Spend any time in the enterprise IT world, and you’ll quickly be led to believe that open source software is insecure, and only what you use when you can’t afford “real” software. Both are false. This is a form of FUD (fear, uncertainty, doubt), which has been historically encouraged by those who sell open source’s proprietary alternatives. When talking about the security of open source, there are two parallel conversations. Open source as a platform, and open source as a workflow.
Open source as a platform
The first threshold issue is whether building or using open source software, even if your own particular code isn’t published, is somehow inherently less secure. This argument has a few flavors:
This one (high profile) open source project that (once) had a vulnerability
There’s good software and there’s bad software. How widely the code’s shared has no direct impact on its quality (if anything, it helps, see below). An immature project is going to have bugs, whether proprietary or open source.
Often times, the reason open source software vulnerabilities make headlines, or seem to make headlines more often, is because it’s so widely used. Your custom built software being hacked isn’t newsworthy, but the CMS that powers a quarter of the internet is. And because the code is open, vulnerabilities are discovered and patched more easily, meaning you may hear more often about open source software having unexploited vulnerabilities, while the only closed-sourced vulnerabilities you hear about are those which have already been exploited in the wild (and thus require immediate action).
It’s (not) made by a bunch of hobbyists
That’s true of some projects, for sure. Plenty of fly-by-night software companies sell subpar, closed-source software. Again, quality is quality. Chances are, the project made in the developer’s mom’s basement isn’t going up against the one made by the company that makes “enterprise-grade” solutions. Like anything else, look to who’s behind the software and who else uses it. Major projects like Linux, WordPress, and Drupal are led by teams of professionals, relied on by thousands of for-profit businesses, and have “suits” supporting them, to ensure their success.
A distributed workflow has a real advantage. Lots of closed-source solutions, influenced by nine-to-five, Monday-to-Friday workflows, stringent release cycles, and press paralysis, are forced to delay releases that patch critical vulnerabilities, often for years. Open source projects, guaranteed to have someone awake at any hour of the night, can turn around that same patch, literally within hours of the vulnerability being reported.
Open source as a workflow
The second form of open source FUD attacks open source as a workflow, meaning that publishing your software’s source code somehow makes it less secure. Again, this argument comes in a few flavors.
Anyone can (not) make changes
Anyone can see where the vulnerabilities are (and fix them)
This is predicated, almost exclusively on the (disproven to death) strategy of security through obscurity. It’s a form of security theater. It’s the idea of hiding a key under the welcome mat. It assumes that, if the bad guy doesn’t know it’s there, it’s secure, right? Wrong. It’s the same reason building blueprints can be available for public inspection (and city review), without increasing the chance of a break-in (and we end up with stronger, more fire resistant buildings as a result).
When everyone can see the inner workings (including those you want to keep out), you’re forced to build inherently secure systems, rather than systems that rely on smoke and mirrors. As a result, statistically, open source software actually produces more secure software than its closed-source counterparts.
We (won’t) reveal our secrets
Open or closed, industry-standard best practices dictate you shouldn’t have secrets in your code. Passwords, tokens, server names, anything remotely secret (heck, anything that changes between development, staging, and production) belongs in the database, an environment variable, or a VCS-ignored configuration file, not distributed with the software itself.
For one, you’ve potentially got outside contractors or others in your code, which shouldn’t be an access control mechanism in itself. For another, best practices once again dictate that such configurations aren’t shared between environments, and are rolled often, something much harder if it requires a code change and deploy. Open sourcing your code forces you to keep application logic and system-specific configuration, secret or otherwise, separate.
Can open source be insecure? Sure. Is there insecure open source software? Sure again. But the idea that a language, platform, or workflow, based solely on its philosophy, is somehow inherently less secure is absurd. Done right, I’d argue open source is often more secure than closed source or proprietary alternatives. Either way, not all software must be closed source and the decision of whether a particular piece of software should be open or closed should be defined by industry-best practices, not by fear.