3 ms·
Yup, the protocol might be secure, but the implementation might not be. Without the source code, you can only guess and hope for the best.
by m-p-3 10y ago
Yup, the protocol might be secure, but the implementation might not be. Without the source code, you can only guess and hope for the best.
- FabHK 10y agoAs many argue (e.g. tptacek), and I find myself increasingly convinced by this: - source code can be looked at, even verified, but it's hard. (Remember many bugs in OpenSSL, for example.) - but binaries, too, can be disassembled, even verified. It might be harder, but it's a shades of grey, not binary (ha). - even if you have the source code, you have to ensure that the binaries actually distributed to your phone correspond to the source code. That muddles the issue further.