Re: "Once We Squeeze All We Can Out of the United States, It Can Dry Up and Blow Away."

From: nemo_outis (abc_at_xyz.com)
Date: 09/21/05 

Date: 21 Sep 2005 14:55:51 GMT

"Jeffrey F. Bloss" <jbloss@tampabay.mapson.rr.com> wrote in
news:1284232.GM1tOFCg9M@wrench.yi.org:

>
> Is open source perfect? No, nothing ever is. But it's light years
> beyond trying to reverse engineer closed source applications. So far
> removed in fact, that yes, it *does* instill a high level of trust in
> most people. Deservedly so.
>

Open-source seems a very attractive feature. However, it is based on two
premises:

1. Competent people will actually examine the source code

2. "Bad guys" will be dissuaded from attempting compromise because of
premise 1 (or, at least their threshold of required competence to sneak by
will be raised quite a bit)

As for premise 1, I know *I* haven't examined the code in detail and I
certainly don't have the cryptographic competence to check that there
aren't subtle flaws (not just outright coding errors or obvious backdoors
but subtler stuff like code that facilitates timing attacks, etc.)

So if we are all depending on some "other guy" to examine the source code
thoroughly, it seems that the potential benefit will largely evaporate.

And the above logic - to the extent it is true - also greatly weakens
reliance on premise 2.

So, yes, open-source has great *potential* for eliminating flaws and
backdoors. But is that potential being realized?

Regards,

PS I have posted in the past regarding Ross Anderson's thoughts on the
overselling of open-source.

Relevant Pages
Quantcast