Something I’ve wondered. One of those “too good to be true, it probably is” type things. With all the FOSS especially for linux, installing package after package because a web search said it would fix your problem, how is it Linux isn’t full of malware and such?
Id like to understand better so I can explain to others who are afraid of FOSS for those reasons. My best response is that since it’s open source, people can see what it’s doing and would right away notice something malicious. I wouldn’t, since I’m not that into code, but others would.
You’re right to think that “since it’s open source, people can see what it’s doing and would right away notice something malicious” is bullshit, cause it pretty much is. I sure as hell don’t spend weeks analyzing the source code of every third party open source package or program that I use. But just like with close-source software, there’s a much bigger story of trust and infrastructure in play.
For one, while the average Joe Code isn’t analyzing the source of every new project that pops up, there are people whose job is literally that. Think academic institutions, and security companies like Kaspersky. You can probably argue that stuff like that is underfunded, but it definitely exists. And new projects that gain enough popularity to matter, and don’t come from existing trusted developers are gonna be subject to extra scrutiny.
For two, in order for a malicous (new) project to be a real problem, it has to gain enough popularity to reach its targets, and the open source ecosystem is pretty freakin’ huge. There’s two main ways that happens: A) it was developed, at least partially, by an established, trusted entity in the ecosystem, and B) it has to catch the eye of enough trusted or influential entities to gain momentum. On point B, in my experience, the kind of person who takes chances on small, unknown, no-name projects is just naturally the “exceptionally curious” type. “Hmm, I need to do X, I wonder what’s out there already that could do it. Hey, here’s something. Is it worth using? I wonder how they solved X. Lemme take a look…”
For three, the open source ecosystem relies heavily on distribution systems, stuff like GitHub, NuGet, NPM, Docker, and they take on a big chunk of responsibility for the security and trustability of the stuff they distribute. They do things like code scanning, binary validation, identity verification, and of course punitive measures taken against identified bad actors (I.E. banning).
All that being said, none of the above is perfect, and malicious actor absolutely do still manage to implant malware in open source software that we all rely on. The hope is that with all of the above points, as well as all the ones I’ve missed, that the odds of it happening are rare, and that when it DOES happen, it’s way easier to identify and correct the problems than when we have to trust a private party to do it behind closed doors.
Great recent example, from last year: https://www.akamai.com/blog/security-research/critical-linux-backdoor-xz-utils-discovered-what-to-know
Me, I see this story as rather uplifting. I think it shows that the ecosystem we have in place does a pretty good job of controlling even the worst malicious actors, cause this story involves just about the worst kind of malicous actor you could imagine. They spent a full 2 years doing REAL open source work to develop that community trust I talked about, as well as maintaining a small army of fake accounts submitting support requests, to put pressure on the project to add more maintainers, resulting in a VERY sophisticated, VERY severe backdoor being added. And they still got found out relatively quickly.
They do try, but many vigilant members of the FOSS community do their best to find out what’s being done and prevent it.
You can read this summary of the attempt to inject a malware payload into a widely used compression tool that is used when remotely accessing servers: https://www.theverge.com/2024/4/2/24119342/xz-utils-linux-backdoor-attempt
It was a close call with potentially dramatic consequences, where a bad actor took 2 years to progressively gain reputation and rights to a key FOSS project, and one performance obsessed engineer to find out what they did and undo everything.
The big difference between FOSS and closed source software is that FOSS gives the possibility to audit the code, whereas binary analysis / retro engineering is much harder.
If it’s open source, then the source code of the malware is also open. Generally, binary blobs aren’t included in open source programs, and when they are with no good explanation, it raises a lot of suspicions.
Closed source is where malware can readily be hidden, which is why there is tons of malware hidden in Windows and Android apps.
What’s to stop Closed Source software from the same?
Checks and balances, and money… people won’t buy your product if it’s malware…unless you make them a captive audience (win11, tencent).
What do you mean by checks and balances in this context?
That doesn’t stop any of them. Windows users still go, willy nilly, traipsing around the internet downloading and installing random things. There is no money, no checks and balances. I’m sure you’ve read Windows converts complaining, “Linux isn’t ready for the average user because it’s too hard to install programs, they want to be able to download an installer, then click next next next and have the application installed.” They think the security of package management is too much for the average user.
Sure, FOSS could get some bad actors. It would be no different than the closed source community. At least with FOSS, there is still opportunity for people to find and eliminate the bad code. The world runs on Linux and FOSS. The place where you would want to sneak in some bad code the most. You’d have a much bigger impact. And, it does happen on occasion, people notice, and the bad code is removed. Compare that to the much smaller, Windows world, where you need anti-virus checkers and maleware checkers.
It sounds like you have the computing world inverted. You believe Windows and closed source is the most dominant computing paradigm. It’s not.
Lots of companies keep getting in little trouble by doing stuff like hard coding passwords and leaving backdoors
It’s even easier if it’s closed source.
Nothing? but the very fact that it is open source makes it much easier to detect malware, I guess. But I don’t think that closed source is better in this regard, rather worse, because corporations love spyware.
See Solar Winds
It does happen, the most notable one that I can remember is XZ Utils. The good thing about open source is eventually someone will spot it and call them out.
Just an additional note: the xz backdoor is well known because it was found. It was found mostly because it’s foss. It’s doubtful it would’ve been found if it was closed source.
Imagine how many xz-like exploits are live today that hasn’t been detected yet. Is this exploit more prevalent in open source or closed source software?
Nothing. Nobody properly analyzes the code usually. It’s just you trust it more because of the fact of it being open.
