4 ms·

How?

• tptacek 10y ago
  Sorry, I don't understand your question.
  • jhasse 10y ago
    How can you know for sure?
    • tptacek 10y ago
      By looking at the code.
      • jhasse 10y ago
        but it's closed-source, so we can't do that
        • napoleond 10y ago
          `tptacek is being obtuse, but it really is pretty straightforward: https://en.wikipedia.org/wiki/Decompiler https://en.wikipedia.org/wiki/Decompiler
          • tptacek 10y ago
            It's a forward tick: 'tptacek. We're not writing Lisp macros. :)
            • napoleond 10y ago
              So you concede that you were being obtuse ;)
              • tptacek 10y ago
                Not really: I'd just rather find out where the point of contention is before getting pedantically prolix.
        • tptacek 10y ago
          You understand how frustrating it is for open source advocates to hear that normal users will never look at source code and so there's no practical difference for them between closed source and open source since it's all opaque to them anyways? That's how literally every security person feels about the argument that closed-source software is unknowable. We don't need decompilers or special tools to read closed-source applications. Almost all of them --- very much including the Signal-based messengers --- are built with tools that produce straightforward easy to follow assembly code.
          • jhasse 10y ago
            So there's no practical difference for you in understanding algorithms between assembly and higher-level source code?
            • tptacek 10y ago
              In practice we often don't even need to read the assembly code; we can match control-flow graphs. There really are some software security verification problems that are easier from the binary, particularly if the build system is complex. But that's sort of besides the point. Reading assembly is more tedious than reading C code, which is in turn more tedious than reading Python code. But you don't get to move the goalposts now. You claimed, repeatedly, that closed-source software was unknowable. It is not; it is in fact very far from unknowable. So the idea that Facebook is going to sneak backdoors into some of its most prominent code under cover of "closed source" is an extraordinary claim, requiring extraordinary evidence.
              • jhasse 10y ago
                I see, thanks for clarifying.
            • kasey_junk 10y ago
              I think there is another issue to remember, you can't trust the source. So, I doubt any security professionals would say its preferable to not have the source, but to do the job of verifying the software you have to do it at a lower level than the source anyway, so having the source is a bonus, not a requirement.