Assessing the importance of open-source software development from a cyber-security perspective

从网络安全的角度来看，闭源软件开发项目比发布其源代码的项目（换句话说，开源项目）更受关注。这主要是由于开源软件可以从安全角度提供的主要优势。作为公众成员访问代码库可以验证软件的内容。可以很容易地识别错误和漏洞，并向软件的开发人员建议补丁，从而防止它们在恶意情况下使用。闭源软件不能提供同样的优势，因为公众成员不能检查源代码并提出修改建议。此外，如果恶意用户发现了一个漏洞，他们可能会在被检测到之前利用它很长一段时间（在某些情况下，可能根本不会被检测到）。Weiss和Bailetti b[1]进一步论证了这一点，指出使用和开发开源解决方案可以帮助确保不同组织之间共享任何漏洞的知识，从而防止进一步的事件发生。我的项目将首先涉及到进一步证明这个概念，通过展示各种闭源软件解决方案和实现，事实上，包含不一定由其开发人员宣传的特性（在某些情况下，这些特性本身可能是漏洞，或者导致漏洞的发现）。我相信在许多不同的情况下展示这一点是有价值的，所以我们将尝试在一个更现代的系统上进行这项工作，以表明这仍然是一个当前的问题，同时在一个更旧的系统上证明这个问题已经存在了很长一段时间。简而言之，该项目的主要目标是从网络安全的角度确定开源软件的主要优势。

From a cyber-security perspective, closed-source software development projects are seen assomewhat more concerning than projects that publish their source-code (in other words, open-sourceprojects). This is primarily due to the major advantages that open-source software can provide froma security perspective. Having access to the codebase as a member of the public allows the contentsof the software to be verified. Bugs and vulnerabilities can easily be identified, and patches can besuggested to the developers of the software, thereby preventing their use under maliciouscircumstances. Closed-source software cannot provide the same advantages, as members of thepublic are not able to examine the source-code and suggest changes. Also, if a malicious user were toidentify a vulnerability, they may be able to use it to their advantage for a significant amount of timebefore being detected (and in some cases, may never be detected at all). Weiss and Bailetti [1] arguethis point further, stating that the use and development of open-source solutions can help to ensurethat the knowledge of any vulnerabilities are shared between different organisations, preventingfurther incidents.My project would firstly involve attempting to further prove this concept, by showing that variousclosed-source software solutions and implementations do, in fact, contain features that were notnecessarily advertised by their developers (which in some cases may be vulnerabilities themselves, orlead to the discovery of vulnerabilities). I believe that it would be valuable to show this in manydifferent scenarios, so an attempt would be made to carry out this work on a more modern system toshow that this is still a current issue, as well as an older system to prove that the problem has existedfor quite a while. In short, the project's primary aim would be to determine the main advantages ofopen-source software from a cyber-security perspective.