it's generally considered an unfriendly behavior anyway.

  • It is not compliant with the license. GPL source code must not be obfuscated. – forest Jun 17 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.