3 ms·

I guess I'm a bit cynical but this seems hand wavy to me. (Note, I love curl and implicitly trust it). The argument that it would probably take too much code a

by aidos 9y ago

I guess I'm a bit cynical but this seems hand wavy to me. (Note, I love curl and implicitly trust it). The argument that it would probably take too much code and would be too obvious doesn't seem solid. I'm no expert in this area but curl sends data over a network and sometimes runs as part of a larger application. It seems like the big dangerous bits are there and it wouldn't take a major bug to send the wrong thing.

shakna 9y ago
> There is only one way to be sure: review the code you download and intend to use. Or get it from a trusted source that did the review for you.
- elnygren 9y ago
  Agreed. However, this is unfeasible/impractical. Ain't nobody got time for that. Are there any commercial or non-profit organisations that maintain lists/repos of audited and trusted software with their checksums? It seems like there would a demand for a package manager like that. I suppose some Linux distros have pretty OK repositories? I wouldn't trust npm, pip, gem etc. though.
  - shakna 9y ago
    That's the second half of the quote: > Or get it from a trusted source that did the review for you. Incidentally, curl has been reviewed by the Mozilla Secure Open Source project [0], who maintain lists of audits which include checksums within the report. Maybe you're looking for something similar? [0] https://wiki.mozilla.org/MOSS/Secure_Open_Source https://wiki.mozilla.org/MOSS/Secure_Open_Source
    - pjmlp 9y ago
      Which version? In order for this process to be truly secure, every single software version needs to be audited.
      - Xylakant 9y ago
        7.50.1 The repost can be found here https://wiki.mozilla.org/images/a/aa/Curl-report.pdf https://wiki.mozilla.org/images/a/aa/Curl-report.pdf You don't have to do a full audit on each version, auditing the deltas should be fairly comprehensive. Now, there could be some malicious code hidden that gets triggered by a begnin change, but otoh, no audit ever will guarantee full security.
justonepost 9y ago
The best way is just defect density. How often do vulns show up? How serious are they? It's always a judgement call of course.
Buge 9y ago
How is there an argument that it would take too much code? He gives the example of how inserting an off-by-one error can lead to complete compromise of your machine. Inserting an off-by-one error shouldn't be too much code.

by aidos 9y ago

shakna 9y ago

> There is only one way to be sure: review the code you download and intend to use. Or get it from a trusted source that did the review for you.

elnygren 9y ago
Agreed. However, this is unfeasible/impractical. Ain't nobody got time for that. Are there any commercial or non-profit organisations that maintain lists/repos of audited and trusted software with their checksums? It seems like there would a demand for a package manager like that. I suppose some Linux distros have pretty OK repositories? I wouldn't trust npm, pip, gem etc. though.
- shakna 9y ago
  That's the second half of the quote: > Or get it from a trusted source that did the review for you. Incidentally, curl has been reviewed by the Mozilla Secure Open Source project [0], who maintain lists of audits which include checksums within the report. Maybe you're looking for something similar? [0] https://wiki.mozilla.org/MOSS/Secure_Open_Source https://wiki.mozilla.org/MOSS/Secure_Open_Source
  - pjmlp 9y ago
    Which version? In order for this process to be truly secure, every single software version needs to be audited.
    - Xylakant 9y ago
      7.50.1 The repost can be found here https://wiki.mozilla.org/images/a/aa/Curl-report.pdf https://wiki.mozilla.org/images/a/aa/Curl-report.pdf You don't have to do a full audit on each version, auditing the deltas should be fairly comprehensive. Now, there could be some malicious code hidden that gets triggered by a begnin change, but otoh, no audit ever will guarantee full security.

justonepost 9y ago

The best way is just defect density. How often do vulns show up? How serious are they? It's always a judgement call of course.

Buge 9y ago

How is there an argument that it would take too much code? He gives the example of how inserting an off-by-one error can lead to complete compromise of your machine. Inserting an off-by-one error shouldn't be too much code.