4 ms·
That reasoning strikes me as flawed. It would be like submitting a term paper to a teacher after he proofread your draft, with all of his suggested fixes, yet h
by AdmiralAsshat 10y ago
That reasoning strikes me as flawed. It would be like submitting a term paper to a teacher after he proofread your draft, with all of his suggested fixes, yet his final response is "Oh sure, you fixed all the problems I found. But I found so many before, what about the ones I didn't find? C+"
This was a third-party audit, and VeraCrypt fixed all of the critical ones that they found. All software has bugs. To find some that are critical is not necessarily indicative of the quality of code on the whole.
- water42 10y agoactually, it would be more like students submitting 100,000 term papers to a teacher after the teacher proofread the drafts and the students made all his suggested fixes. auditing a large codebase certainly isn't as easy as proofreading a paper. it's not a "one and done" scenario. especially when you also factor in the security requirements of encryption software. the world won't end if there's a missed spelling mistake or two in a term paper, but if there are critical vulns in VeraCrypt the entire software could be rendered useless
- kkl 10y agoI do not think your analogy applies here. Finding 8 critical-risk bugs in a project from an audit is bad news. It is highly suggestive that the codebase is riddled with flaws. Smoke, fire, yadda yadda.