3 ms·
Do you need to access source code in order to analyze software for backdoors? Shouldn't you be looking directly at the compiled machine code? There's no guaran
by statictype 9y ago
Do you need to access source code in order to analyze software for backdoors? Shouldn't you be looking directly at the compiled machine code?
There's no guarantee that the source code you are looking at matches the binaries that are being distributed isn't it?
- JumpCrisscross 9y ago> There's no guarantee that the source code you are looking at matches the binaries that are being distributed isn't it? Couldn't one compile from source and then compare blobs?
- detaro 9y agoI wonder how many commercial code bases/products can do that. Certainly an interesting proposal for verification purposes like this, but e.g. the recent Debian efforts show that it is not trivial.
- JumpCrisscross 9y ago> the recent Debian efforts show that it is not trivial Is there a link on this you recommend?
- leni536 9y agohttps://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds
- detaro 9y agohttps://reproducible-builds.org/docs/ https://reproducible-builds.org/docs/ (it's linked from the Debian site already posted by leni536, but wanted to explicitly point it out since it explains the issues and solutions very well)
- PeterisP 9y agoIf you want to find and develop exploits, having the source code certainly makes it easier - the expected use case here isn't the foreign gov't ensuring that Symantec software is safe so they can use it, but rather the foreign gov't developing exploits to circumvent Symantec software when attacking e.g. USA computers.