Joshua M. Pearce, The Conversation:
Software users and developers already embrace computer software whose source code is publicly accessible. All supercomputers, 90 percent of cloud servers, 82 percent of smartphones and 62 percent of embedded systems – like those inside consumer electronics – run on open-source operating systems. More than 70 percent of “internet of things” devices also use open-source software.
Open-source software isn’t inherently or automatically more secure. But it creates more possibilities, and market pressure, for improving security. Just as when choosing a safe to store a secret document in, customers must decide – should they pick a system whose security is vouched for by the company that makes it, or a system that can be explored, examined and tested?
Open-source software users choose not to trust a program unless they can verify it independently. Many of them don’t have the expertise themselves to be able to evaluate security claims, of course – but they can wait until consumer-protection groups do so independently, hire a verified expert to check things out, or even learn the skills needed to investigate for themselves. They could even decide to pay for a version of the software that has been checked out and is supported by experts.
Open-source hardware offers users the same choice. Many people who buy electronics have no idea what’s inside them. Even technically sophisticated companies like Amazon have to hire outside forensic experts to be sure of exactly what is in the hardware their companies rely on.
Open-source hardware would mean each device’s designs and components would be open for public view at any time. People could study the information, follow the directions to build a device, test it and distribute it – or even sell it. All that transparency would give attackers more data about their potential targets, for sure. But it would help customers downstream much more, by giving them the means to verify their own devices’ security themselves.
Making open-source hardware systems more available increases regular people’s security by giving them verifiably secure options. If someone is especially concerned, they could even manufacture their own electronics. There are a wide range of designs already publicly available on sites like Hackaday, Open Electronics and the Open Circuits Institute. There are also many communities based on specific products like Arduino.
Even open-source chips are gaining traction. It’s already possible for people to build electronics that are open-source from the chips all the way up to the physical components. If hardware hacks become more common, that may be a key way for people to protect their cybersecurity. Companies and governments can also be expected to adopt policies that favor open-source hardware and require better testing to ensure their equipment is safe to use.