3 ms·
Such a service would need to review every source code update for a whole bunch of projects, which seems like an enormous amount of work. My best guess is that s
by mathieubordere 7y ago
Such a service would need to review every source code update for a whole bunch of projects, which seems like an enormous amount of work. My best guess is that such a service does not exist.
- gigatexal 7y agoI’d support one that did.
- abstrct 7y agoAgreed. That's my biggest concern with any product that promises security and privacy. They're great features to put on a product that offers neither. I feel like funding would be easy, but who would you trust being behind such an initiative though?
- gigatexal 7y agoA loosely coupled set of highly trusted and capable security engineers who formed a group to audit such things that upon successful audit could place their seal of approval on a version I would support with a subscription in no time. A large group of individuals would guard against any one or a majority being compromised by bribes or otherwise. Not entirely make such fraud impossible just less likely. I see this similar to the Jepsen set of tests for a given database. A similar code test would be nice. But tough since patches and things would nullify the approval. Some tweaking to the idea would be nice but in general it’s almost a never adopt for me for security focused products because I don’t know if I can trust the creators. Why would I? I don’t have anything to go on.
- draik 7y agoThere is another problem with that. Who will review the reviewers? Can we be 100% certain that no one can buy such an approval from the reviewers and so on.. That is sad :| P.S. I'm probably just paranoic.
- gigatexal 7y agoIt has to begin with people that hat are above reproach. I’d submit the openBSD folks.