The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [opensource]

Open source is a term used for software whose source code is made available. Software distributed under Open source license allow the users to study, debug and improve the software with certain rights preserved for the copyright holder.

Filter by
Sorted by
Tagged with
5
votes
1answer
224 views

How can WhatsApp be listed on the EFF secure application toolset when it's not opensource? [closed]

I see this EFF tool guide, proposing WhatsApp as one of "our pick of the best, most secure applications" source. How can WhatsApp be trusted as a secure application when it is not open-source (...
1
vote
0answers
56 views

Open source KMIP Server in a production-level environment [closed]

I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
1
vote
2answers
78 views

Mitigating security risks of using open-source software

The title sounds like a trolling question but it is not (I'm a huge fan of OSS). I have a small company with a web app that is undergoing infosec review with a Fortune 100 company. The questions I ...
57
votes
5answers
14k views

Is open-sourcing the code of a webapp not recommended?

How to find out what programming language a website is built in? How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off? And other Qs like these ^ . ...
1
vote
2answers
143 views

OpenSource API Security Testing Automation?

I had been tasked with automating application api security testing for proof of concept project which requires me to propose a tool. Now this tool has to provide data results as json/xml or otherwise ...
1
vote
1answer
55 views

How can the validity and safety of a software library be checked?

So beyond looking at the source code for particular software library, is there a way to vet that it does not contain malicious code? As far as I know from my own research, services like pip, npm, and ...
4
votes
4answers
166 views

What is the use of disabling detailed exception pages on open-sourced apps?

Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the ...
2
votes
1answer
115 views

How safe is it to open source access to MySQL database on github, only permitting SELECT query?

The Setup: Im building an app to model visually world data. A significant part of this project will be the database since that data is what is interesting. I should only need to allow SELECT queries,...
1
vote
2answers
91 views

How to securely transfer data from a public website, to a VPN-secured website?

I'm (currently) a VPN newby. I have a VPS with a few websites on it, hosted by liquid web. I have installed a medical records package (openEMR) in a sub-domain, in its own cPanel account. I intend to ...
3
votes
2answers
186 views

How can a client verify that code sent from the server has not been tampered with?

While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
3
votes
2answers
187 views

Should things like project IDs, cloud region IDs etc be kept secret on an open source project?

All my side project are open source - just using the free Github account. I'm wondering about how security conscious I need to be about keep things like: Google Cloud Platform Project IDs Log ...
1
vote
1answer
742 views

How to Check Open Source Code for Vulnerabilities? [closed]

I am a member in bug bounty platform. There are some programs that make their source code available to the hackers to find vulnerabilities. For example, their PHP, JS, C++, or ruby code. I want to ...
-1
votes
1answer
171 views

Secure Admin Password in Open Source Software

I am writing a server using nodejs. It is on a public GitHub repository, so its complete code is visible to anyone. The client can send strings to the server. I need to determine if the given string ...
2
votes
1answer
79 views

How to cryptographically guarantee that data came from a trusted application on a mobile device?

I'd like to have an open source application generate data and sign it in such a way that anyone with access to the data alone can know for sure it was generated by that open source code. More ...
4
votes
2answers
372 views

How can Linux be secure if it allows for open source contributions from the public?

From my brief understanding of Linux, developers from around the globe submit code to be included into a Linux update. It's then reviewed by security administrators. When approved, it's passed onto ...
3
votes
1answer
3k views

does karabiner elements on Mac OSX contain or potentially contain malware?

I'm using Karabiner elements, an open-source program to remap the keys on my macbook air (running the latest Mac OSX High Sierra) and my apple wireless keyboard. It works very nicely. However, I am ...
1
vote
0answers
22 views

Aptitude & Yum: Studies on Actual Security

The theory has long been that package managers (and potentially other sources of FOSS) were potentially "more secure" and/or "more trustworthy" than commercial software because more people's eyes have ...
2
votes
1answer
6k views

How secure is Keepass when using mobile apps

Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user ...
1
vote
1answer
102 views

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
2
votes
1answer
294 views

How is the create-react-app package tree properly sanitized?

React, and it's application creation script, create-react-app, are popular packages nowadays... and with good reason: React is a rock-star framework. From a security perspective, sanitizing all the ...
1
vote
2answers
87 views

Possible setup for a direct democracy voting system to prevent fraud

My Government is designing a direct democratic voting system and would like the system to be open sourced and unable to be corrupted by individuals and other stakeholders. Some requirements as of now:...
3
votes
1answer
972 views

What are easy checks to identify malware in Python code?

It is well known that PyPI does not prevent the upload of malicious code. Unfortunately, automated tools often cannot distinguish between features of a program and malicious code. In the case of ...
1
vote
1answer
170 views

Public guest user for PostgreSQL?

I manage an open-source software project that relies on data that I am happy to share with the public. The software is hosted on github.com, but the dataset is too large to host there. It is easiest ...
3
votes
2answers
236 views

How do I escalate a security concern of a library when the author doesn't seem to care

There's an open source library that is horribly insecure. The author acknowledges it's insecure. The library's headline says "This is an implementation for platform X of Library Y". Library Y is ...
1
vote
0answers
962 views

Is it safe to use “Iguana Tex”? Why does it trigger a virus report? [closed]

I have used Iguana Tex in the past to insert Latex equations into my power point presentations. Lately, it triggers a response from the virus check programs. According to the developer, it is a 'false ...
4
votes
3answers
447 views

Is it safe to use this embedded ftp server?

We are using a software suite for automation of FTP traffic. It uses the Apache Mina FtServer component as an embedded FTP server (for FTPS and SFTP). The use of this library has been flagged as a ...
-3
votes
3answers
953 views

What is problem with open source anti-virus [closed]

Why there is no open source anti-virus? And what problems that will associate with open source?
6
votes
2answers
651 views

Can I trust a security hash implementation after testing it with random inputs against another implementation?

Let's say I want to use a security hashing algorithm, like bcrypt, and I want to use a young bcrypt implementation, e.g. called libfancybcrypt, instead of an well established implementation. Of ...
1
vote
2answers
228 views

How can we retire SHA1 in prefernce to SHA256 or SHA-3?

According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could ...
2
votes
2answers
230 views

Can the U2F standard be used by servers to impose a specific category of hardware?

I don't like that browsers, email clients, etc. come bundled with CAs and that there is no emphasis for a more decentralized authentication mechanism. Fortunately, it's not too bad, because at the ...
3
votes
1answer
660 views

Have there been any case studies on intentional vulnerabilities or malware in open source projects?

In my experience, it's a common mantra that open source tends to be secure due to its availability for open scrutiny. I tend to agree with this. At the same time it's no secret that vulnerabilities ...
3
votes
2answers
183 views

Does Open-Source imply Authenticity?

One of the purported advantages of open-source software is that in being so, it allows for multiple eyes on the code, and enables faster resolution of bugs. I think, also implied is an assurance about ...
0
votes
1answer
43 views

I have an open source App that installs firewall rules, but should your firewall rules remain secret?

As I'm working on an OpenSource application, that application is to serve Web pages to clients. It also supports a mailserver, DNS, and runs with the Cassandra database. What I have done is setup a ...
7
votes
3answers
324 views

Before a piece of software is approved to go into a repo, what security checks does it go through? [closed]

I use Debian Jessie, and the Debian repo has many open source packages. I understand there's a process that checks these before they get used in the repository. While I understand it's impossible to ...
0
votes
1answer
64 views

3rd Party Vulnerabilities Fix (Access to source code vs no access to source code)

I've embedded system software with listed vulnerabilities from a static code analyser tool. Since it is an embedded system, and I don't have access to some of the source code (being 3rd party) for ...
0
votes
0answers
19 views

What are the security risks of making an app closed-source? [duplicate]

What are the security risks, if any, of making an app closed-source vs. open-source?
3
votes
3answers
518 views

Basic security checklist for using an open-source library

I've recently started working with web applications, and the ones developed by our team seem to use a lot of external components for different minor functionality (e.g. a scrolling slider bar, a ...
6
votes
1answer
138 views

Is there a database with XSS vectors, possible reference and test information?

I recently had the idea to develop a public database in which unique cross-site scripting (XSS) vectors will be registered and get a reference assigned similar to the CVE system. I made a local PoC ...
5
votes
1answer
233 views

Could the unused Mali GPU in the Libre Tea Computer Card be a security risk?

The Libre Tea Computer Card is a single-board computer that comes without any proprietary software (at least that’s the goal, it’s currently in crowdfunding): […] all firmware and kernel sources ...
4
votes
1answer
68 views

Any historical precedent for Open-Source libs as an attack vector?

I'm curious as to whether there are any noteworthy cases historically of people deliberately placing exploits in open-source code libraries used by others, either something relatively obvious with the ...
2
votes
1answer
58 views

Is there any way to verify that an organization operating an open-source SaaS is using an untampered-with version of the software?

Some organizations have begun offering access to servers running open-source software (mail servers, chat servers), operated and maintained by those organizations, for a nominal recurring upkeep fee. ...
60
votes
7answers
7k views

Closed source binary blobs in chipsets - privacy threat?

I wanted to buy a Librem Purism 13 because I care about my privacy and generally wanted a laptop to test Linux on. However, I was advised against it because it uses Intel i5 processors which contain ...
0
votes
1answer
107 views

How to make users trust my website? I want to convince them that is all, 100%, fully open-source without any hidden additions

Say I have a website that handles data from another provider/service that my users use. My users log in through OAuth with the foreign provider. They need to add an additional key, which I'll save, ...
1
vote
1answer
504 views

Making an encrypted SMS app (Android) [closed]

From my limited googling I've noticed that a lot of the mainstream encrypted messaging apps all are either (or a combination of!) closed-source, run through an uncontrolled third-party server, use a ...
8
votes
1answer
905 views

Is the OpenPGP implementation of the YubiKey 4 Open Source?

Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
5
votes
1answer
240 views

Can open source software be digitally signed?

I've read that installing Linux on UEFI PCs requires additional steps to disable the requirement for digitally signed bootloaders. But I thought that open source software can be digitally signed by ...
-1
votes
2answers
156 views

Is open source a good option for cryptography libraries? [closed]

I am trying to find good cryptography library to use with my project. I found open source options like openSSL and many more and also proprietory options like Intel Integrated Performance Primitives ...
6
votes
3answers
895 views

Making database code open source

I am building a web app. It is currently not open source, but I am considering making it open source, so that others can fix bugs, improve it, so that others are not suspicious of my motives (fun to ...
3
votes
3answers
179 views

Is the Linux / Debian software and package-management ecosystem secure?

My basic question is this: When we are using the Linux / Debian apt-get or yum package system, we're placing a lot of faith in that the packages we're downloading and installing are secure. For that ...
2
votes
1answer
283 views

What is the benefit of using lastpass authenticator on android compared to other similar applications?

Lastpass recently (march 2016) released a new app called lastpass authenticator. Reading their blog post and the description of the app features, it looks like to me that the app does nothing more ...