Hello everyone, and sorry for my bad english. So lets start with a usual topic about Open Source, and that is “everybody can see the code of a OpenSource programm to see if it is malware”. And my question is: how people that cannot read a single line of a programming language manage to do that? I mean, they can just trust in everybody that say which software is secure or not. If the software is a virus or malware, or poses security risks, people won’t know that unless they’re programmers, and so the same thing happens to these kinds of people as used to happen with proprietary software: they have to rely on those who “know” to find out if something. I find this quite problematic because, as I said, anyone who doesn’t understand the code wouldn’t be able to verify whether such a program is secure or not, and would have to place their trust in third parties. That aside, it’s also worth noting that most software has hundreds, if not thousands, of lines of code, which would make it take longer to parse all that code—and even more tedious than reading a typical “EULA.” Can you think of any way to fix this?
I’ll offer the contrarian answer: FOSS does not guarantee secure software; in-fact, neither does proprietary software, nor government software, nor anonymous software.
As others have mentioned, assurances about software come from audits or by trusting someone reputable who has done the audit. Delivering security guarantees is not what most FOSS projects are meant to do.
So what exactly do FOSS projects do? Why are they any better than proprietary software? The short answer is that FOSS is about continuity. You can and will find FOSS projects from 30 years ago, which have been kept updated so they can run modern machines. The folks doing that didn’t need anyone’s permission to do that; they can just do it.
Meanwhile, if Adobe of MSFT declare that a certain proprietary software suite is going EOL and will not receive any more security updates, then the user base is SOL. FOSS gives a potential route away from this fate, if someone or some group is willing to put the elbow grease into security updates. Even if it’s just one person.
So in the short term, there are no security assurances for either proprietary or FOSS. In the long term, all software cannot escape the unstoppable march of time and vulnerabilities. But at least FOSS has a chance to be corrected, years or decades later.