Back story:

My best friend is a self-taught coder for a community art site, written in PHP. Some time ago he mentioned he wanted to make the source code of the site public, to which my response was total horror - surely it was going to be full of security holes waiting to be found, and it was going to lead to hacking and errors on a huge scale. He never ended up doing it.

Current story:

I'm starting development of a community website built in Rails, and for ease of use I was going to use Github for version control. Then I realized it was pretty much exactly the same thing as my friend making his source code public - which made me stop and think.

Would you make your website's completely-custom source code public? Or is this a case of open source gone too far?

(note: I don't think this applies to people who run things like Wordpress. Or does it?)

  • 2
    Interesting thought experiment: Compare the rate of security vulnerabilities in the open-source Apache web server, with those in the closed-source IIS.
    – Anon.
    Feb 17 '11 at 1:14
  • 5
    @Anon yeah, but Apache has been heavily tested and audited by hundreds of people for several years. The OP's web site probably has not.
    – Pekka
    Feb 17 '11 at 1:18
  • @Anon: last time I checked, there were mer cert advisories out about Apache than IIS . . . Feb 17 '11 at 1:24
  • @Anon @Pekka No it hasn't, it's a brand new site. Feb 17 '11 at 1:28
  • If the code is good, it's not a security hole to release the source code. That's why there's so many open-source frameworks. However, I would guess that a new, self-taught PHP developer will have very little idea about web security, especially in a language that actually lets you ignore so many basic security principles. Of course, any language can have its security holes but homebrew PHP projects are especially notorious for poor web security. If you don't believe me, just look at the number of websites found by google that have SQL strings in the url. Jun 14 '11 at 17:28

It's fine!

If you're planning to dump out your database that contains private information about anything, I urge you to think again. In terms of security, if it's obvious that you haven't sanitised your user input, well... I guess you'll learn that lesson one way or another. Apart from the obvious security loopholes (which you should be avoiding anyway), think about how much time it'd take for you to browse the code of another web site and look for potential exploits. (Ages.)

Regarding intellectual property and all the genius ideas that you'll come up: there are probably people out there that are smarter than you, so nothing of yours is going to stolen.

  • 1
    No I wasn't going to include database dumps, though I hadn't thought as far as to how to not include database connection info in the repository. (I know enough not to, though.) And oh there are many many people out there smarter than me.... just made me think. Feb 17 '11 at 1:27
  • @karpie as far as the private keys and passwords are concerned, you may always specify those files in .gitignore or .hgignore. Like in case of django it is settings.py file
    – crodjer
    Feb 17 '11 at 15:13

Your thinking on the security is exactly backward. You should really only trust the code to be secure if it has been published and examined by at least a few security experts. Putting your code on github (or whatever) is much more likely to help security than hurt it. In fairness, getting security right -- or at least reasonable -- with RoR is a lot less problematic than with PHP. Nonetheless, if you want it secure, you'd be a lot better off making it public for a while before putting it to use (especially if you can convince somebody who knows security well to look at it...)

  • The problem here is the last point (getting someone that knows security to look at it, thoroughly).
    – Gipsy King
    Feb 17 '11 at 12:06
  • @Gipsy King: That can be difficult -- but publishing the code increases the chances from none to at least some... Feb 17 '11 at 14:09

You could make it public, but unless you are a 'name' company, will anybody care enough to look?

  • 1
    This is a fair point. Feb 17 '11 at 2:18
  • I think it is a bit of a myth with open source that if you open it they will come. In the vast majority of cases no one comes and the project dies. Sometimes they do come and the project thrives.
    – Craig
    Feb 17 '11 at 2:29
  • @Craig: Sometimes you open it, the company dies, and then several years later something finally comes out of opening it.
    – Anon.
    Feb 17 '11 at 2:55
  • Anon, probably it does. My point really is that Open Source is not a magic bullet to code collaboration.
    – Craig
    Feb 17 '11 at 2:56
  • @Craig: That's because people want products and services targeted for them. Not random code or services that someone releases for free. You don't need to be a 'name' company to have people look at, or for, your work. You just need a product or idea that someone else values.
    – aqua
    Feb 17 '11 at 6:51

I see many people publishing their website source codes and dot-files (Unix configuration files) to sites like GitHub.

Please also consider the case when those hosting sites get compromised and someone smuggles malicious code into your code base/configuration files (like 'alias cd=rm -rf *') and you are going to back pull it someday. SourceForge got compromised recently.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.