As of late, I've found my self in the middle of quite a few debates on open source network/system security. Specifically, I've had to defend a number of projects who only use open source tools, and post details of their infrastructure online (such as firewall rules), for others to criticize and comment on.
In my opinion, there is no problem with this, as the groups I've defended only expose well-known, battle tested, security audited, and heavily supported dependencies/services, such as Django and OpenSSH. They also have very simple firewall rules and configurations which block out all other ports. To me, this seems practical and removes much (although obviously not all) of the risk from their hands.
However, I also see the other side, and understand that this could be risky for smaller projects that don't have many people reviewing their code. This also, unlike a proprietary solution, exposes technical data about security to a potential attacker, which is a risk... although I've also heard people argue that it doesn't actually make any practical difference.
Here's a simple, but good article on Wikipedia that covers some points on each side. This article is more about software... but many of the arguments still apply or translate: https://en.wikipedia.org/wiki/Open-source_software_security
The point is, I've already had my debates about this, and now I would like to hear from everyone else. What do you think? Do you think that "security through community" is a good idea? Is it the way of the future? Or is it the beginning to the end for any company that takes this approach? Are there some approaches that are good, and others that are bad?
In my opinion, there is no problem with this, as the groups I've defended only expose well-known, battle tested, security audited, and heavily supported dependencies/services, such as Django and OpenSSH. They also have very simple firewall rules and configurations which block out all other ports. To me, this seems practical and removes much (although obviously not all) of the risk from their hands.
However, I also see the other side, and understand that this could be risky for smaller projects that don't have many people reviewing their code. This also, unlike a proprietary solution, exposes technical data about security to a potential attacker, which is a risk... although I've also heard people argue that it doesn't actually make any practical difference.
Here's a simple, but good article on Wikipedia that covers some points on each side. This article is more about software... but many of the arguments still apply or translate: https://en.wikipedia.org/wiki/Open-source_software_security
The point is, I've already had my debates about this, and now I would like to hear from everyone else. What do you think? Do you think that "security through community" is a good idea? Is it the way of the future? Or is it the beginning to the end for any company that takes this approach? Are there some approaches that are good, and others that are bad?