3 ms·
This is a very weak argument, eyeballs do find backdoors. Usually each commit is checked by few people and the introduction of the backdoor is rather obvious.
by xxs 8y ago
This is a very weak argument, eyeballs do find backdoors. Usually each commit is checked by few people and the introduction of the backdoor is rather obvious.
As for not knowing what has been downloading (if someone tempered with), the best approach is compiling it on your own.
- gaius 8y agoThis is a very weak argument, eyeballs do find backdoors Eventually, maybe. How many eyeballs and how long to find Heartbleed?
- Coxa 8y agoThere's a difference between a potential backdoor and a bug. While a lot of eyeballs might oversee a bug, you have to make an effort to design your backdoor to go unnoticed.
- gaius 8y agoGood backdoors are indistinguishable from bugs, for plausible deniability
- zAy0LfpBZLC8mAC 8y agoThe question isn't whether there won't ever be backdoors, but how likely that is, how long they will stay in place undetected, and what the effects on the reputation of the product/project/committer are once they are discovered. Bringing this up as an argument is a sensible as claiming that transparency and democracy isn't any better than a dictatorship because there is still corruption.
- kasey_junk 8y agoCan you cite any commits for any open source software where a back door was attempted to be introduced & code review found it pre-emptively? The reason I ask is that this is an oft repeated claim about open source by developers yet when I talk to security people they don’t seem to care about open source nearly as much. To them inspecting binaries is table stakes anyway. Meanwhile people write backdoors that aren’t obvious for fun. http://underhanded-c.org/ http://underhanded-c.org/