Why proprietary code is bad for security

Jabari Zakiya wrote an article headlined “Beware of Skype” in the Free Software Magazine. He suspects that the recent outage of the Skype network had to do with the US of A’s revised Foreign Intelligence Surveillance Act (FISA), something which is planned (and soon done) here in Germany as well: the spying of the state onto its local citizens. See the German Wikipedia article about the topic “Online-Durchsuchung“, which is also known as the “Bundestrojaner” (a trojan installed by the government).

Interesting for us all is what conclusion Jabari comes to in his article:

Since Skype is a proprietary commercial enterprise, it doesn’t allow for open source auditing of their code; so they can tell us anything without providing any independent means of verification.

And further:

I think the ultimate answer to privacy on the net is to never assume the network you are using isn’t being tapped…

True. Tho Skype is using an encrypted protocol, it’s still their own, non-disclosed code and property. So we don’t know what it contains. The same is true for many network products of big vendors like Cisco and the like - and they are everywhere in between you and your communication partner, be it email, phone, or anything else. And operating systems. How often have I heard users claiming that they “don’t know what that PC is trying to do” - they don’t trust their own machines, and have a reason not to. That reason is called “proprietary code” - a black box which does magic, and no one knows how. No one except the makers, of course.

I think the time is ripe for a lot of things to change. People are treated as “users”, as “consumers”, their habits and reactions are constantly monitored and saved in statistics, helping only advertising companies to annoy them even more, software vendors to suspect them to be criminals, and now the governments, who seem to see only terrorists around. A high definition movie you buy will probably not even play on your equipment, because in the long didgital chain of DRM (Digital Rights Management, also called “Digital Restirictions Management” by the Free Software Foundation and others), some of your equipment may not treat that closed code right. And that will be *your* problem, because in the store that same media may work just fine.

It’s time to stop accepting that *we* are the bad guys, and to stop consuming things we just don’t understand (and cannot, because they are proprietary, closed-source systems).

Say no to companies, or even governments who treat you like this. Start using open sourced products and protocols wherever you can. Even if *you* could still never understand the code used in these systems, there are still lots of people who can, and who will examine it. The magic word here is “peer review” - your friend or buddy or neighbour may be able to understand all that, and to help. No, not with Skype or Windows or any black box from Cisco. But he/she may be able to help you with the many free software and/or protocol alternatives, which you can start using today.

And if someone wants your money, ask them to let you see the code first.

Update: An interesting side-note to the article above is that when  Scott McCausland (sk0t), the ex-administrator of the EliteTorrents BitTorrent tracker was sentenced to use Windows instead of Linux during his probation time lately, the reason for that was that he only could be “monitored” when using Windows. Read about that stuff here if you like.

10 Responses to “Why proprietary code is bad for security”


  1. 1 Peter Rock

    “Tho Skype is using an encrypted protocol, it’s still their own, non-disclosed code and property. So we don’t know what it contains.”

    Yes. This is important for people to understand.

  2. 2 James

    “…if someone wants your money, ask them to let you see the code first.” Amen to that! Just look at the debacle with electronic voting in the USA, it is a perfect example of proprietary code being dangerous.

  3. 3 Sum Yung Gai

    You are right on. Richard Stallman has been warning people about this for years. Even Alan Cox, who is not exactly a Stallman fan personally, agrees and has written his own paper basically saying what you’ve said above. Eventually it will come to a head, as history shows us that it always has.

  4. 4 Wolfgang

    Thanks Sum Yung Gai, and James, and Peter.

    We have met RMS already - in the gallery there’s a pic of our small one, who was *very* interested in his laptop ;-) I agree, these guys are great.

    And yes, the voting machines here in Germany were also easily hacked by the guys of CCC (Chaos Computer Club).

  1. 1 cpunk - the cypherblog
  2. 2 jeremy.lonien | Warum Closed Source böse ist
  3. 3 Matteo Moro » Blog Archive » Software proprietario: lasceresti le chiavi di casa a chi te l’ha venduta?
  4. 4 FreeSoftNews » Blog Archive » Why Proprietary Code is Bad for Security
  5. 5 Ledokin » Why proprietary code is bad for security
  6. 6 Boycott Novell » An Issue of Mistrust: Bill Gates, BayStar, Acacia, SCO, and Linux

Leave a Reply