When do you trust open source? With so many recent attacks using insecure software as a vector--thousands upon thousands of attacks--the reliance on the vigilance of others seems almost foolhardy.
Open source has an answer for the lack of security, in that the code is presumably visible to all. However, few actually read the source code of the applications they rely on; there are simply too many of them, their codebases are too large, and chances are that most people reading the source code couldn't do a proper security analysis anyway.
Doesn't this mean that open source and closed source end up being on an even playing field with respect to security? If nobody reads the source code, open or closed, where's the difference in security between the two licensed codebases?
With the aid of Josh Bressers, lead of Red Hat's Product Security Team, let's look at a process by which one can gain some reassurance concerning open source security, along with a pointed look at one more way in which Red Hat contributes to the entire Linux community.
The basic argument, in simplified straw man form, looks like this:
-
Open source is no more secure than closed source.
-
You don't review every line of open source code; you trust the projects.
-
Since you don't review every line of code, trusting your closed source vendor is the same as trusting an open source project.
This almost makes sense--but according to Josh, this is what actually happens:
You probably haven't reviewed the source code to your web browser (how you're reading this page). Even if you did review the code, you need to trust whomever built the source code. Up to this point, open source is on par with closed source.
If you have a closed source product, you have to trust the vendor. There's zero choice. If they make a claim, you probably can't prove them wrong. Many closed source vendors have been caught doing silly things, but security isn't trivial, and people easily forget the sins of the past.
Open source and closed source diverge when you consider the people who do review your source code. Red Hat has a number of security teams who do actually conduct source code audits. Do they catch everything? Certainly not, but they are essentially an independent third party looking at public source code. Even if you don't like what they find, you can go look and verify security for yourself. You don't have to trust the third party; you can still conduct your own analysis.
There are also other groups doing third-party security verification. That's the amplification power of open source.
All of this is what makes open source more secure. We can't lie, we can't cheat, we can't steal. The emperor is naked and knows it. More than once Red Hat has hit security issues where we wish we could have weaselled out of them, but at the end of the day, open source kept us honest.
We think open source is more secure than closed source. Every time.
저자 소개
채널별 검색
오토메이션
기술, 팀, 환경을 포괄하는 자동화 플랫폼에 대한 최신 정보
인공지능
고객이 어디서나 AI 워크로드를 실행할 수 있도록 지원하는 플랫폼 업데이트
오픈 하이브리드 클라우드
하이브리드 클라우드로 더욱 유연한 미래를 구축하는 방법을 알아보세요
보안
환경과 기술 전반에 걸쳐 리스크를 감소하는 방법에 대한 최신 정보
엣지 컴퓨팅
엣지에서의 운영을 단순화하는 플랫폼 업데이트
인프라
세계적으로 인정받은 기업용 Linux 플랫폼에 대한 최신 정보
애플리케이션
복잡한 애플리케이션에 대한 솔루션 더 보기
오리지널 쇼
엔터프라이즈 기술 분야의 제작자와 리더가 전하는 흥미로운 스토리
제품
- Red Hat Enterprise Linux
- Red Hat OpenShift Enterprise
- Red Hat Ansible Automation Platform
- 클라우드 서비스
- 모든 제품 보기
툴
체험, 구매 & 영업
커뮤니케이션
Red Hat 소개
Red Hat은 Linux, 클라우드, 컨테이너, 쿠버네티스 등을 포함한 글로벌 엔터프라이즈 오픈소스 솔루션 공급업체입니다. Red Hat은 코어 데이터센터에서 네트워크 엣지에 이르기까지 다양한 플랫폼과 환경에서 기업의 업무 편의성을 높여 주는 강화된 기능의 솔루션을 제공합니다.