Mozilla warns against closed-source software

Members of the Mozilla Foundation have urged users to look to open-source software following Snowden's revelations of back-door access and hidden code in proprietary applications, beginning - naturally - with switching to its Firefox web browser.

There's little denying that documents leaked by whistleblower and former National Security Agency (NSA) contractor Edward Snowden have damaged trust in commercial software companies: NSA-mandated algorithms have been found to be vulnerable to attack, and security company RSA has seen numerous speakers pull out of its upcoming conference over claims it accepted a large cash sum from the NSA to make the broken-by-design algorithms the default in its encryption software.

For closed-source software, the claims present a problem: users are increasingly distrustful of companies who claim their software is secure only for the fingerprints of the NSA to be found all over it - but releasing the source code for audit is unthinkable. The result is usually an awkward middle ground like that chosen by Microsoft, which allows selected large customers - typically governments - limited access to selected source files for the purposes of auditing its security. For everyone else, though, it boils down to a simple matter of trust.

In a blog post entitled Trust but Verify, Mozilla's Brendan Eich and Andreas Gal argue that the only true solution is open source - in particular for web browser users. 'Software vendors — including browser vendors — must not be blindly trusted,' the pair argue. 'Not because such vendors don’t want to protect user privacy. Rather, because a law might force vendors to secretly violate their own principles and do things they don’t want to do.

'Mozilla has one critical advantage over all other browser vendors,' the pair naturally conclude. 'Our products are truly open source. Internet Explorer is fully closed-source, and while the rendering engines WebKit and Blink (Chromium) are open-source, the Safari and Chrome browsers that use them are not fully open-source. Both contain significant fractions of closed-source code.'

While encouraging users to switch to Firefox, the pair also ask security researchers to get involved in order to ensure the security of their software. 'To ensure that no one can inject undetected surveillance code into Firefox, security researchers and organizations should: regularly audit Mozilla source and verified builds by all effective means; establish automated systems to verify official Mozilla builds from source; and raise an alert if the verified bits differ from official bits.'

'Security is never “done” — it is a process, not a final rest-state,' the pair conclude. 'No silver bullets. All methods have limits. However, open-source auditability cleanly beats the lack of ability to audit source vs. binary. Through international collaboration of independent entities we can give users the confidence that Firefox cannot be subverted without the world noticing, and offer a browser that verifiably meets users’ privacy expectations.'

Mozilla is currently working on a means for verifying that its builds are indeed based on the published source code, offering public tracking of that work on its Bugzilla platform.