Open Source Security: Kerckhoffs vs Obscurity
Key Points
- Even operational systems, including Linux, can be compromised and contain malware, but this doesn’t inherently make open‑source software insecure.
- Proprietary software hides its source code (a “black box”), whereas open‑source software reveals the code, allowing anyone to inspect how it works.
- Kerckhoffs’s principle states that a cryptographic system should remain secure even if everything except the secret key is publicly known, promoting transparency and broader review.
- Relying on “security through obscurity” – keeping implementation details hidden to deter attackers – is considered a weak approach compared to open scrutiny.
- Open‑source projects can achieve strong security when they embrace transparency, rigorous peer review, and avoid hidden mechanisms.
Full Transcript
# Open Source Security: Kerckhoffs vs Obscurity **Source:** [https://www.youtube.com/watch?v=HcV4u-nemNk](https://www.youtube.com/watch?v=HcV4u-nemNk) **Duration:** 00:09:56 ## Summary - Even operational systems, including Linux, can be compromised and contain malware, but this doesn’t inherently make open‑source software insecure. - Proprietary software hides its source code (a “black box”), whereas open‑source software reveals the code, allowing anyone to inspect how it works. - Kerckhoffs’s principle states that a cryptographic system should remain secure even if everything except the secret key is publicly known, promoting transparency and broader review. - Relying on “security through obscurity” – keeping implementation details hidden to deter attackers – is considered a weak approach compared to open scrutiny. - Open‑source projects can achieve strong security when they embrace transparency, rigorous peer review, and avoid hidden mechanisms. ## Sections - [00:00:00](https://www.youtube.com/watch?v=HcV4u-nemNk&t=0s) **Debating Malware in Open Source** - A speaker recounts a past debate about Linux malware, asserts that any operational system can be compromised, defines open‑source versus proprietary software, and outlines key considerations for ensuring the security of open‑source projects. ## Full Transcript
about 20 years ago a colleague and I had
a debate as to whether Linux could have
malware in it he said no I said yes
turns out I was right it turns out in
fact any system if it's operational can
be broken into it can be hacked it can
have malware so it shouldn't come as a
huge surprise but that's not to say that
open source isn't secure in fact it can
be very secure but let's take a look at
what are some of the considerations I'm
going to take a look at open source
security in this video some of the
things that we should be thinking about
and then ultimately conclude with some
guidance so that you can make sure your
open source projects are in fact secure
let's start with some definitions first
of all what do I mean by open source
well to talk about this let's first talk
about proprietary proprietary is a
system that's closed I can't see what's
in it if we're talking about software I
don't see the source code I just see the
executable version so it's a black box
to me an open-source project open Source
software in these cases I can see inside
the box I can see how it works I can see
if it's an operating system well I can
see the source code if it's an
application again I can see the source
code if it's uh going to be an AI model
I can see the source code and yes AI is
another example of something where we're
going to be using open- Source models
and then one of the classics is with
cryptography so in this case what I want
to be able to do is see how the crypto
system works that leads us to our first
point Kirk off's principle kirkoff had
this idea that a crypto system should be
secure even if everything except the key
is public knowledge so kirkoff was
telling us that basically if I have
plain
text that I'm going to encrypt I'm going
to put that into my encryption system
and then what comes out is going to be a
bunch of gobbledygook that no one can
understand understand this is the cipher
text plain text Cipher text and the only
thing that should be a secret about this
system is the key this thing right here
that key as it changes will change this
plain text into a different Cipher text
that's it there should be no secrets in
this this should be publicly known and
why is that because the more people that
know it the more review we can do and
the more problems we can tease out of
the system before we put it into
production and that's in fact how the
the rules that we have followed when it
comes to cryptography these days now the
contrary to that is this notion of
obscurity in particular security by
obscurity and you know what security by
obscurity is because you've seen
examples of this imagine at your home
you've got a key to the door now we're
not talking crypto keys we're talking
physical Keys you got a key to get you
into the front door and where do you
hide that so that nobody could ever
figure out where it is well right here
under the welcome mat no one's ever
going to think of that right well of
course that's the idea of security by
obscurity I can't see the key because
it's under the mat so therefore it's
secure yeah not so secure because the
problem is secrecy doesn't end up being
a very good way to ensure security
because Secrets ultimately become known
let's take a look at the Thousand eyes
principle this basically says that if I
have enough people all inspecting open-
source code that they are going to find
the vulnerability and the idea is really
sound the principle Works however think
about looking at a complex system in the
case of Linux there's on the order of 27
million lines of code that's a lot of
stuff and I'm going to find the
vulnerability that's right there okay
even with a thousand eyes looking at 27
million lines of code that's a problem
of scale are we going to be able to
scale the inspection of individuals in
order to find all of the vulnerabilities
and who ultimately feels responsible to
do this a lot of people use open source
but not everyone contributes to open
source and not everyone is looking for
vulnerabilities in open source so it's a
subset of that community that actually
is trained and understands what to be
looking for in the first place and feels
a personal responsibility to go off and
do that level of inspection and then
support if we do find who is going to
fix it who's going to verify that the
fix that somebody wants to suggest okay
we have processes for doing all of this
but the the point is it's not as simple
as just saying we put it out there and
the community finds all the problems and
everything works perfectly it doesn't
now having said that we've had some big
successes so this General principle does
in fact work and I'll give you some
examples two really classic ones and I
just mentioned one of them is Linux
operating system very solid operating
system and it has the ability that you
can configure it to be very secure it's
withstood the test of time for decades
about three decades now and again very
solid operating system we can do some
great stuff with this another example
borrowing from the world of cryptography
the standard that we all use for
symmetric cryptography these days is
called the advanced encryption standard
AES and it was developed in an open-
Source model in other words the
algorithms were submitted everyone had
an opportunity to look at the algorithms
and understand how they work and try to
F figure out if there's a way that they
can break them and so far no one has
found a way to break AES that's anything
faster than Brute Force so that's a
success now so we've had some of those
but how about some of these well we've
had some of those as well uh one of the
most not notable is a vulnerability to a
component called log 4J which is
open-source software that was included
it's logging software that logs
activities included as part of Apache
and it was included in tons and tons of
products in tons of projects that people
worked on individually and in large
groups and we found a few years ago that
there was a vulnerability a very serious
vulnerability in this even though it had
been available for people review for
years there was a serious vulnerability
that gave an attacker potentially
complete control over the system so in
that case the Thousand eyes didn't find
the problem and and ultimately we found
it and now there's a fix but not
everything gets caught is the point some
other things that we found IDC uh
reported in 2023 that there was a
24% increase in software supply chain
vulnerabilities that's a big number
looking at open source and saying we're
using all of this code and that the
number of vulnerabilities is increasing
astronomically and they went further on
to say that it affected roughly 64% of
organizations so it's not like just a
few people are getting hit by this it's
affecting lots and lots of people so as
software grows as these open source
projects grow we're needing to grow our
responsibility our support our skill
level and our ability to to Really
analyze all of these things effectively
now another uh bit of information that
we had from one report
was a problem is that coders will
sometimes encode Secrets directly into
their source code what kind of Secrets
do I mean I'm talking about passwords
I'm talking about crypto keys and things
like that they found that in analyzing
code that there were
4,000 secrets embedded directly into
source code that's a lot and if because
it's source code means anyone could look
at it and see what it was and therefore
anyone could take advantage of it and
those 4,000 Secrets unique Secrets
embedded in open- source
code affected
450,000 projects these again are
alarming numbers so we shouldn't be
doing that but it's not like just a few
people did it it happened on at least
4,000 occasions that this occurred so so
we've got to do a better job we have our
successes but we also have some failures
okay what can we do to avoid some of the
failures that I just mentioned it turns
out there is some good guidance out
there and resources you can take
advantage of there's a group called The
open software security Foundation ossf
their website you can see ossf dorg
includes a lot of good educational
materials so you can learn more about
what you need to do to make this stuff
not fail in addition they have some
guides in particular they focus on open
source development what are secure
coding practices and things like that
that you should follow project
management and project considerations
for running an open source project and
also industry best practices the things
that we've learned that are the time-
tested principles that we know work and
help us avoid that and achieve more of
that so what about that debate is open
source more secure or not I'm going to
say it's not more secure it's more
secure and that's what makes the
difference in other words I have the
ability to leverage the Thousand eyes I
have the ability to leverage Kirk off's
principle and not rely on security by
obscurity so that I can achieve these
successes so open source can be more
securable and that is the goal that
we're ultimately after