ELI5, Why is Open Source Software considered safe if it can be accessed and changed by anyone?
In: Technology
Imagine you have two lock designs. The first lock design is owned by a company, and you can only buy the finished lock. The second lock design can be looked at by anyone.
The first lock design is a black box. You buy it, know/assume it works, but you’re not exactly sure how. In order to find out if there’s a way to open the lock without having the key, you’re just going to have to try out a bunch of different things to get it to open, and hope for luck. You can try taking it apart, but while it can help you narrow down what you’re going to try to do to open the lock without the key, it’s very hard to decipher exactly what is going on inside it, because it’s stupidly complicated. Now, that may seem safer at first glance…
…but let’s compare that to the second lock design. If you want to, you can read exactly how it works. You can also make your own changes to the design, and either build a lock with that design or propose design changes to the company actually creating the lock. Now, it may at first seem more dangerous, because any bad guy can see exactly how the lock works, and try to find a way to open the lock without the key. But, it also means that any lock expert can look at the design to find a way to open a lock without the key, and if they find a way, they can submit a suggestion as to make that method not work anymore. That suggestion can then be used by lock makers to make their locks even more secure, in hopes of making it impossible to open the lock without a key. So both the “bad guys” and lock experts are better equipped to do what they do, and the idea is that there are more lock experts out there than bad guys, the lock experts will find the problems before the bad guys.
And then here’s another aspect: with the first lock design, you have to trust the company that sold it to you that there’s no unknown master key that unlocks all locks of that model. On the other hand, if someone would try to add a way for an unknown master key to unlock the lock, people would immediately realize that, because the design change is open to the public, and and no company with any bit of credibility would use that design proposal – one would hope. And even then, a smaller company could use the designs without the change, and offer competition to the other lock makers.
Latest Answers