The major drawback of relying exclusively on open source projects (and I admit to doing the same at my workplace) is that they are considered "secure and tested" by default. Of course there are projects (e.g., Linux, AES, etc.) that undergo a high level of testing before being released as a new version, but we usually forget that these projects rely on other projects that in turn rely on other projects, and so on. Therefore, the status of individual tests should be checked before any upgrade or installation, running more tests internally (where possible) to ensure a lower level of possible attacks on the supply chain.
@jeffcrume
3 ай бұрын
Very well said!
@Bobcoolyoung
3 ай бұрын
I love these IBM learning videos. They're so lucid and dynamic. Thank you Jeff.
@jeffcrume
3 ай бұрын
Thank you for saying so!
@rookie28604
3 ай бұрын
Open source eco systems have their problems but it's always going to have more eyes than closed systems. There is a problem of a lot of people using open source but not contributing.
@jeffcrume
3 ай бұрын
Agreed. I’m a fan of open source. It just isn’t perfect. Nothing is
@amigazo3972
3 ай бұрын
Your level of making things understandable is insane. Thanks for the nice material in this delivery. We have missed you in the IBM videos :D
@jeffcrume
3 ай бұрын
Thank you so much! I’ve missed doing these but should be back in the studio soon
@InvalidPersistentName
3 ай бұрын
Excellent description of a timely topic. Thank you!
@jeffcrume
3 ай бұрын
Thanks so much!
@velo1337
3 ай бұрын
the 1000 eye argument is also not valid if you check that some stuff is only maintained by a handful of people
@jeffcrume
3 ай бұрын
Very true. And even if we have the 1,000 eyes, they may not all know what to look for
@computelabs
3 ай бұрын
When you talk about failure of opensource i would like to share that it's there respective community who encouraged hard-coded password to write inside the code, it's not software failure rather than those community discourage individual to write or make secure product by not mentioning in their document. Also today processors are advanced and they do in memory encryption which can be used by these open source software to secure or turn this failure into success
@jeffcrume
3 ай бұрын
Agreed. We need to get the word out so that people start doing this instead of
@2truffies
3 ай бұрын
How does he mirror write? 🤷🏼♂️ Cool video 👍
@kevinrineer5356
3 ай бұрын
Transparent glass and flips horizontally in the edit
@bakerkawesa
3 ай бұрын
Open source is self organizing and more scalable. With open source products, a community of maintainers, contributors, and users share amongst themselves the burden of identifying and solving problems. With closed source products, a handful of employees of an organization must wear all the hats. Closed source is also tempted by "security by obscurity"; a non-option for open source.
@jeffcrume
3 ай бұрын
All true. Which is why IBM has been a leading contributor to open source projects in Linux, cryptography (including quantum safe) and others
@computelabs
3 ай бұрын
Open source software can be only be secured if the dev or admin knows about security and he has done audit its softer ware security, otherwise I can see that if source code is open or available that does not mean it's secure because source code is available or visible.Any attcker can read the code and design the exploit specifically, overall the dev or owner should be smart enough to turn it into secure
@ManfredWisniewski
3 ай бұрын
Great summary, thank you!
@jeffcrume
3 ай бұрын
I’m glad you liked it
@rucellegarciano4105
4 ай бұрын
Wow... It was 2006-2007... Almost 20 years ago...
@libertadtech
3 ай бұрын
3:44 As AI advancements come, I am very sure that automated code inspection to find vulnerabilities is very close, when AI finds something it will be derivative to a human being doing a manual inspection. Great advances in security are coming, much more with the large context windows that are being generated with almost no flaws, will it be with GPT-5, Gemini Ultra 2.0 or Claude 4, or the next generation, I really don't know, but, I'm excited.
@zeektm1762
28 күн бұрын
Judging by the quality of code generated by GPT-4 and more development-tuned models, I would say we have many decades before AI can operate as an unsupervised developer..
@spelz1751
3 ай бұрын
How'd you get the eyes to blink 😮
@jeffcrume
3 ай бұрын
That was some nice work by the guy that edited the video. We can add drawings like this later in the post production process where animations are possible
@ReefGeoscience
3 ай бұрын
Here's a thought, why not train an AI to look for zero-day exploits in open source code. Switching to Linux would then be a no-brainer
@jeffcrume
3 ай бұрын
No doubt that is already happening, unfortunately. The positive side of this, though, is that if the good guys use the same tech to identify vulnerabilities, then maybe they will be able to fix them sooner as well
@DV-ml4fm
3 ай бұрын
I will still use linux over window$ any day.
@jeffcrume
3 ай бұрын
I don’t blame you 😊
@abdulfatahmohammed6800
3 ай бұрын
Same here
@vvvvvvvvvvv631
3 ай бұрын
closed source is already a malware
@paulbrian101
3 ай бұрын
Awesome presentation!
@jeffcrume
3 ай бұрын
Thank you!
@karlostj4683
3 ай бұрын
"I can see the source code..." Which you can also do with "proprietary" software, if you have, say, a decompiler. The translation between human-readable code and machine code is far more understandable than say the translation between the English language and Arabic. So no, "proprietary software" isn't a "black box".
@Strammeiche
3 ай бұрын
As a developer security by obscurity is my daily business.
@rucellegarciano4105
4 ай бұрын
Yes... It can...
@pankaj16octdogra
3 ай бұрын
Very nice
@rucellegarciano4105
4 ай бұрын
Nice short video tutorial...
@jeffcrume
3 ай бұрын
Thanks!
@blogcorpo
3 ай бұрын
♥♥
@rucellegarciano4105
4 ай бұрын
I remember, our Computer Science 101 Laboratory at the College of Engineering was on Linux. At first, I was surprised how weird it was because our Computer lab in high school was on Windows... It was my first experience of Linux. Ubuntu, Linux. I asked why we were using Linux... And the answer that I got was that it was open source. Again, my first experience of the phrase "open source". But they also further added that we were using Linux because, compared to Windows, it was more immune to computer viruses... But not totally... Windows is great... It is preferable but Word, Excel, the whole kit and caboodle, is already not free. Windows is great but it is not free... And I am in a third world country... So... 🤷
@vcx666
3 ай бұрын
😂😂that is why 99% of windows used to be p!rated before most OEMs started shipping it out of box specially after 10.
@Pem7
3 ай бұрын
It is but like any other system, it can be hacked too🤞🏾
@jeffcrume
3 ай бұрын
If it’s operational, it can be hacked
@karlostj4683
3 ай бұрын
Richard Stallman (the "king" of open source) and his ilk gave us the original libstd that is used in every UNIX distribution - and that was the source of a huge number of security vulnerabilities. Where were the "1,000 eyes" looking at it when it was blessed by Stallman et al? The vulnerabilities in libstd were the result of undisciplined programmers who were more concerned about performance than they were about security. They cut corners like sloppy teenage programmers.
@chpsilva
3 ай бұрын
Yeah, because closed source does better, right ?
@jeffcrume
3 ай бұрын
Exactly. Nobody (and no software) is perfect
@puki07777
4 ай бұрын
Great talk thanks for being so open!
@jeffcrume
3 ай бұрын
I’m glad you liked it!
@gogich777
3 ай бұрын
First, learn what Linux is. This will be a good first step.
@Debanjan-rm6wj
3 ай бұрын
Watson daishta
@GopalDev-xc9zk
3 ай бұрын
Hi
@tubemaan
3 ай бұрын
Since this "expert" started the video by implying a comparison with the unnamed (but clearly obvious) Microsoft products, he should be fair and objective and say the fact that in contrast, THERE ARE THOUSANDS OF MALWARE ATTACKING AND INFECTING MICROSFT wINDOWS OS EVERY SINGLE DAY. With this in mind, the implied comparison loses its meaning and purpose, and the two or three security issues that affected Linux over the last three decades pale in comparison and are negligible compared to the Microsoft Windows never-ending security breaches. - I would drink Linux collada all day, seven days a week, with these one-in-five-years' security issues rather than using any of Microsoft's "amazing" products or services for one hour. Microsoft would pay a billion dollars to promote this guy and this video, I even suspect that he works with Microsoft. LOG4J and the few other vulnerabilities (including the one related to XZ module that was discovered last month) are NOT malware, they are backdoor code inserted by bad actors from within the people responsible for maintaining the open source code. ( they are two entities that benefit from creating those security issues and are therefore suspected of planting those backdoor security breaches: Microsoft and state-level intelligence organizations).
@jeffcrume
3 ай бұрын
I can assure you, I have no affiliation with Microsoft. In fact, I haven’t used Windows OS in more than a decade. However, to say that there are only 2 or 3 security issues with Linux over the past 3 decades is not supported by the facts. As Linux has become more popular, it has become a larger target and attackers have taken notice. No software (open or proprietary) is completely secure. I’m a big fan of open source. It just isn’t a magic cure for all security issues
@zeektm1762
28 күн бұрын
Log4Shell (I assume this is the vulnerability you are referring to), as far as I know, was not an insider threat or a purposeful backdoor. It was a failure to sanitize user provided data, not intentionally malicious code. Open to being wrong though.
Пікірлер: 60