3

Free software evangelists often advertise free and open source software to be more secure than proprietary alternatives.

  • Is this true, and why?
  • Are there security reasons not to use free and open source software?

closed as primarily opinion-based by Mast, Michael Schumacher, kdopen, HDE 226868, Zizouz212 Jun 23 '15 at 21:26

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

6

Is open source software more secure than proprietary software?

It depends. There can be secure proprietary software and insecure Open source software and it can be the other way. It depends on knowledge and involvement of the developers.

Are there reasons why Open Source Software can be more secure than proprietary software?

  1. The source code is visible to everyone. That means everyone can check for security problems and report them. That doesn't mean the software is checked, but it is possible. If the project in question is used often it might happen.

  2. It is easier to deduct, if the developers do something about security. You can look at the source and the changes that are applied and learn if the developers actively working on resolving issues. That isn't that easy for proprietary software.

5

This principle is sometimes referred to as Linus' Law:

Given a large enough beta-tester and co-developer base, almost every problem will be characterized quickly and the fix will be obvious to someone.

Coverity published a study that "found that open source code quality is on par with proprietary code quality for codebases of similar size"; however, the Wikipedia page I quoted above points out that the Heartbleed bug was inserted into the OpenSSL code base on December 31, 2011, and -- despite OpenSSL being widely used piece of system software -- was not discovered until April 1, 2014, almost three years later.

  • 3
    Heartbleed isn't really a counter-argument here. Bugs like that tend to persist in proprietary software even longer. – Mnementh Jun 23 '15 at 21:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.