3 ms·
Seems like we need a linter that can look for binary, hex, or otherwise encrypted-looking data in source code (I have no idea how you'd teach the linter to look
by AdmiralAsshat 8y ago
Seems like we need a linter that can look for binary, hex, or otherwise encrypted-looking data in source code (I have no idea how you'd teach the linter to look for anything that "looks like gibberish"--I'd leave that to people smarter than me). From past experience with other popular apps that get backdoored with bitcoin miners, anything intentionally obfuscated in what is supposed to be an open source application is almost always suspicious.
- Severian 8y agoYou could measure the entropy of single lines and determine if the entropy is high. Although you'd probably get a lot of false positive.
- gnulinux 8y agoYou can probably just measure the entropy of literals, but then an attacker might use reflection to construct arbitrary strings. Not an easy problem.