6 ms·

> BitTorrent Sync remains the most secure and private way to to move data between two or more devices. That very first sentence will always be false as long as

by toggle 12y ago

> BitTorrent Sync remains the most secure and private way to to move data between two or more devices. That very first sentence will always be false as long as it isn't open source. (Even the protocol isn't publicly documented, last I checked.) I'm not an open-source purist, but the way they always promote as being the most secure, private option out there while completely ignoring that fact is frustrating. I haven't tried using it, but Pulse[0] appears to be an open source replacement for BitTorrent Sync. I figure it's relevant to this thread. [0]: https://ind.ie/pulse/ https://ind.ie/pulse/ EDIT: ef4 mentioned Syncthing in his comment. Pulse was forked from Syncthing. I think they're still compatible with each other at the moment. Nice explanation at https://discourse.syncthing.net/t/syncthing-is-still-syncthing/1372 https://discourse.syncthing.net/t/syncthing-is-still-syncthi....

trickz 12y ago
How would open sourcing it make it more secure? I mean, I understand that doing so would let you look at the code, and maybe even have others find and plug security holes, but your statement seems to imply that closed source is less secure by default, unless I'm missing something.
- mkonecny 12y ago
  Doesn't necessarily make it more secure, but will increase the confidence that it is the most secure through peer review. Any company will say their products are secure/the best etc. - proof is what makes those claims legit.
  - trickz 12y ago
    Yep, that's fair.
    - jmathai 12y ago
      Completely agree that open source is critical to making claims about security. Else you're asking people to trust you. Not to be pedantic but the gotcha is that you can't know they're using the open source software as-is. If they run a hosted service or distribute binaries you won't know. Also with cryptography any change (diverging from the open source software) can have regressions.
      - virtue3 12y ago
        I thought about this a lot when trying to come up with a very secure open source email service. Is there perhaps a way to show hashes for the coded binaries/etc that are used that could actually be trusted to be correct? It just seems like such a chicken/egg problem. Where does the actual trust come from (like holy crap web certificates seems unbelievably broken). Ultimately it seems like it's just impossible to be 100% for sure what is running on another persons server without having access to it. Which is unfortunate.
      - stormbrew 12y ago
        The answer to this, for something like btsync, is that you shouldn't really be trusting the servers outside your control to begin with. That's the whole point of these systems as opposed to the usual cloud model where you're throwing plaintext up to a server and hoping their security model holds. If the client software is all that's ever supposed to see plaintext, being able to see source allows you to confirm that that is (probably) the case and then compile it yourself rather than trust that they haven't thrown an extra step in that backdoors it.
  - tedunangst 12y ago
    I think 2014 should be the year we finally retire the millions of eyeballs meme. Open sourcing something does not magically cause people to review it.
    - click170 12y ago
      No, but it does make it possible for those few who do. And that's a few more than would have reviewed it if it was closed source. It's not perfect, but IMO this is one of the best parts of Open Source, I can audit it if I want to. Closed Source strips me of that option. Edit: Clarification.
      - wglb 12y ago
        I can audit it if I want to But seriously--do you? Or others that you know working in the field?
        click170 12y ago
        Yes I have, several times. Sometimes it's to find out what the heck is the cause of a particular behavior in a program, sometimes it's to know for sure that the program isn't trying to do anything that I recognize as malicious in a security sensitive environment, other times it's to see exactly how a game is calculating whether or not my bullet has hit the enemy (server side calculation is more difficult to fake than client side). Would you honestly chose a black-box solution for a business critical need, knowing that it could stop working at any time and won't let you know for sure that the code is secure by auditing it (or paying a trusted security professional to do so for you)? I get the impression that the anti many eyes sentiment comes largely from non-programmers, am I wrong about that?
        acdha 12y ago
        > I get the impression that the anti many eyes sentiment comes largely from non-programmers, am I wrong about that? I've only heard it from programmers, generally very good ones. Anyone who is at all following the security community knows that many eyes is possible but generally very optimistic. That's why so many people were glad to see Heartbleed lead to the Core Infrastructure Initiative since that will keep the guaranteed number above zero for some key projets.
- 5293qhofeo 12y ago
  Security is a poor word, but if we define it as quality (reliability, fitness for a stated purpose, logical consistency, etc), then access to source code allows peer and public review. IMHO, free software is just the scientific method (loosely) applied to programming (with a moral context). Test-driven development is an attempt to tighten up the hypothesis-implementation-analysis loop.

by toggle 12y ago

trickz 12y ago

How would open sourcing it make it more secure? I mean, I understand that doing so would let you look at the code, and maybe even have others find and plug security holes, but your statement seems to imply that closed source is less secure by default, unless I'm missing something.

mkonecny 12y ago
Doesn't necessarily make it more secure, but will increase the confidence that it is the most secure through peer review. Any company will say their products are secure/the best etc. - proof is what makes those claims legit.
- trickz 12y ago
  Yep, that's fair.
  - jmathai 12y ago
    Completely agree that open source is critical to making claims about security. Else you're asking people to trust you. Not to be pedantic but the gotcha is that you can't know they're using the open source software as-is. If they run a hosted service or distribute binaries you won't know. Also with cryptography any change (diverging from the open source software) can have regressions.
    - virtue3 12y ago
      I thought about this a lot when trying to come up with a very secure open source email service. Is there perhaps a way to show hashes for the coded binaries/etc that are used that could actually be trusted to be correct? It just seems like such a chicken/egg problem. Where does the actual trust come from (like holy crap web certificates seems unbelievably broken). Ultimately it seems like it's just impossible to be 100% for sure what is running on another persons server without having access to it. Which is unfortunate.
    - stormbrew 12y ago
      The answer to this, for something like btsync, is that you shouldn't really be trusting the servers outside your control to begin with. That's the whole point of these systems as opposed to the usual cloud model where you're throwing plaintext up to a server and hoping their security model holds. If the client software is all that's ever supposed to see plaintext, being able to see source allows you to confirm that that is (probably) the case and then compile it yourself rather than trust that they haven't thrown an extra step in that backdoors it.
- tedunangst 12y ago
  I think 2014 should be the year we finally retire the millions of eyeballs meme. Open sourcing something does not magically cause people to review it.
  - click170 12y ago
    No, but it does make it possible for those few who do. And that's a few more than would have reviewed it if it was closed source. It's not perfect, but IMO this is one of the best parts of Open Source, I can audit it if I want to. Closed Source strips me of that option. Edit: Clarification.
    - wglb 12y ago
      I can audit it if I want to But seriously--do you? Or others that you know working in the field?
      - click170 12y ago
        Yes I have, several times. Sometimes it's to find out what the heck is the cause of a particular behavior in a program, sometimes it's to know for sure that the program isn't trying to do anything that I recognize as malicious in a security sensitive environment, other times it's to see exactly how a game is calculating whether or not my bullet has hit the enemy (server side calculation is more difficult to fake than client side). Would you honestly chose a black-box solution for a business critical need, knowing that it could stop working at any time and won't let you know for sure that the code is secure by auditing it (or paying a trusted security professional to do so for you)? I get the impression that the anti many eyes sentiment comes largely from non-programmers, am I wrong about that?
        acdha 12y ago
        > I get the impression that the anti many eyes sentiment comes largely from non-programmers, am I wrong about that? I've only heard it from programmers, generally very good ones. Anyone who is at all following the security community knows that many eyes is possible but generally very optimistic. That's why so many people were glad to see Heartbleed lead to the Core Infrastructure Initiative since that will keep the guaranteed number above zero for some key projets.
5293qhofeo 12y ago
Security is a poor word, but if we define it as quality (reliability, fitness for a stated purpose, logical consistency, etc), then access to source code allows peer and public review. IMHO, free software is just the scientific method (loosely) applied to programming (with a moral context). Test-driven development is an attempt to tighten up the hypothesis-implementation-analysis loop.