Here is how "I" understand how FOSS works. The code is there, any one can read, when someone wants to adjust something he submits his "adjustment" . This adjustment is reviewed by some central authority/developer/github and approves its addition to the code. If any one can write code and auto-add it to the codebase I think we will see chaos. So surely someone is seeing it right?
I think you greatly overestimate what "seeing" means. They check the code for coding errors and functionality. They don't check it for vulnerabilities unless they are very obvious. They definitely don't check it for deliberately inserted vulnerabilities and backdoors, they have neither the resources nor the time.
And this code is submitted by people all over the world. Many if not most anonymous. Many what the Linux kernel maintainers themselves refer to as "drive-by contributors" who provide a single blurb of code to fix a bug or create a solution, then don't contribute again. Some contributors are teams associated with colleges. Which means that the people in them change all the time. It should be trivial for some foreign government hackers to set up a relationship with kernel maintainers using some state run college as a front end, keep submitting good code of high quality for a couple years, then carefully inject backdoors in one of the submissions.
A year or so ago some University of Minnesota "researches" had deliberately submitted bad code to Linux kernel maintainers as a proof of concept, then published a story somewhere. This caused a major **** storm, with kernel maintainers going back and removing university submittals from prior years, and banning it from future contributions (not sure where it stands now, I haven't been paying attention lately). At that time, there was a link on Reddit to the kernel maintainers' group discussion forum. This was an eye opener to me. This is where I found references to "drive-by and anonymous contributors" that the group was concerned could be discouraged from submitting code if the rules were tightened; to checks being less rigorous if the contributors had already established trust with maintainers; that despite what some claimed, some of the code contributed by UMN team was already inserted into the kernel; and the overall attitude of "it's entirely their fault, how dare they to betray our trust like that", with very little acknowledgement of the core problem.
If I find it, I'll post a link to that site.
#2 , Linux is built fully by programmers along with its apps out of care. I assume most of them build it for themselves and share it with the community. The OS and the apps are used by
professionals and
corporates like Google. So I am just guessing those corporates at least have someone to review the code and point out any issues before deploying it on the AMZ , Azure, Bank, Cloudflare, whatever else.
Look at the big names sponsoring linux. No one is looking at the code?
Linux Foundation claims 777K developers contribute to the code, thats a lot of unqualified and unexperienced people including Linus himself.
I don't think you understand the difference between writing code, and securing it. Writhing is where the bugs and vulnerabilities are introduced. Bugs manifest themselves by unexpected code performance. Vulnerabilities are sitting there silently waiting to be discovered.
All of these developers are writing code. Mountains of it. Over 70 million lines of kernel code alone.
How many are securing the code that has already been written by others ? It's a painstakingly hard, boring, thankless work.
#3 There are literally millions of of people who are black hat hackers, security scientist/researchers, universities students, cyber security organizations, and even state intelligence agencies by Russia, China, and USA none are looking for these vulnerabilities to spy on each other or protect their own systems? idk...
Of course they are. But not to fix them. A backdoor in a major OS is a goldmine for government agencies. The US government is sitting on many hacking tools and code it will not disclose, and will only quietly fix if the benefit of doing this outweighs the benefit of having access.
There's a thriving market for selling code vulnerabilities.
There's also a thriving commercial industry built around securing Windows, because that's where the money is.
There's no such industry built around securing Linux. The US gov't is trying to fix that.
As for the links you provided, as you have pointed out in your post
#426 , all these eyes watching and monitoring did not figure out this security vulnerabilities?
This is exactly what this says, isn't it ? These vulnerabilities existed in Linux core code for 12-15 years without getting fixed. So, either they were unable to "figure it out", or the people who figured them out were uninterested in having it fixed because someone else was willing to pay for that information.
yeah, so why can't we say Windows is just filled of security holes as Linux? Maybe 15 years down the line they will say they found a security hole in Windows thats been there since XP days.
Unless there is some professional test that indeed Windows/MacOS is more secure than Linux, why would we just assume Windows is more secure?
Windows is not "closed source" in the sense that nobody but a few select MS employees see the code. They have bounty programs and have been partnering with security researchers for two decades now to find and fix bugs. They pay them to do it full time. If you have the right qualifications, you can apply, sign NDA, and get access.
And yes, Windows, despite having control over who contributes to the code, having internal QA procedures, and paying specialists to work full-time to secure the code, still has vulnerabilities. The simple logic says that Linux, which has little control over who contributes the code, doesn't have a team of highly paid security researchers, and is an extremely fragmented field with gazillion distros, should have far more of them.
And if there was a professional test to find vulnerabilities, there wouldn't be many. You can compare the numbers of vulnerabilities found and published, but it's not a good comparison since there's not a uniform approach to that.
Don't get me wrong, if you were speaking of
Haiku or
ReactOS I would 100% agree with you, but there is just too many eyes and a corporate/gov dependance on Linux to be called "filled with security holes".
As I said many times, "many eyes on the code" is a fallacy. Show me how many eyes have actually inspected the code. Have you looked at Linux kernel code ? Do you personally know anyone who is a qualified security researcher and inspected Linux kernel, or drivers, or programs ? Writing code is fun, securing code is boring.
And corporate / Govt don't use Linux desktops, unlike an average Joe. They mainly use it for servers, inside a secured environment, where OS vulnerabilities are somewhat negated by the security policies and people employed full-time to monitor traffic. And they are getting concerned with the state of Linux security - see my original post with MIT article.
hey, really beautiful Profile pic. kudos!
Thank you ! It's one of the many beautiful murals in downtown Detroit. It's like an open sky art museum.
