Something I’ve wondered. One of those “too good to be true, it probably is” type things. With all the FOSS especially for linux, installing package after package because a web search said it would fix your problem, how is it Linux isn’t full of malware and such?
Id like to understand better so I can explain to others who are afraid of FOSS for those reasons. My best response is that since it’s open source, people can see what it’s doing and would right away notice something malicious. I wouldn’t, since I’m not that into code, but others would.
Its a lot easier to find a rotten apple in an open box that the seller allows you to inspect before purchase than it is to find one in a sealed crate you are not allowed to touch.
Users find malware even in closed source. The russian malware in capcoma drm is a good example.
It’s even easier if it’s closed source.
Common sense will go a long way
From a technical perspective many Linux distros are moving to reproducible builds
They do try, but many vigilant members of the FOSS community do their best to find out what’s being done and prevent it.
You can read this summary of the attempt to inject a malware payload into a widely used compression tool that is used when remotely accessing servers: https://www.theverge.com/2024/4/2/24119342/xz-utils-linux-backdoor-attempt
It was a close call with potentially dramatic consequences, where a bad actor took 2 years to progressively gain reputation and rights to a key FOSS project, and one performance obsessed engineer to find out what they did and undo everything.
The big difference between FOSS and closed source software is that FOSS gives the possibility to audit the code, whereas binary analysis / retro engineering is much harder.
What’s to stop Closed Source software from the same?
Checks and balances, and money… people won’t buy your product if it’s malware…unless you make them a captive audience (win11, tencent).
Lots of companies keep getting in a little trouble by doing stuff like hard coding passwords and leaving backdoors
That doesn’t stop any of them. Windows users still go, willy nilly, traipsing around the internet downloading and installing random things. There is no money, no checks and balances. I’m sure you’ve read Windows converts complaining, “Linux isn’t ready for the average user because it’s too hard to install programs, they want to be able to download an installer, then click next next next and have the application installed.” They think the security of package management is too much for the average user.
Sure, FOSS could get some bad actors. It would be no different than the closed source community. At least with FOSS, there is still opportunity for people to find and eliminate the bad code. The world runs on Linux and FOSS. The place where you would want to sneak in some bad code the most. You’d have a much bigger impact. And, it does happen on occasion, people notice, and the bad code is removed. Compare that to the much smaller, Windows world, where you need anti-virus checkers and maleware checkers.
It sounds like you have the computing world inverted. You believe Windows and closed source is the most dominant computing paradigm. It’s not.
So they’re the same
Nothing? but the very fact that it is open source makes it much easier to detect malware, I guess. But I don’t think that closed source is better in this regard, rather worse, because corporations love spyware.
See Solar Winds
They can and do try to share malware, but distros and software hubs take measures to prevent it. You can read about Flathub’s approach in Flathub Safety: A Layered Approach from Source to User
It does happen, the most notable one that I can remember is XZ Utils. The good thing about open source is eventually someone will spot it and call them out.
Just an additional note: the xz backdoor is well known because it was found. It was found mostly because it’s foss. It’s doubtful it would’ve been found if it was closed source.
Imagine how many xz-like exploits are live today that hasn’t been detected yet. Is this exploit more prevalent in open source or closed source software?
Well if you use a Linux distribution, you generally get your software from some central package repository. That’s driven by maintainers who look at the software, the updates… They patch the software, make sure it runs smoothly on your system and is tied into other things… They’ll also have a look at security vulnerabilities and security in general.
Other than that, there isn’t much really “stopping” people from writing malware. We have tons of it. Fake VLC versions, copycats on the iPhone appstore… MS Windows is full of advertisements and features that send data “home”. They introduce features which border on being malware all the time… We have trojans, viruses etc. It’s all out there.
Generally, it’s a good idea to think before executing random code from the internet. Is it from a trustworthy source? Are other people using a piece of software and they’d have noticed if it deleted all files?
Usually, we have more good people than bad. And people need some motivation. It’s unlikely someone invests 10 years of their life to develop a shiny and polished office suite, just so they can run some malware somewhere. There are easier ways to accomplish that. So it generally doesn’t happen that way. It’s theoretically possible, though.
And in the old way is: Windows, Android etc are way more popular. If someone wants to do something malicious, they likely don’t target the 1-2% using a different operating system. They are going to write malware for a more popular operating system. And on the server, where Linux dominates the market, admins execute less random code. They’ll know they want MariaDB and where to get it. So it’s harder to do an attack this way.
And if I imagine being the attacker… What would be a reason to include malware in a FOSS project? Just to wreck havock and mess with people? That sounds like a 16 yo with too much time on their hands. But we have very few of those in the free software community. So that’s a bit unlikely… If someone wants a botnet, there might be easier ways to do it. And for a targeted attack, you wouldn’t hide your malware in a random project… So I generally don’t see many reasons for someone to combine malware with useful FOSS software.
:() :;:
:() :;:
Oh, that was fun! I didn’t know Linux had that Easter Egg in the terminal!
Fun fact, a properly configured system shouldn’t be impacted by this
Not so much what’s preventing, but how hard it is to get away with it.
Whatever closed-source software is doing on your system, there is no way to know to begin with, what it is that it is doing. You can only look at the outer effects it has, but you can’t examine it much. So even if a closed system is doing all sorts of things, as long as it’s stealthy enough, there would be no consequences at all.
This is the very opposite is what you get with FOSS, not to mention the difference on how software is developed, built, distributed and managed in unix systems compared to proprietary ones.
Nothing. Nobody properly analyzes the code usually. It’s just you trust it more because of the fact of it being open.
