There are literally thousands of eyes that look at kernel sources. Google even pays 1e5 usd if one finds exploitable bugs in their code. Yet security-related bu

There are literally thousands of eyes that look at kernel sources. Google even pays 1e5 usd if one finds exploitable bugs in their code. Yet security-related bugs stil pop up regularly. Even to prove things formally source is not that essential. One stil needs to know details how code is translated into the machine instructions. But then to show, for example, absence of code path that copies user location into network packet one may analize machine instructions.