We know of Linus' law:

With enough eyeballs all bugs are shallow

In general, people seem to say that open-source software is more secure because of that very thing, but...

There are many small OSS projects with just 1 or 2 developers (the cathedral model, as described by ESR). For these projects, does releasing the source-code actually lower the security? For projects like the Linux kernel there are thousands of developers and security vulnerabilities are quite likely going to be found, but when just some few people look through the source code, while allowing crackers (black hat hackers) to see the source as well, is the security lowered instead of increased?

I know that the security advantage closed-source software has over OSS is security through obscurity, which isn't good (at all), but it could help to some degree, at least by giving those few devs some more time (security through obscurity doesn't help with the if but with the when).

EDIT: The question isn't whether OSS is more secure than non-OSS software but if the advantages for crackers are greater than the advantages for the developers who want to prevent security vulnerabilities from being exploited.

4 Answers 4


I think it probably does lower security a bit, for an open source project that's so small or obscure that nobody but its authors are really looking at it. In that case, you aren't getting any help with security from a community, but if someone did for some reason target your small obscure project, they'd have an easier time since they'd have the source. Not that they'd have an impossible time without source, but having the source speeds up understanding, whether your intent is friendly or malicious.

A lot of the most common web vulnerabilities (HTML escaping issues, SQL injection, etc.) are pretty easy to check for without having source, too, so it's not like keeping things closed will mean you're safe.

I'd tend to think you're better off just doing what makes sense on the license (open or closed) independent of security concerns, and then treat security as something to worry a lot about either way.


Open Source just means commonly available code/apps, that help you get started. Do not by default assume because it's open source it is good or bad code, you must always double check any code. For quality, commenting, documentation, how easy is it to upgrade/change.

Use a security checklist to identify all possible problems, and use that for whatever language/server/os you use, whether the code is open or closed source

  • I don't assume that, I have seen many and many open-source programs which weren't even remotely of good quality. What I asked was whether the decreased time for finding vulnerabilities is a greater advantage to the good or bad guys for OSS projects with a very small dev base
    – Anto
    Commented Feb 25, 2011 at 16:32
  • Fair point. Just seen too many people just go blind, and that always encourages less effort into code quality.
    – crosenblum
    Commented Feb 25, 2011 at 16:49

Security of code is ensured only by implementing a proven security algorithm correctly. This is in fact easier to verify with open source code, i.e. bugs get sorted out faster. I believe the widely used security algorithms like SHA et al. are published, still their availability doesn't make it any easier for crackers to crack them. It is the proven mathematical theory behind them which makes them secure.

As for small open source projects, I guess it doesn't make sense to publish code anyway when it is only half baked and not functional. From the security perspective, this means it should be thoroughly reviewed, preferably by as many security expert(s) as possible, and/or against a security checklist as @crosenblum suggests.

  • But what if the program is vulnerable to say a buffer overflow, finding that helps crackers
    – Anto
    Commented Feb 25, 2011 at 16:33
  • @Anto, please see the update I added in the meantime. Commented Feb 25, 2011 at 16:39
  • I see your edit, but some small vulnerability might still have slipped through, it happens very often in fact, just look at Windows ;)
    – Anto
    Commented Feb 25, 2011 at 16:39
  • 1
    It's not about publishing code which is half baked, it's about the fact we all make mistakes. In a closed source project those mistakes are there but they're better hidden. In a small open source project on the other hand they're there for everyone to see. If the project is small enough that there aren't going to be lots of developers finding and correcting those mistakes, the question is does the risk outweigh the potential benefits? Commented Feb 25, 2011 at 16:43
  • 1
    @Jon, I understand. But maybe if the project is so small that not many developers are interested in it, this also lowers the risk of crackers being interested isn't it? Commented Feb 25, 2011 at 17:13

You can think of Security as a state. A given piece of software has some level of security, but unless mathematically proven.. that level is unknown.

Publishing source code doesn't make your code any more or less secure, all it does is change the amount of information that is known about your software.

What publishing your code can do is make it easier for someone to exploit a vulnerability. That vulnerability is there, whether or not you publish the code. It's just as insecure. The question comes down to how much effort it takes to create and exploit.

As an example, 10+ years ago, it was very difficult to exploit buffer overflows. In fact, not much attention was given to them as a security issue because it was thought to be too difficult to exploit.

Since that time, people have figured out ways to easily exploit those vulnerabilities, and have even written software to do so automatically. Did those applications that were vulnerable to these exploits become less secure? No, they were always that insecure. All that changed was the knowledge of how to exploit it.

So, to summarize... Not publishing your code won't make you more secure, but it can make it a little more difficult for someone to exploit you. And, over time, that advantage will likely go away.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.