5 ms·

I really do not understand any of this. I am in the 1st period of the Information Systems course. But I know one thing, it's much easier to find a backdoor with

I really do not understand any of this. I am in the 1st period of the Information Systems course. But I know one thing, it's much easier to find a backdoor with the open code than the other way around. Besides that nothing guarantees that with these techniques you do not miss something.

idlewords 10y ago
Whether it's open or closed source, you have to examine the actual binary code to see what's running on the device. And the tools for this are very good. Both Android and iOS have been very heavily vetted.
mikhailt 10y ago
If you don't understand this, then you're in the wrong business. I hope your school teaches that even vetted security code can be turned against you.
deleted 10y ago
[deleted]
mikecb 10y ago
Many people who find bugs for a living would argue the opposite.
tedunangst 10y ago
One of my perennial favorite HN comments: you, the professional reverse engineer, could not possibly do what you do. I've never tried to do it, but I know you can't.
- jhlgkhkhil 10y ago
  More like I the lowly software developer can read code but I can't reverse engineer - and why should I learn?
  - tptacek 10y ago
    It's fine not to learn. What's less fine is stridently asserting, as you have all over this thread, that security advice from experts is flawed while at the same time huffing about how little time you have to learn about the details.
    - jhlgkhkhil 10y ago
      I have repeatedly asked you to actually provide some citations for your claims. Please do so.
detaro 10y ago
Explicit backdoors are a tiny part of the risk you are exposed to, so even if the risk of a undiscovered backdoor in a product is higher than in another, it can still be more secure overall. The article we are commenting on explains quite a few points counting in favor of iOS. An adversary doesn't care about backdoors if the thing you use has plain old unplanned vulnerabilities they can exploit instead.
pag 10y ago
Given enough googly eyes, all bugs are hilarious.

idlewords 10y ago

Whether it's open or closed source, you have to examine the actual binary code to see what's running on the device. And the tools for this are very good. Both Android and iOS have been very heavily vetted.

mikhailt 10y ago

If you don't understand this, then you're in the wrong business. I hope your school teaches that even vetted security code can be turned against you.

deleted 10y ago

[deleted]

mikecb 10y ago

Many people who find bugs for a living would argue the opposite.

tedunangst 10y ago

One of my perennial favorite HN comments: you, the professional reverse engineer, could not possibly do what you do. I've never tried to do it, but I know you can't.

jhlgkhkhil 10y ago
More like I the lowly software developer can read code but I can't reverse engineer - and why should I learn?
- tptacek 10y ago
  It's fine not to learn. What's less fine is stridently asserting, as you have all over this thread, that security advice from experts is flawed while at the same time huffing about how little time you have to learn about the details.
  - jhlgkhkhil 10y ago
    I have repeatedly asked you to actually provide some citations for your claims. Please do so.

detaro 10y ago

Explicit backdoors are a tiny part of the risk you are exposed to, so even if the risk of a undiscovered backdoor in a product is higher than in another, it can still be more secure overall. The article we are commenting on explains quite a few points counting in favor of iOS. An adversary doesn't care about backdoors if the thing you use has plain old unplanned vulnerabilities they can exploit instead.

pag 10y ago

Given enough googly eyes, all bugs are hilarious.