7 ms·
How do you pay for the audits without a conflict of interest? Unless it is crowdfunded in some way, the auditors would have incentives to not find anything.
by cmdrfred 10y ago
How do you pay for the audits without a conflict of interest? Unless it is crowdfunded in some way, the auditors would have incentives to not find anything.
- nickpsecurity 10y agoIn the past, it was done by independent parties that everyone had to go through plus the NSA's IAD. These days just evaluation labs but it's more politics these days. The best way left would be to pick people with known skill and unlikely to lie about quality. Especially where reputation is on the line. I also can't overemphasize having clear standards to evaluate against. Then, you can have it done in a jurisdiction with strong contract law where they legally have to check it against the evidence. Make sure they publish a statement to the effect of what criteria it met to what degree. Potential to use lawsuits against them.