CybersecurityOpen-source hardware could defend against the next generation of hacking
Imagine you had a secret document you had to store away from prying eyes. And you have a choice: You could buy a safe made by a company that kept the workings of its locks secret. Or you could buy a safe whose manufacturer openly published the designs, letting everyone – including thieves – see how they’re made. Which would you choose? It might seem unexpected, but as an engineering professor, I’d pick the second option.
Imagine you had a secret document you had to store away from prying eyes. And you have a choice: You could buy a safe made by a company that kept the workings of its locks secret. Or you could buy a safe whose manufacturer openly published the designs, letting everyone – including thieves – see how they’re made. Which would you choose?
It might seem unexpected, but as an engineering professor, I’d pick the second option. The first one might be safe – but I simply don’t know. I’d have to take the company’s word for it. Maybe it’s a reputable company with a longstanding pedigree of quality, but I’d be betting my information’s security on the company upholding its traditions. By contrast, I can judge the security of the second safe for myself – or ask an expert to evaluate it. I’ll be better informed about how secure my safe is, and therefore more confident that my document is safe inside it. That’s the value of open-source technology.
Computer hardware is, for the most part, like the safe whose security mechanisms are secret. Any weaknesses are hidden, as well as any of their strengths. In the wake of revelations that Chinese spies may have been able to install a tiny computer chip inside devices used by as many as 30 companies, like Amazon and Apple, as well as the U.S. military and the CIA, I suggest re-evaluating the hardware people and corporations rely on to protect their secrets.
Hacking hardware is particularly dangerous because it can bypass even the most secure programming safeguards – like taking control of a server without needing a password at all. Hardware customers could benefit from the clear – if surprising – lesson the software industry has learned from decades of fighting prolific software hackers: Open-source systems can be more secure.
Lessons from open-source software
Software users and developers already embrace computer software whose source code is publicly accessible. All supercomputers, 90 percent of cloud servers, 82 percent of smartphones and 62 percent of embedded systems – like those inside consumer electronics – run on open-source operating systems. More than 70 percent of “internet of things” devices also use open-source software.
