Open Source Software Security

Catalog description

The Free and Open-Source Software (FOSS) movement promotes the principles of software freedom, collaboration, and innovation, allowing users to access, modify, and share software without restrictions. FOSS is good for software security because it promotes transparency, allowing anyone to review the source code for vulnerabilities and ensuring that security flaws are more likely to be discovered and fixed quickly: "given enough eyeballs, all bugs are shallow" –Eric S. Raymond (Linus's law) In this course, we use OpenSSL—one of the most security-critical FOSS projects of our time—as a case study on the evolution of an FOSS project in response to vulnerabilities reported by security researchers. We study, discuss, and present their discovery, potential exploitation, mitigation, and disclosure. We also learn how to effectively contribute to FOSS projects.