3 ms·

So there's no practical difference for you in understanding algorithms between assembly and higher-level source code?

• tptacek 10y ago
  In practice we often don't even need to read the assembly code; we can match control-flow graphs. There really are some software security verification problems that are easier from the binary, particularly if the build system is complex. But that's sort of besides the point. Reading assembly is more tedious than reading C code, which is in turn more tedious than reading Python code. But you don't get to move the goalposts now. You claimed, repeatedly, that closed-source software was unknowable. It is not; it is in fact very far from unknowable. So the idea that Facebook is going to sneak backdoors into some of its most prominent code under cover of "closed source" is an extraordinary claim, requiring extraordinary evidence.
  • jhasse 10y ago
    I see, thanks for clarifying.
• kasey_junk 10y ago
  I think there is another issue to remember, you can't trust the source. So, I doubt any security professionals would say its preferable to not have the source, but to do the job of verifying the software you have to do it at a lower level than the source anyway, so having the source is a bonus, not a requirement.