Why Open Source Matters For Bitcoin

[Charles-Tim]

Open source and close source are not new on this forum, but can be new to newbies and also many/most people in the world, and before using a software, people need to be able to differentiate between open source and close source software.

Open source software are software that have a source code that are available to the public, because this source code are available to the public, vulnerabilities contained in the software can quickly be detected and fixed. Users using open source soteware can be able to check what they are running on their computer, in that case, there is no power relationship anymore, no need to trust developer, it brings freedom. Open source software can provide high quality code because there are a lot of people checking the code, it gives maximum transparency of the software users are running on their device. Example of open source software are bitcoin core and electrum wallet.

Close source software source code are not available to the public but instead to a centralized set of people, which makes it available to few set of people unlike open source. Using this kind of software, users do not know the source code of the software, and do not know if the software contain malware or not. Users do not know if the software is spying, or maybe developer include a malware in it, or the close source software could be doing something you do not want a software to do and hidden until someone's bitcoin is completely stolen.

https://m.youtube.com/watch?v=_qdhc5WLd2A&feature=youtu.be
This episode was published on Dec 18, 2020: Why Open Source Matters For Bitcoin: Van Wirdum Sjorsnado
In this episode of "The Van Wirdum Sjorsnado," hosts Aaron van Wirdum and Sjors Provoost discussed why it matters that Bitcoin software is open source and why even open-source software doesn't necessarily solve all software-specific trust issues.

In theory, the fact that most Bitcoin nodes, wallets and applications are open source should ensure that developers can’t include malicious code in the programs: anyone can inspect the source code for malware. In practice, however, the number of people with enough expertise to do this is limited, while the reliance of some Bitcoin projects on external code libraries (“dependencies”) makes it even harder.

Furthermore, even if the open-source code is sound, this doesn’t guarantee that the binaries (computer code) really correspond with the open-source code. Van Wirdum and Provoost explain how this risk is largely mitigated in Bitcoin through a process called Gitian building, where several Bitcoin Core developers sign the binaries if, and only if, they all produced the exact same binaries from the same source code. This requires special compiler software.

Click the link below to listen to the full video

[ranochigo]

Open source software are software that have a source code that are available to the public, because this source code are available to the public, vulnerabilities contained in the software can quickly be detected and fixed.

Not true. HeartBleed was only detected 2 years after it was accidentally introduced into the code. Having an open source software provides a check-and-balance for people to be able to have reproducible builds and detect any potential backdoors inserted by the developers. I think it's important to be clear that this benefit lies primarily with those who are able to read and understand the source code. As for everyone else, they have to trust that those who read the source codes are competent and able to stop any backdoors being inserted. Open source =/ Trustless.

Bitcoin Core has to be open source is due to it's decentralised nature. There cannot be any central authority to make changes and everyone should be free to fork and implement their own code change. It's the reference implementation after all and it doesn't make sense for it to be close source anyways. Your points are valid, just wanted to add a bit of my thoughts.

[actmyname]

I think it's important to be clear that this benefit lies primarily with those who are able to read and understand the source code. As for everyone else, they have to trust that those who read the source codes are competent and able to stop any backdoors being inserted. Open source =/ Trustless.

It's the balance between accessibility and security: the need to trust is diluted across all of those that can review the particular processes. The whole appeal of decentralization is the distribution of dependence over the network such that the volatility of malicious actors is (more or less) negligible.

No need to run any anti-trust regulation when it's embedded in the structure of the network, like how independent auditing is built into open-source builds.

[akirasendo17]

Open source means that software that anyone can modify or build from it and even check, while the other one is that only the team started  or create
 the software can update the software if you are looking for an example: Linux and Microsoft, you see Linux has different flavors, from fedora Ubuntu Linux,
while Microsoft is windows.
At the same time, Linux is secured than windows

[Charles-Tim]

Open source software are software that have a source code that are available to the public, because this source code are available to the public, vulnerabilities contained in the software can quickly be detected and fixed.

Not true.

I understand, you are right. In some cases, a source code could take time before some bugs will even be fixed. But, I was trying to make it clear in a way it would be understandable, in a way of comparing between close source and open source that open source code is available to more people than close source code in which two heads are better than one in removing bugs and vulnerabilities from source codes.

[ranochigo]

I understand you, and you are right. In some cases, a source code could take time before some bugs will even be fixed. But, I was trying to make it clear in a way it would be understandable, in a way of comparing between close source and open source that open source is available to more people than close source in which two heads are better than one in removing bugs and vulnerabilities from source codes.

It doesn't really matter all that much in this aspect. Giving more people access to the source code does not automatically mean that more competent people would be available and willing to audit the code completely given that they "likely" lack the financial incentive to do so and close source projects are more likely to consists of certain proprietary aspect and it would be to their advantage to get more competent people to dedicate their time completely to work on it. I bet most of the major tech companies has more people working full time on their projects with more experience, and obviously more funding to operate bug bounty programs.

Obviously, an attacker can better see the codes and see if there's any bugs or exploit within the code and use it to their own advantage instead of working to fix it. ShellShock was undetected for more than a decade.

Not to say that open source projects are bad at all, there are certainly valid points that I would get behind, especially the point whereby transparency can be ensured. An open source project is not necessarily more "free" of vulnerabilities and bugs than a close sourced one.

I think one of the main benefits of open source projects, other than it's transparency is it's ability to allow people to modify the codes to suit their own needs. If you don't like certain features, want to add some features but the repo maintainers don't like it, go ahead and fork it.

[pooya87]

Obviously, an attacker can better see the codes and see if there's any bugs or exploit within the code and use it to their own advantage instead of working to fix it. ShellShock was undetected for more than a decade.

But also the moment a bug is exploited, it will be caught and fixed whereas in closed source software it takes a much longer time to do so and in most cases they aren't really fixed. Compare Windows with Linux for example.

Not to say that open source projects are bad at all, there are certainly valid points that I would get behind, especially the point whereby transparency can be ensured.

Transparency of a closed source software can never be ensured. It can do whatever it wants without the user ever finding out. The bigger the company and the more competent their developers are the harder it would be to catch their shenanigans. Again look at Windows aka the official Microsoft keylogger .

[decodx]

Open source has its advantages and disadvantages. Some of the benefits of open source are flexibility, re-use of source code, independence, open standards, competitive price (no license fee). On the other hand, the drawbacks compared to closed source (commercial) software are: no guarantee of return, no support from the developer, no guarantee of continuation of the software, no interoperability with commercial products.

Therefore, it is difficult to unambiguously conclude which is better. If someone wants to make their code open source, that means they want to make a contribution to society. While with closed-source software, developers want to ensure the security and quality of their product in return for financial benefit.