Week 3: Open Source vs Closed Source

[gu-ana]

I'm all in favor of open source things but closed source is "sometimes" good as well. Case in point is Microsoft word vs Libre Office. Just because something is free doesn't mean it's good.

Open Source
Pros:

• All source code is available for view
• There is usually a community that will release updates and drivers to ensure the product will run smoothly
• Arsenal of people willing to contribute if the product is good
• usually FREE
• Linux is an example B)
• Sometimes has good documentation
  Cons
• Updates are purely up to the digression of the maintainers, if they no longer feel like support the product, you'd have to maintain it yourself.
• Usually no dedicated "customer support", so if your product breaks, you have to fix it yourself
• No money :(
• Possible slow updates because hobbyists maintain the code

Closed Source
Pros:

• Maintained by people who are paid to do so
• Cannot access source code or very limited source code
• Faster development time for bugs or new features (usually unless you use bloomberg)
• Compensates people for their work as a dev
  Cons:
• Updates are dropped on legacy hardware
• not FREE
• No control over the product, hard to change things if not explicitly given the opportunity in the API.
• If there is an important bug, you're at the mercy of the company pushing out an update.

[vcta99]

Hi Ana! Loved how clear and straight to the point the bullet points are for the thinking cap. I wanted to ask though, why is, "Cannot access source code or very limited source code" a pro for closed source? Is there a benefit from a user perspective in not accessing the source code?

[Wny-Duong]

This is just my understanding of why it would be a pro, I don't know what Ana would say to this. The idea behind limited access to source code as a pro comes from the fact that if some malicious person wants to exploit a vulnerability in your software, then trying to limit their access to your source code would be a good thing since it makes it somewhat harder for them to find vulnerabilities in the software. This is technically true in the sense that having a closed system does limit the information easily accessible to some bad agent, so you could consider it a pro in that way. So the user benefit in not being able to access the source code, through this logic, is increased security of the software.

In real world applications, however, there's typically workarounds to this technically true statement [1]. There's software that lets you disassemble executable software anyway to recreate the source code. There's ways to attack and create vulnerabilities in software without needing to look at the source code at all. And there's closed source software that gets leaked or stolen anyway. Because of this, it's technically pro or a con since there are benefits to security when it comes to open source (like having extra eyes on source code to find vulnerability) as well. It really just depends on where your priorities are security-wise, are you worried about how easy it is to exploit a vulnerability or are you worried that you might not catch a vulnerability before someone can exploit it?

Source:
[1] (Director of Open Source Supply Chain Security @ Linux) https://dwheeler.com/secure-programs/Secure-Programs-HOWTO/open-source-security.html