3 ms·
> It only takes one person to find a bit of malicious code, we don’t all need to review every single line. This is just objectively wrong. I have worked on pro
by xvector 5y ago
> It only takes one person to find a bit of malicious code, we don’t all need to review every single line.
This is just objectively wrong. I have worked on projects at FAANG where entire teams did not spot critical security issues during review.
You are very unlikely to spot an issue with just one pair of eyes. You need many if you want any hope of catching bugdoors.
- IgorPartola 5y agoYou are misunderstanding what I am saying. I am saying that it only takes one person who finds a vulnerability to disclose it, to a first approximation. Realistically it’s probably closer to 2-3 since the first might be working for the NSA, the CCP, etc. I am making no arguments about what amount of effort it takes to find a vulnerability, just talking about how not every single user of a piece of code needs to verify it.