4 ms·

No. I can review 0.1% of the code and verify that it compiles correctly and then let another 999 people review their own portion. It only takes one person to fi

No. I can review 0.1% of the code and verify that it compiles correctly and then let another 999 people review their own portion. It only takes one person to find a bit of malicious code, we don’t all need to review every single line.

remram 5y ago
That only works if you coordinate. With even more people, you can pick randomly and be relatively sure you've read it all, but I posit that 1) you don't pick randomly, you pick a part that is accessible or interesting to you (and therefore probably others) and 2) reading code locally is not sufficient to find bugs or backdoors in the whole.
- pabs3 5y ago
  The crev folks are working on a co-ordination system for incremental distributed code review: https://github.com/crev-dev/ https://github.com/crev-dev/
  - IgorPartola 5y ago
    I actually wonder if it’s possible to write code at such a macro level as to obfuscate, say, a keylogger in a huge codebase such that reviewing just a single module/unit would not reveal that something bad is going on.
    - eru 5y ago
      Depends on how complicated the project itself is. A simple structure with the bare minimum of side-effects (think, functional programming) would make this effort harder. For something like C, all bets are off: http://www.underhanded-c.org/ http://www.underhanded-c.org/ or https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest
  - remram 5y ago
    Crev is a great idea, unfortunately it is only really available for Rust right now.
    - pabs3 5y ago
      I noticed there is a git-crev project, might that be useful for other languages? Also there is pip-crev for Python.
xvector 5y ago
> It only takes one person to find a bit of malicious code, we don’t all need to review every single line. This is just objectively wrong. I have worked on projects at FAANG where entire teams did not spot critical security issues during review. You are very unlikely to spot an issue with just one pair of eyes. You need many if you want any hope of catching bugdoors.
- IgorPartola 5y ago
  You are misunderstanding what I am saying. I am saying that it only takes one person who finds a vulnerability to disclose it, to a first approximation. Realistically it’s probably closer to 2-3 since the first might be working for the NSA, the CCP, etc. I am making no arguments about what amount of effort it takes to find a vulnerability, just talking about how not every single user of a piece of code needs to verify it.

remram 5y ago

That only works if you coordinate. With even more people, you can pick randomly and be relatively sure you've read it all, but I posit that 1) you don't pick randomly, you pick a part that is accessible or interesting to you (and therefore probably others) and 2) reading code locally is not sufficient to find bugs or backdoors in the whole.

pabs3 5y ago
The crev folks are working on a co-ordination system for incremental distributed code review: https://github.com/crev-dev/ https://github.com/crev-dev/
- IgorPartola 5y ago
  I actually wonder if it’s possible to write code at such a macro level as to obfuscate, say, a keylogger in a huge codebase such that reviewing just a single module/unit would not reveal that something bad is going on.
  - eru 5y ago
    Depends on how complicated the project itself is. A simple structure with the bare minimum of side-effects (think, functional programming) would make this effort harder. For something like C, all bets are off: http://www.underhanded-c.org/ http://www.underhanded-c.org/ or https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest
- remram 5y ago
  Crev is a great idea, unfortunately it is only really available for Rust right now.
  - pabs3 5y ago
    I noticed there is a git-crev project, might that be useful for other languages? Also there is pip-crev for Python.

xvector 5y ago

> It only takes one person to find a bit of malicious code, we don’t all need to review every single line. This is just objectively wrong. I have worked on projects at FAANG where entire teams did not spot critical security issues during review. You are very unlikely to spot an issue with just one pair of eyes. You need many if you want any hope of catching bugdoors.

IgorPartola 5y ago
You are misunderstanding what I am saying. I am saying that it only takes one person who finds a vulnerability to disclose it, to a first approximation. Realistically it’s probably closer to 2-3 since the first might be working for the NSA, the CCP, etc. I am making no arguments about what amount of effort it takes to find a vulnerability, just talking about how not every single user of a piece of code needs to verify it.