Item — HN Reader

I read the source code of programs I use often, mostly for learning purposes. The first thing I do when I want to evaluate the security of a program I don't trust is look at the system calls it performs, especially those related to I/O.

Since I don't need to reverse engineer binaries, open source code allows me to spot malicious code much faster. More importantly, it allows me to more easily remove that code from the program.

The rate of vulnerabilities caused by honest mistakes is probably the same.

1 comments

Yeah, everybody is going to start reading the entire source code of the apps they use.

There's still a benefit even if only a small amount of people read it, because they can call it out. You don't go to the production areas of packaged food you buy to make sure you know they're not making any mistakes/pumping sawdust into the food, but you trust that because everyone else is buying it and no one is getting sick that there's a fair chance you won't either.

You broke your analogy a bit there. You don't go to the production areas of packaged food companies because you assume that others are doing so - specifically, state regulators. It's not that no one is obviously getting sick - they might be getting sick in subtle ways they can't pin on the food, like long term heavy metal poisoning, in the same way that malicious software can be very quiet about it.

That's a good point. It's not a 1-1 analogy, but I think the overall principle applies. If it's open source, more people can regulate it, as opposed to less.

Oh no, it's a fine analogy! I just thought you muddled it a little at the end with the 'no one getting sick' part. It's important that source code be available for the same reason that food preparation not be done behind locked doors with secret ingredients - not so much so that everyone can see for themselves, but so that someone can, and raise the alarm for the rest of us if anything is amiss.

The 'getting sick' part actually works too - it's important to be able to review the process precisely because it's not always immediately obvious if something is wrong.