4 ms·
My point is not that you shouldn't verify OpenSSL code. My point is that you shouldn't pretend that you don't implicitly trust Intel/AMD (or Yubikey).
by oconnore 10y ago
My point is not that you shouldn't verify OpenSSL code. My point is that you shouldn't pretend that you don't implicitly trust Intel/AMD (or Yubikey).
- mort96 10y agoSo something _has_ changed in other words. You used to implicitly trust Yubikey's word that they put the publicly available source code on their devices, just like now, but you used to also be able to verify their code such that you could be fairly sure that if the trust in the company is warranted, their product is fairly secure, or more importantly, find security issues in their code.