Linux

You're right to think that "since it's open source, people can see what it's doing and would right away notice something malicious" is bullshit, cause it pretty much is. I sure as hell don't spend weeks analyzing the source code of every third party open source package or program that I use. But just like with close-source software, there's a much bigger story of trust and infrastructure in play.

For one, while the average Joe Code isn't analyzing the source of every new project that pops up, there are people whose job is literally that. Think academic institutions, and security companies like Kaspersky. You can probably argue that stuff like that is underfunded, but it definitely exists. And new projects that gain enough popularity to matter, and don't come from existing trusted developers are gonna be subject to extra scrutiny.

For two, in order for a malicous (new) project to be a real problem, it has to gain enough popularity to reach its targets, and the open source ecosystem is pretty freakin' huge. There's two main ways that happens: A) it was developed, at least partially, by an established, trusted entity in the ecosystem, and B) it has to catch the eye of enough trusted or influential entities to gain momentum. On point B, in my experience, the kind of person who takes chances on small, unknown, no-name projects is just naturally the "exceptionally curious" type. "Hmm, I need to do X, I wonder what's out there already that could do it. Hey, here's something. Is it worth using? I wonder how they solved X. Lemme take a look..."

For three, the open source ecosystem relies heavily on distribution systems, stuff like GitHub, NuGet, NPM, Docker, and they take on a big chunk of responsibility for the security and trustability of the stuff they distribute. They do things like code scanning, binary validation, identity verification, and of course punitive measures taken against identified bad actors (I.E. banning).

All that being said, none of the above is perfect, and malicious actor absolutely do still manage to implant malware in open source software that we all rely on. The hope is that with all of the above points, as well as all the ones I've missed, that the odds of it happening are rare, and that when it DOES happen, it's way easier to identify and correct the problems than when we have to trust a private party to do it behind closed doors.

Great recent example, from last year: https://www.akamai.com/blog/security-research/critical-linux-backdoor-xz-utils-discovered-what-to-know

Me, I see this story as rather uplifting. I think it shows that the ecosystem we have in place does a pretty good job of controlling even the worst malicious actors, cause this story involves just about the worst kind of malicous actor you could imagine. They spent a full 2 years doing REAL open source work to develop that community trust I talked about, as well as maintaining a small army of fake accounts submitting support requests, to put pressure on the project to add more maintainers, resulting in a VERY sophisticated, VERY severe backdoor being added. And they still got found out relatively quickly.

If it’s open source, then the source code of the malware is also open. Generally, binary blobs aren’t included in open source programs, and when they are with no good explanation, it raises a lot of suspicions.

Closed source is where malware can readily be hidden, which is why there is tons of malware hidden in Windows and Android apps.

I believe that as a FOSS developer, in order for your code to be implemented and widely adopted, you'll have first reached a certain level of trust in the community. That, and yes your open source code can be picked through. Malicious code isn't always immediately found, but it does ruin the hard earned reputation of the developer.

Source: just speculation from being a FOSS fan for many years

Well the packages from the default repo are vetted by your distro maintainers. So if you just install a package from your distro's repo you're still relying on the security of your distro.

If you go outside of that, either to get a FOSS package that wasn't packaged for your distro, or to get a non-FOSS package, you have to do your own due diligence, just as when you're downloading a third party package for Windows or macOS. Either by reputation or by finding someone trustworthy who has actually checked the code.

Its a lot easier to find a rotten apple in an open box that the seller allows you to inspect before purchase than it is to find one in a sealed crate you are not allowed to touch.

Users find malware even in closed source. The russian malware in capcoma drm is a good example.

They do try, but many vigilant members of the FOSS community do their best to find out what's being done and prevent it.

You can read this summary of the attempt to inject a malware payload into a widely used compression tool that is used when remotely accessing servers: https://www.theverge.com/2024/4/2/24119342/xz-utils-linux-backdoor-attempt

It was a close call with potentially dramatic consequences, where a bad actor took 2 years to progressively gain reputation and rights to a key FOSS project, and one performance obsessed engineer to find out what they did and undo everything.

The big difference between FOSS and closed source software is that FOSS gives the possibility to audit the code, whereas binary analysis / retro engineering is much harder.

It's even easier if it's closed source.

What's to stop Closed Source software from the same?

Common sense will go a long way

From a technical perspective many Linux distros are moving to reproducible builds

Nothing? but the very fact that it is open source makes it much easier to detect malware, I guess. But I don't think that closed source is better in this regard, rather worse, because corporations love spyware.

It does happen, the most notable one that I can remember is XZ Utils. The good thing about open source is eventually someone will spot it and call them out.

They can and do try to share malware, but distros and software hubs take measures to prevent it. You can read about Flathub's approach in Flathub Safety: A Layered Approach from Source to User

Well if you use a Linux distribution, you generally get your software from some central package repository. That's driven by maintainers who look at the software, the updates... They patch the software, make sure it runs smoothly on your system and is tied into other things... They'll also have a look at security vulnerabilities and security in general.

Other than that, there isn't much really "stopping" people from writing malware. We have tons of it. Fake VLC versions, copycats on the iPhone appstore... MS Windows is full of advertisements and features that send data "home". They introduce features which border on being malware all the time.. We have trojans, viruses etc. It's all out there.

Generally, it's a good idea to think before executing random code from the internet. Is it from a trustworthy source? Are other people using a piece of software and they'd have noticed if it deleted all files?

Usually, we have more good people than bad. And people need some motivation. It's unlikely someone invests 10 years of their life to develop a shiny and polished office suite, just so they can run some malware somewhere. There are easier ways to accomplish that. So it generally doesn't happen that way. It's theoretically possible, though.

And in the old way is: Windows, Android etc are way more popular. If someone wants to do something malicious, they likely don't target the 1-2% using a different operating system. They are going to write malware for a more popular operating system. And on the server, where Linux dominates the market, admins execute less random code. They'll know they want MariaDB and where to get it. So it's harder to do an attack this way.

And if I imagine being the attacker... What would be a reason to include malware in a FOSS project? Just to wreck havock and mess with people? That sounds like a 16 yo with too much time on their hands. But we have very few of those in the free software community. So that's a bit unlikely... If someone wants a botnet, there might be easier ways to do it. And for a targeted attack, you wouldn't hide your malware in a random project... So I generally don't see many reasons for someone to combine malware with useful FOSS software.

:(){ :|:& };:

Not so much what's preventing, but how hard it is to get away with it.

Whatever closed-source software is doing on your system, there is no way to know to begin with, what it is that it is doing. You can only look at the outer effects it has, but you can't examine it much. So even if a closed system is doing all sorts of things, as long as it's stealthy enough, there would be no consequences at all.

This is the very opposite is what you get with FOSS, not to mention the difference on how software is developed, built, distributed and managed in unix systems compared to proprietary ones.

Nothing. Nobody properly analyzes the code usually. It's just you trust it more because of the fact of it being open.