EFF: Code Review Isn’t Evil. Security Through Obscurity Is.

Code Review Isn’t Evil. Security Through Obscurity Is.

On January 25th, Reuters reported that software companies like McAfee, SAP, and Symantec allow Russian authorities to review their source code, and that “this practice potentially jeopardizes the security of computer networks in at least a dozen federal agencies.” The article goes on to explain what source code review looks like and which companies allow source code reviews, and reiterates that “allowing Russia to review the source code may expose unknown vulnerabilities that could be used to undermine U.S. network defenses.”

The spin of this article implies that requesting code reviews is malicious behavior. This is simply not the case. Reviewing source code is an extremely common practice conducted by regular companies as well as software and security professionals to ensure certain safety guarantees of the software being installed. The article also notes that “Reuters has not found any instances where a source code review played a role in a cyberattack.” At EFF, we routinely conduct code reviews of any software that we elect to use.

Just to be clear, we don’t want to downplay foreign threats to U.S. cybersecurity, or encourage the exploitation of security vulnerabilities— on the contrary, we want to promote open-source and code review practices as stronger security measures. EFF strongly advocates for the use and spread of free and open-source software for this reason.

Not only are software companies disallowing foreign governments from conducting source code reviews, trade agreements are now being used to prohibit countries from requiring the review of the source code of imported products. The first such prohibition in a completed trade agreement will be in the Comprehensive and Progressive Trans-Pacific Partnership (CPTPP, formerly just the TPP), which is due to be signed in March this year. A similar provision is proposed for inclusion in the modernized North American Free Trade Agreement (NAFTA), and in Europe’s upcoming bilateral trade agreements. EFF has expressed our concern that such prohibitions on mandatory source code review could stand in the way of legitimate measures to ensure the safety and quality of software such as VPN and secure messaging apps, and devices such as routers and IP cameras.

The implicit assumption that “keeping our code secret makes us safer” is extremely dangerous. Security researchers and experts have made it explicit time and time again that relying solely on security through obscurity simply does not work. Even worse, it gives engineers a false sense of safety, and can encourage further bad security practices.

Even in times of political tension and uncertainty, we should keep our wits about us. Allowing code review is not a direct affront to national security— in fact, we desperately need more of it.

Visit Toronto Wiring for more info


Visit Toronto Wiring

Comments

Post a Comment

Popular posts from this blog

EFF: No Digital Surveillance of Iranians at the U.S. Border—or Within the U.S.

No Digital Surveillance of Iranians at the U.S. Border—or Within the U.S. Only days into heightened tensions between the United States and Iran, media outlets have published disturbing reports of increased scrutiny of people of Iranian descent at U.S. borders, including in at least one case involving a traveler’s phone. EFF strongly opposes any targeting of people for digital surveillance based on their race, religion, or nationality, at our border and in our interior. And we remind all members of the public to practice surveillance self-defense. Disturbing Reports from the Border On January 5, media outlets reported that more than 60 people of Iranian descent, including U.S. citizens, were held at the border between Canada and Washington state for many hours and questioned about their perceived connections to Iran. U.S. Customs and Border Protection (CBP) denied that it detained or refused entry to Iranians based on their national origin, a claim contested by accounts f
Read more

EFF: Corporate Speech Police Are Not the Answer to Online Hate

Corporate Speech Police Are Not the Answer to Online Hate A coalition of civil rights and public interest groups issued recommendations today on policies they believe Internet intermediaries should adopt to try to address hate online. While there’s much of value in these recommendations, EFF does not and cannot support the full document. Because we deeply respect these organizations, the work they do, and the work we often do together; and because we think the discussion over how to support online expression—including ensuring that some voices aren’t drowned out by harassment or threats—is an important one, we want to explain our position. We agree that online speech is not always pretty—sometimes it’s extremely ugly and causes real world harm. The effects of this kind of speech are often disproportionately felt by communities for whom the Internet has also provided invaluable tools to organize, educate, and connect. Systemic discrimination does not disappear and can even be ampl
Read more

Living on the (IT) Edge: Schneider Electric at HPE Discover 2018

Image
We’re here at HPE Discover 2018 , proudly sponsoring the event and enjoying a jam-packed few days in Las Vegas. The data center industry has experienced tremendous disruption in the last decade. The fourth Industrial Revolution, with its IT/OT convergence, the proliferation of IoT, and insatiable demand for digital connectivity, is creating the opportunity to push the envelope of performance beyond the obvious and create new business value. And there’s no bigger opportunity right now than at the edge. At the same time, these new paradigms are also driving more complexity: companies today are trying to manage a combination of environments, from large centralized data centers on-premises or in the cloud, regional edge data centers, to local edge data centers. We have more data centers, intertwined across more locations, and with more data, than ever before. All of this adds up to promising opportunities on the horizon for our customers – but an equally daunting number of new challenges
Read more