The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [opensource]

Open source is a term used for software whose source code is made available. Software distributed under Open source license allow the users to study, debug and improve the software with certain rights preserved for the copyright holder.

Filter by
Sorted by
Tagged with
1
vote
2answers
143 views

OpenSource API Security Testing Automation?

I had been tasked with automating application api security testing for proof of concept project which requires me to propose a tool. Now this tool has to provide data results as json/xml or otherwise ...
1
vote
0answers
535 views

Findbugs Source Code Analyzer not able to detect vulnerabilities in JSP file?

I am using FindBugs to do source code analysis along with Find Security Bugs plugin to specifically detect security vulnerabilities like SQL Injection, XSS, etc. I installed the FindBugs plugin for ...
5
votes
1answer
224 views

How can WhatsApp be listed on the EFF secure application toolset when it's not opensource? [closed]

I see this EFF tool guide, proposing WhatsApp as one of "our pick of the best, most secure applications" source. How can WhatsApp be trusted as a secure application when it is not open-source (...
1
vote
0answers
56 views

Open source KMIP Server in a production-level environment [closed]

I need to use a KMIP server for a project and searched for an open source solution. The only viable options I found are PyKMIP (https://github.com/OpenKMIP/PyKMIP) and KMIP4J (https://sourceforge.net/...
1
vote
2answers
78 views

Mitigating security risks of using open-source software

The title sounds like a trolling question but it is not (I'm a huge fan of OSS). I have a small company with a web app that is undergoing infosec review with a Fortune 100 company. The questions I ...
57
votes
5answers
14k views

Is open-sourcing the code of a webapp not recommended?

How to find out what programming language a website is built in? How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off? And other Qs like these ^ . ...
1
vote
2answers
91 views

How to securely transfer data from a public website, to a VPN-secured website?

I'm (currently) a VPN newby. I have a VPS with a few websites on it, hosted by liquid web. I have installed a medical records package (openEMR) in a sub-domain, in its own cPanel account. I intend to ...
1
vote
1answer
55 views

How can the validity and safety of a software library be checked?

So beyond looking at the source code for particular software library, is there a way to vet that it does not contain malicious code? As far as I know from my own research, services like pip, npm, and ...
4
votes
4answers
166 views

What is the use of disabling detailed exception pages on open-sourced apps?

Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the ...
2
votes
1answer
115 views

How safe is it to open source access to MySQL database on github, only permitting SELECT query?

The Setup: Im building an app to model visually world data. A significant part of this project will be the database since that data is what is interesting. I should only need to allow SELECT queries,...
3
votes
2answers
186 views

How can a client verify that code sent from the server has not been tampered with?

While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
6
votes
3answers
848 views

Does (J-)SOX Forbid the Use of Open Source Software?

With Regard to Sarbanes Oxley and particularly The Japanese version thereof: Is it true that in order to comply with (J-)SOX you must have a support contract - and therefore a responsible party - for ...
3
votes
2answers
187 views

Should things like project IDs, cloud region IDs etc be kept secret on an open source project?

All my side project are open source - just using the free Github account. I'm wondering about how security conscious I need to be about keep things like: Google Cloud Platform Project IDs Log ...
3
votes
3answers
179 views

Is the Linux / Debian software and package-management ecosystem secure?

My basic question is this: When we are using the Linux / Debian apt-get or yum package system, we're placing a lot of faith in that the packages we're downloading and installing are secure. For that ...
2
votes
1answer
294 views

How is the create-react-app package tree properly sanitized?

React, and it's application creation script, create-react-app, are popular packages nowadays... and with good reason: React is a rock-star framework. From a security perspective, sanitizing all the ...
8
votes
4answers
11k views

How is Tor secure despite being open source?

If Tor is open source (and thus its process of concealing your IP is known), then how does it keep anything secure? Couldn't someone look at the source code and figure out how to reverse the routing ...
1
vote
1answer
742 views

How to Check Open Source Code for Vulnerabilities? [closed]

I am a member in bug bounty platform. There are some programs that make their source code available to the hackers to find vulnerabilities. For example, their PHP, JS, C++, or ruby code. I want to ...
-1
votes
1answer
171 views

Secure Admin Password in Open Source Software

I am writing a server using nodejs. It is on a public GitHub repository, so its complete code is visible to anyone. The client can send strings to the server. I need to determine if the given string ...
2
votes
1answer
79 views

How to cryptographically guarantee that data came from a trusted application on a mobile device?

I'd like to have an open source application generate data and sign it in such a way that anyone with access to the data alone can know for sure it was generated by that open source code. More ...
4
votes
2answers
372 views

How can Linux be secure if it allows for open source contributions from the public?

From my brief understanding of Linux, developers from around the globe submit code to be included into a Linux update. It's then reviewed by security administrators. When approved, it's passed onto ...
20
votes
5answers
5k views

Is there any open source ransomware? [closed]

I'm working on malware analysis at my university and I'm trying to develop ransomware. I'm planning to publish the source code after it's finished. Is there any open source ransomware sample so I can ...
3
votes
2answers
236 views

How do I escalate a security concern of a library when the author doesn't seem to care

There's an open source library that is horribly insecure. The author acknowledges it's insecure. The library's headline says "This is an implementation for platform X of Library Y". Library Y is ...
6
votes
2answers
414 views

Drupal Disputed CVE Five Year Tempest – Open Source Security Shortfall?

Can someone add context to the subject issue? At first glance it appears to me this issue represents a fundamental shortfall in the forces encouraging secure coding in open source development. Is ...
3
votes
1answer
3k views

does karabiner elements on Mac OSX contain or potentially contain malware?

I'm using Karabiner elements, an open-source program to remap the keys on my macbook air (running the latest Mac OSX High Sierra) and my apple wireless keyboard. It works very nicely. However, I am ...
2
votes
3answers
206 views

What was done to gain a list of home directory accounts?

Today some sites were defaced in our WHM/cpanel VPS. I understand that the common cause of this is outdated scripts/plugins/etc. However as I was checking the file manager of one of the accounts I saw ...
6
votes
3answers
20k views

Are there any free static analysis tools for C# / .NET code [closed]

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
1
vote
0answers
22 views

Aptitude & Yum: Studies on Actual Security

The theory has long been that package managers (and potentially other sources of FOSS) were potentially "more secure" and/or "more trustworthy" than commercial software because more people's eyes have ...
2
votes
1answer
6k views

How secure is Keepass when using mobile apps

Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user ...
1
vote
1answer
102 views

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
1
vote
2answers
87 views

Possible setup for a direct democracy voting system to prevent fraud

My Government is designing a direct democratic voting system and would like the system to be open sourced and unable to be corrupted by individuals and other stakeholders. Some requirements as of now:...
5
votes
1answer
233 views

Could the unused Mali GPU in the Libre Tea Computer Card be a security risk?

The Libre Tea Computer Card is a single-board computer that comes without any proprietary software (at least that’s the goal, it’s currently in crowdfunding): […] all firmware and kernel sources ...
3
votes
1answer
974 views

What are easy checks to identify malware in Python code?

It is well known that PyPI does not prevent the upload of malicious code. Unfortunately, automated tools often cannot distinguish between features of a program and malicious code. In the case of ...
6
votes
3answers
2k views

Is there any way to use Nuget securely?

Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget" The problem I have is that anyone can pretend to be ...
1
vote
1answer
170 views

Public guest user for PostgreSQL?

I manage an open-source software project that relies on data that I am happy to share with the public. The software is hosted on github.com, but the dataset is too large to host there. It is easiest ...
1
vote
0answers
962 views

Is it safe to use “Iguana Tex”? Why does it trigger a virus report? [closed]

I have used Iguana Tex in the past to insert Latex equations into my power point presentations. Lately, it triggers a response from the virus check programs. According to the developer, it is a 'false ...
4
votes
3answers
447 views

Is it safe to use this embedded ftp server?

We are using a software suite for automation of FTP traffic. It uses the Apache Mina FtServer component as an embedded FTP server (for FTPS and SFTP). The use of this library has been flagged as a ...
-3
votes
3answers
953 views

What is problem with open source anti-virus [closed]

Why there is no open source anti-virus? And what problems that will associate with open source?
5
votes
1answer
240 views

Can open source software be digitally signed?

I've read that installing Linux on UEFI PCs requires additional steps to disable the requirement for digitally signed bootloaders. But I thought that open source software can be digitally signed by ...
6
votes
2answers
651 views

Can I trust a security hash implementation after testing it with random inputs against another implementation?

Let's say I want to use a security hashing algorithm, like bcrypt, and I want to use a young bcrypt implementation, e.g. called libfancybcrypt, instead of an well established implementation. Of ...
1
vote
2answers
228 views

How can we retire SHA1 in prefernce to SHA256 or SHA-3?

According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could ...
11
votes
4answers
586 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
2
votes
1answer
58 views

Is there any way to verify that an organization operating an open-source SaaS is using an untampered-with version of the software?

Some organizations have begun offering access to servers running open-source software (mail servers, chat servers), operated and maintained by those organizations, for a nominal recurring upkeep fee. ...
2
votes
2answers
230 views

Can the U2F standard be used by servers to impose a specific category of hardware?

I don't like that browsers, email clients, etc. come bundled with CAs and that there is no emphasis for a more decentralized authentication mechanism. Fortunately, it's not too bad, because at the ...
3
votes
1answer
660 views

Have there been any case studies on intentional vulnerabilities or malware in open source projects?

In my experience, it's a common mantra that open source tends to be secure due to its availability for open scrutiny. I tend to agree with this. At the same time it's no secret that vulnerabilities ...
3
votes
2answers
183 views

Does Open-Source imply Authenticity?

One of the purported advantages of open-source software is that in being so, it allows for multiple eyes on the code, and enables faster resolution of bugs. I think, also implied is an assurance about ...
0
votes
1answer
43 views

I have an open source App that installs firewall rules, but should your firewall rules remain secret?

As I'm working on an OpenSource application, that application is to serve Web pages to clients. It also supports a mailserver, DNS, and runs with the Cassandra database. What I have done is setup a ...
7
votes
3answers
324 views

Before a piece of software is approved to go into a repo, what security checks does it go through? [closed]

I use Debian Jessie, and the Debian repo has many open source packages. I understand there's a process that checks these before they get used in the repository. While I understand it's impossible to ...
0
votes
1answer
64 views

3rd Party Vulnerabilities Fix (Access to source code vs no access to source code)

I've embedded system software with listed vulnerabilities from a static code analyser tool. Since it is an embedded system, and I don't have access to some of the source code (being 3rd party) for ...
53
votes
7answers
8k views

Open Source vs Closed Source Systems

My understanding is that open source systems are commonly believed to be more secure than closed source systems. Reasons for taking either approach, or combination of them, include: cultural norms, ...
0
votes
0answers
19 views

What are the security risks of making an app closed-source? [duplicate]

What are the security risks, if any, of making an app closed-source vs. open-source?