3 ms·

Are you aware of the fact that your computer runs a lot of scary code that you can't see anyway? Do you audit the firmware of your drives?

• riquito 8y ago
  You don't need to verify everything yourself, when the code is open you can trust one or more third party auditing
  • zeusk 8y ago
    and since when were device firmwares "open" or audited by a "trustworthy" and "competitive" party? I work on OneCore (Windows) and sometimes I have trouble believing the kind of crap some hardware vendors ship as firmware.
  • scarface74 8y ago
    How did that work out for the HeartBleed bug that was in Open source code for a year?
• geofft 8y ago
  I am absurdly aware of this. I am also absurdly aware that most free software isn't audited, either, and is full of unintentional security vulnerabilities more exploitable than anything going on with my proprietary firmware. Nonetheless, I believe in incremental improvements. (Note that untrustworthy drive firmware has an easy workaround at least in theory - just do full-disk authenticated encryption, and then the drive can't do anything worse than DoS you, which is sort of a thing drives tend to do on their own anyway.)