The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [opensource]

Open source is a term used for software whose source code is made available. Software distributed under Open source license allow the users to study, debug and improve the software with certain rights preserved for the copyright holder.

Filter by
Sorted by
Tagged with
60
votes
7answers
7k views

Closed source binary blobs in chipsets - privacy threat?

I wanted to buy a Librem Purism 13 because I care about my privacy and generally wanted a laptop to test Linux on. However, I was advised against it because it uses Intel i5 processors which contain ...
57
votes
5answers
14k views

Is open-sourcing the code of a webapp not recommended?

How to find out what programming language a website is built in? How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off? And other Qs like these ^ . ...
53
votes
7answers
8k views

Open Source vs Closed Source Systems

My understanding is that open source systems are commonly believed to be more secure than closed source systems. Reasons for taking either approach, or combination of them, include: cultural norms, ...
31
votes
0answers
2k views

Can you prove that an open source program is running the same code that it claims to be? [duplicate]

So if a group has made open source software, and the source code is available on github, and is bundled with an executable in their main download, can it be proven that the executable is compiled from ...
29
votes
11answers
5k views

What is the point of using an open source and secure OS if you are running it on a machine with closed source firmware?

I'm very interested in the OpenBSD OS, as it currently seems to me to be the option that takes security more seriously than its contemporaries. But as I was reading about it, it occurred to me that ...
29
votes
8answers
2k views

Is it safer to use less heard of software than popular software?

Is it good policy to use non-mainstream applications, or does it depend? For example is it better to use a less popular browser, media player or operating system as it is less likely a target for ...
20
votes
5answers
5k views

Is there any open source ransomware? [closed]

I'm working on malware analysis at my university and I'm trying to develop ransomware. I'm planning to publish the source code after it's finished. Is there any open source ransomware sample so I can ...
19
votes
3answers
14k views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
19
votes
2answers
13k views

FOSS Enterprise Password Management Solution [closed]

Can anyone recommend a F/OSS enterprise password management solution on/around the same level as something like Cyber-Ark? Specifically, something along the lines of a standard password manager, (...
15
votes
8answers
1k views

Trust Issues Relative to Open Source

Two separate discussions have very recently opened my eyes to an issue I had not considered – how to confirm the Open Source binary one uses is based on the published source code. There is a large ...
14
votes
3answers
1k views

What are the security implications of 'open-source' vs. 'source-available'?

In light of the current fiasco surrounding TrueCrypt, I have received considerable criticism from current clients and peers in the IT industry for my continued support of the open-source model. Such ...
13
votes
7answers
2k views

How are open-sourced operating systems and software kept secure?

I have been wondering about his for awhile. I have Linux running on a PC at home. I had a jailbroken iPhone. They both have attributes that make them very attractive, and they are also FREE! But I ...
13
votes
3answers
383 views

open source software security rating — 3rd-party authority

A client is asking my company to write up internal standards that open source software must meet before we will approve it for use on our workstations. Our policy has always been subjective and hard ...
11
votes
3answers
3k views

Security related code in Open Source projects?

I have recently heard that most of the PHP code is confidential, because if attackers know your database structure or the hash function used to encrypt the passwords, there is higher chances of a ...
11
votes
4answers
586 views

How to trust ICs?

While it is theoretically possible to thoroughly examine the source code of Open Source Software to check for backdoors (neglecting a Ken Thompson hack), and given sufficiently adequate knowledge in ...
11
votes
4answers
4k views

Tool for public key cryptography where password is the private key?

Is there any free & open source tool for public key cryptography, where the private key is just a chosen password? Here is what I need: I want to make backups every hour using a script I want to ...
11
votes
4answers
950 views

I work on an open source project. Is there a “standard” to reporting security vulnerabilities that we can use?

I work on an (intentionally undisclosed) open source project. To the best of my knowledge, we do not have a discoverable policy on reporting security vulnerabilities. Rails has their own policy ...
10
votes
2answers
2k views

Looking for an open risk assessment methodology

I'm looking for a fully open quantitative risk assessment methodology. Most of the methodologies have usage or licensing restrictions placed upon them. I define open as methodology covered by ...
10
votes
1answer
5k views

What is real-world impact of CVE-2016-0728 (Linux Kernel Vulnerability)

Today emerged report about another serious vulnerability in opensource world, CVE-2016-0728. It is local privilege escalation in Linux kernel 3.8+. What are the the possible real-world exploitation, ...
9
votes
2answers
5k views

How do open source projects handle secure artifacts?

Specifically, how are things like keystores handled, or other items needed to build or run an app? In my case, I have a Chrome OS app that requires a keystore to build and publish to the Chrome Web ...
8
votes
4answers
11k views

How is Tor secure despite being open source?

If Tor is open source (and thus its process of concealing your IP is known), then how does it keep anything secure? Couldn't someone look at the source code and figure out how to reverse the routing ...
8
votes
5answers
1k views

Is it safer to compile open source code vs simply running the binary?

I understand that with OpenSource software, my milage may vary based on the trust of the author and the distribution platform they use (Codeplex, Git, or private server). Oftentimes a FOSS website ...
8
votes
1answer
905 views

Is the OpenPGP implementation of the YubiKey 4 Open Source?

Although previous versions of the YubiKey (eg Neo and Neo-N) used an Open Source Java applet to handle OpenPGP signing, encryption and authentication, it is unclear from the yubico website / ...
7
votes
4answers
2k views

Is compiling source code from github a big security risk?

I have several programs (Emacs el-get, oh-my-zsh and Homebrew) that occasionally load source code from github and compile it on my machine. Is this a big security concern? What can I do to prevent ...
7
votes
3answers
287 views

How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?

Are there any realistic methods for verifying that Apple or whoever has not tampered with third party application distributed through their App Store? You might for example have an open source ...
7
votes
3answers
324 views

Before a piece of software is approved to go into a repo, what security checks does it go through? [closed]

I use Debian Jessie, and the Debian repo has many open source packages. I understand there's a process that checks these before they get used in the repository. While I understand it's impossible to ...
7
votes
2answers
132 views

Searching vulnerabilities via similar code comparison. Is it a viable attack vector?

Consider the following scenario: the attacker scans (optimally automatically) open codebases (eg. GitHub) for vulnerable code fragments by checking bug reports and patches. the attacker scans for ...
6
votes
3answers
9k views

Could I delete .csr files once the key was signed by CA

I'm creating my own openvpn server. The Certificate authority is located on a separated host. There is two kind of clients: which that just send a .csr and to which i send the .crt as an answer and ...
6
votes
3answers
848 views

Does (J-)SOX Forbid the Use of Open Source Software?

With Regard to Sarbanes Oxley and particularly The Japanese version thereof: Is it true that in order to comply with (J-)SOX you must have a support contract - and therefore a responsible party - for ...
6
votes
3answers
895 views

Making database code open source

I am building a web app. It is currently not open source, but I am considering making it open source, so that others can fix bugs, improve it, so that others are not suspicious of my motives (fun to ...
6
votes
3answers
20k views

Are there any free static analysis tools for C# / .NET code [closed]

A client recently asked me to perform a code review on C# code. As an independent contractor I was wondering what are the automated solutions out there where I would not have to break the bank to ...
6
votes
2answers
414 views

Drupal Disputed CVE Five Year Tempest – Open Source Security Shortfall?

Can someone add context to the subject issue? At first glance it appears to me this issue represents a fundamental shortfall in the forces encouraging secure coding in open source development. Is ...
6
votes
3answers
1k views

How much can we trust open source implementations of crypto (security) libraries?

In one of my projects I was choosing bcrypt or PBKDF2 for the KDF for passwords. I have read that bcrypt is generally more advanced and scrypt is even better. But I am using .NET platform where bcrypt/...
6
votes
2answers
651 views

Can I trust a security hash implementation after testing it with random inputs against another implementation?

Let's say I want to use a security hashing algorithm, like bcrypt, and I want to use a young bcrypt implementation, e.g. called libfancybcrypt, instead of an well established implementation. Of ...
6
votes
3answers
2k views

Is there any way to use Nuget securely?

Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget" The problem I have is that anyone can pretend to be ...
6
votes
2answers
1k views

In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?

I'm looking at the source code of some potentially hostile code. As usual, VS 2012 is giving me the security warning: "You should only open projects from a trustworthy source" ... "ask me for every ...
6
votes
1answer
138 views

Is there a database with XSS vectors, possible reference and test information?

I recently had the idea to develop a public database in which unique cross-site scripting (XSS) vectors will be registered and get a reference assigned similar to the CVE system. I made a local PoC ...
5
votes
3answers
989 views

Open source web application penetration testing community

I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause ...
5
votes
1answer
240 views

Can open source software be digitally signed?

I've read that installing Linux on UEFI PCs requires additional steps to disable the requirement for digitally signed bootloaders. But I thought that open source software can be digitally signed by ...
5
votes
1answer
225 views

How can WhatsApp be listed on the EFF secure application toolset when it's not opensource? [closed]

I see this EFF tool guide, proposing WhatsApp as one of "our pick of the best, most secure applications" source. How can WhatsApp be trusted as a secure application when it is not open-source (...
5
votes
2answers
5k views

How secure is EncFS compared to TrueCrypt?

If I choose the paranoia option for EncFS and for TrueCrypt I create containers using the encryption algorithm AES-Twofish-Serpent and the Hash Algorithm Whirlpool. Are both methods equally secure, ...
5
votes
2answers
2k views

What are good free opensource tools for helping in manual source code reviews? [closed]

I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
5
votes
1answer
233 views

Could the unused Mali GPU in the Libre Tea Computer Card be a security risk?

The Libre Tea Computer Card is a single-board computer that comes without any proprietary software (at least that’s the goal, it’s currently in crowdfunding): […] all firmware and kernel sources ...
5
votes
1answer
133 views

Quantitative Security Analysis of Open Source Repos like CRAN and NPM

Is anyone aware of any quantitative analysis or research on the security of CRAN or NPM? e.g. How much malware is hosted, rate of compromise, speed to close, number of attack vectors, CERT reports ...
4
votes
4answers
3k views

Is it secure to have source code for website public? [duplicate]

I am working on a website and would like to have it under revision control. I have used git for earlier projects before and I like it. This project though is a website written in Django. I am totally ...
4
votes
2answers
372 views

How can Linux be secure if it allows for open source contributions from the public?

From my brief understanding of Linux, developers from around the globe submit code to be included into a Linux update. It's then reviewed by security administrators. When approved, it's passed onto ...
4
votes
5answers
6k views

Building a Security Training Simulation environment

My university is keen to build a security training simulation environment/platform and it will be a good learning experience for students. I Googled around to find out how it is built, but I only ...
4
votes
3answers
206 views

How can you know what is distributed with your Linux

I'm curious, in theory, how can one know if for example kernel that is distributed with Ubuntu Linux is really what is on https://github.com/torvalds/linux and not some modified kernel which contains ...
4
votes
4answers
167 views

What is the use of disabling detailed exception pages on open-sourced apps?

Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the ...
4
votes
3answers
448 views

Is it safe to use this embedded ftp server?

We are using a software suite for automation of FTP traffic. It uses the Apache Mina FtServer component as an embedded FTP server (for FTPS and SFTP). The use of this library has been flagged as a ...