3 ms·
At the level of security where you need to be paranoid about the operating system developers, how do you know the source code Microsoft shows you, corresponds t
by rwallace 10y ago
At the level of security where you need to be paranoid about the operating system developers, how do you know the source code Microsoft shows you, corresponds to the Windows binaries running on your machines? (Let alone to the sum and total of all binary patches applied thereto?)
- PeCaN 10y agoA source license probably also gets you the build system, or if not maybe you could throw more money at them. But reproducible builds are a hard problem, so… honestly, I can't answer that.
- pjmorris 10y agoAnd that's what I really mean by 'black boxes'. Yes, you can buy access to, e.g., Windows source, but that doesn't mean that what you review and what is running on your systems are the same thing. And I can't even speak to all the third-party bits that get compiled in to an instance of Windows. It's a really, really hard problem.