5 ms·
If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)
by fictioncircle 9y ago
If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)
- thinkMOAR 9y agoTrue, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling.
- phinnaeus 9y agoMake sure you read the code of the compiler you're using as well, and bootstrap/compile it from that source instead of trusting an existing compiler binary.
- Santosh83 9y agoWhy stop with compilers? Inspect the circuit diagrams for all your hardware and then make sure the actual manufacturing followed the designs to a tee.
- Royalaid 9y agoI mean I know it hyperbole but I am pretty sure there are hardware bugs that allow access, see that Intel or IBM remote management disclosure. It might not a real backdoor but it's as good as one. As people above are mentioning keep your paranoia inside your threat model
- madamelic 9y agoI wish I could find the story where someone actually had this issue. Basically, the story was that a program for grad research was inserting all kinds of nasty, anti-semetic things into text and it turned out the previous grad student had poisoned the compiler which was modifying the strings and was able to re-poison it every time through something else. I forgot the exact details but it is an amazing read.
- fictioncircle 9y ago> True, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling. Then they aren't paranoid but normal folks, eh?
- 0xfeba 9y agoRelevant: https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest
- fictioncircle 9y agoValid point. https://github.com/HainaLi/horcrux_password_manager https://github.com/HainaLi/horcrux_password_manager It is in JS at least. Underhanded C is likely an easier trick to manage.
- tzs 9y agoWhat do you mean by "treat it as code you authored"?
- fictioncircle 9y agoFor purposes of security paranoia, if you can perform a security audit on open source code it is just as good as any other code you've written. Idk about other people but I find anything I don't find security holes in myself "as good" as anything I've written. I've got the same set of assumptions/blinders/competence either way.