FAQ: « Doesn’t being Opensource imply a security threat ? »
The term “open source” or “free software” simply means that you have access to the source code, which allows you to check it for any security vulnerabilities, backdoors, hidden features, etc. By choosing software with published source code, you can double-check that no such issues might arise.
What if I don’t have time/ressources to check it ?
You do not need to check it yourself. As free software (for example, released under the GPL licence), its source code is available to the Community and is therefore checked by numerous users, developers and would-be users. For example, the source code for the Linux kernel is accessible worldwide; it is therefore checked on a daily basis, even by the most demanding customers, such as NASA, ESA, NSA, Google, IBM, CERN, … not only for its security, but also for issues relating to stability, performance, reliability, and so on.
The source code for the Linux kernel (the world’s most widely used operating system) is extremely trustworthy, very stable and free from any backdoors, despite certain satirical publications, such as
Software whose source code cannot be verified (proprietary software) offers no guarantee of stability or security, other than the level of confidence you grant to its publisher…
This is a decision that must be taken with great caution, especially as it has been common knowledge for years, if not decades, that the major proprietary software publishers (mainly US) have collaborated with espionage or intelligence agencies, thereby undermining any trust that might be placed in such organizations and/or countries.
Even security-focused software, such as the OpenSSL library, SSH, OpenVPN, RSA implementations, TOTP, … is open source software: security through obfuscation is not a requirement; publishing the source code is a better way to ensure its robustness, as it allows external experts to verify that it contains no potential vulnerabilities.
Conclusion:
The use of a software that is delivered to you, also in source-code format is the best way to ensure its stability, reliability, security, aside of its Long-Term maintainability.
On the same subject, read here about « Does using Scada-LTS implies you to have remote access to it ? »
Don’t miss neither our related page, about “Why Linux and not Windows ?“
