If you say that people do check FOSS code for errors and functionality but no one tests for security then I agree with you. I guess no one puts the effort to check the vulnerabilities of said software as it is not is "responsibility" but I have to say again in the case of linux I find that hard to believe given how many fortune 500 companies use that software but none would put the effort to check the security. Stupid, isn't it?
As a none coder, those submissions are not reviewed before implemented in the source code?
You are correct. i do not know. I just assumed there is some sort of "best practice" in writing code to make it none vulnerable.
I'm afraid writing code it's a whole lot more complicated and - for the lack of better term - non-linear than you think. While I am not a developer, I did some coding for fun every now and then. It's not as straightforward as designing a mechanical device. The "best practices" are just general recommendations, not a set of step-by-step rules. Lots of modern coding is taking "blurbs" or libraries already written by others, and adapting them to your needs and filling in the blanks. If writing code was so easy, straightforward, and following easy rules and patterns, most of it would have been automated years ago.
The code – I thought – was checked by project maintainers before if it adheres to those "best practices" . If you are thinking "this guy does not know what he is talking about" you are not wrong, I am just discussing my POV to my limited knowledge.
It's checked for functionality, not for vulnerabilities. And I am speaking about kernel code. I don't know how much checking goes into component code (e.g. something like Gnome desktop), or drivers, or apps. A lot of time they seem to release it first and deal with fixing bugs later.
Think about a lock. A lock may be sticky, have problems with inserting the key, or not reliably locking. Or it may have some obvious design problems visible to someone with experience. These are all bugs, and they often get checked for - not always.
Now imagine that you have a lock that looks and operates great, but if you hit it with a mallet against a particular spot on the lower left side while simultaneously pressing on the keyhole with a screwdriver, and the outdoor temperature is below freezing, you can open it without a key. This is a vulnerability, specific to this particular design, which can only happen when a set of random variables aligns in a very narrow, specific set of values.
How do you check for something like that ? You would need a very different approach to finding these things, a specific experience and mindset, and it would take an order of magnitude longer. And it would be especially hard to find if that vulnerability didn't just occur sporadically, but was deliberately designed by a malicious lock designer who took pains to make it harder to discover (at which time, it's called a backdoor).
That's why I am saying that it's very unlikely that over 70 million lines of Linux kernel code, several hundred millions of lines of components code, and god knows how many lines of code for drivers and apps, all accumulated over the last 30 years, and wrtten by hundreds of thousands of coders from all over the world, some professionals and some amateurs, using vastly different approach to coding, has ever been validated from security perspective. They can't even keep up with bugs.
Are you saying there are companies that did discover the vulnerability, and will sell that to payers? thats vile! Shouldn't this be illegal? its like selling a device to bypass metal detectors in an airpot.
Yes, that's exactly what am I saying. How do you make it illegal for a programmer in Ukraine to sell a vulnerability discovered in the free open source code to some governmental agency in China ? What jurisdiction's laws are broken here, and whose IP rights have been violated ?
en.wikipedia.org
Linux foundation can buy this info though, and fix the vulnerabilities, I hope they have enough money from all those sponsors.
They barely have enough money to keep Linux development running. And, their approach to security is ... not something I agree with.
So Windows is similarly unsecure ? Someone found the vulnerabilities in Windows?
Yes. There are vulnerabilities found in Windows all the time. It's an ongoing battle, and will always be. But at least, after the ******** of the early 2000s, Microsoft has been treating security seriously.
I thought you said above the US gov. knows the vulnerabilities and willing to keep it that way for their advantage and not to fix the vulnerabilities in Linux.
Not just the US government. At least the US govt is interested in keeping Linux secure for the sake of global economic system.
Well noted. Makes sense.
Honestly, no, but I assumed Linus and the guys are doing that work.
Linus can't personally check billions of lines of code.
He also has a rather cavalier approach to security - from my personal perspective. He dismissed Liniux security concerns as "just bugs" and has been very vocal about his opinion of security people being paranoid morons who only interfere with software development. "F...king morons" was the exact quote that I recall.
Here's one article that discusses his views on security. Note that there's no mention of someone deliberately inserting vulnerabilities at all. It's all "bugs" to him so if there's a good process for finding and squashing bugs, he's fine. Except as I said, a bug means something doesn't work as intended; with a vulnerability or a backdoor, everything works as intended while packing a nasty surprise; with Linus' approach, these things would never be discovered.
Linus Torvalds made a surprise appearance at LinuxCon and talked about containers, security, and IoT, among other topics.
www.cio.com
As to why corporations and banks keep using Linux servers - well think of Kia. Some Kia cars used to be easy to steal using a simple software hack that allowed someone to remotely open and start the car using a phone app. Now say you own a Kia and park it in the street in front of your apartment, or in an open parking space behind your office building. A company owns 30 Kias they use to drive between their offices, and they are all parked in underground garages with locked gates and armed security. The cars are equally vulnerable to that backdoor code, but these corporate cars are a whole lot harder for the bad guys to get to.
