4 ms·

Isn't that a large part of the open-source nature? Audit the code or hardware designs yourself, determine their trustworthiness from that. It's much harder to t

Isn't that a large part of the open-source nature? Audit the code or hardware designs yourself, determine their trustworthiness from that. It's much harder to trust something when you can't examine the inner workings of it.

shoto_io 5y ago
Ok thanks, I get that. But how many people can do that? Like 0.001% of the population?
- stonogo 5y ago
  How many people can authenticate a dollar bill? How many people can validate a cryptographic signature? How many people can direct a blockbuster action movie? The point is, right now, nobody can audit these things. Once someone -- anyone! -- can, everyone else can benefit.
  - cassianoleal 5y ago
    There's also the matter of traceability. Even if there is no direct audit of the code, once a vulnerability is discovered it can be traced back to the person(s) who introduced it. With a closed system, only the owner of the source code history can do that. With open source, any person in the world can, and can start a discussion to understand whether it was malicious or not, if the person(s) should be banned from pushing code, new code security standards to be adopted, etc. You lean on the world's expertise at that point. Bad things happen. It's important to have the ability to understand why and mitigate for the future.
    - pjmlp 5y ago
      Nope, it can be traced back to a random nickname on the Internet, using a computer somewhere in the globe.
      - Traf444 5y ago
        I guess you have never had commit rights to any Linux distribution or such? You don't get commit rights as a random person, so yes, a commit can usually be traced back to a person. Sure, the committer could have received a patch from a unknown person, but then he's still responsible for the commit.
        pjmlp 5y ago
        I guess you are a security expert that knows how every single FOSS project that might be used as dependency works.
        Traf444 5y ago
        That's not what I tried to say. It's up to you as a user to make due diligence and make an informed decision if you want to use the software or not. Any serious project would have some form of web of trust and know who has commit rights. It's up to you to decide if you trust their web of trust. I guess from your comments that you are not actually interested in contributing to the discussion since you just sprout single line comments with no information at all.
        pjmlp 5y ago
        I contribute with experience instead of FOSS ideology absent from how things actually work.
        Traf444 5y ago
        No, you throw out nonsense single line sentences that say and contribute nothing.
      - cassianoleal 5y ago
        That may be so, but it's usually been through code reviews, pull requests and whatnot - which means a maintainer somewhere has approved that code. In any case, "a random nickname on the Internet, using a computer somewhere in the globe" is a lot more information than none. Finding out that that's the case for a given project is part of traceability.
  - zimpenfish 5y ago
    >How many people can authenticate a dollar bill? [...] nobody can audit these things. USGOV has a pretty comprehensive guide on how to validate them: https://www.uscurrency.gov/sites/default/files/downloadable-materials/files/quick-reference-guide-5-10-20-50-100.pdf https://www.uscurrency.gov/sites/default/files/downloadable-...
    - manquer 5y ago
      There is also plenty of documentation and books to learn coding and start auditing if you want to. Fake validation is less like coding as to catch a really well made fake you would need years of experience seeing all sorts of fakes , while coding needs only experience to see what is good code to able to catch most issues
      - zimpenfish 5y ago
        > coding needs only experience to see what is good code to able to catch most issues If that were true, the software industry would have a much smaller problem re: bugs and errors than they currently do.
        manquer 5y ago
        Less bugs would be there if the industry wanted it and paid for it. Sadly the problem is good enough is how the industry sees everything, constant cost cutting , off shoring or replacing senior talent with fresh graduates , inadequate focus on security, debt is all too common, unless/until something affects bottomline there is no pressure.
    - stonogo 5y ago
      Please note the entire absence of the dollar bill from that document.
      - zimpenfish 5y ago
        > Please note the entire absence of the dollar bill from that document. A fair point. I took "dollar bill" to be the generic "US currency" rather than specifically "the $1 bill". But this page covers everything from $1 to $100 (although it seems the $1 and $2 have barely any.) https://www.uscurrency.gov/denominations/ https://www.uscurrency.gov/denominations/
- ac29 5y ago
  I think its fair to call it 0%. Auditing a large, modern code base is going to be impossible for a single person. For example, the Linux kernel is 27.8M lines of code (as of Jan 2020, [0]). Yes, a lot of that code is for drivers you wont use, or platforms you aren't running on. But still, no one person is going to be able to get through all of it with enough attention to detail to notice things like subtle race conditions, especially if they were inserted maliciously. [0] https://www.phoronix.com/scan.php?page=news_item&px=Linux-Git-Stats-EOY2019 https://www.phoronix.com/scan.php?page=news_item&px=Linux-Gi...

shoto_io 5y ago

Ok thanks, I get that. But how many people can do that? Like 0.001% of the population?

stonogo 5y ago
How many people can authenticate a dollar bill? How many people can validate a cryptographic signature? How many people can direct a blockbuster action movie? The point is, right now, nobody can audit these things. Once someone -- anyone! -- can, everyone else can benefit.
- cassianoleal 5y ago
  There's also the matter of traceability. Even if there is no direct audit of the code, once a vulnerability is discovered it can be traced back to the person(s) who introduced it. With a closed system, only the owner of the source code history can do that. With open source, any person in the world can, and can start a discussion to understand whether it was malicious or not, if the person(s) should be banned from pushing code, new code security standards to be adopted, etc. You lean on the world's expertise at that point. Bad things happen. It's important to have the ability to understand why and mitigate for the future.
  - pjmlp 5y ago
    Nope, it can be traced back to a random nickname on the Internet, using a computer somewhere in the globe.
    - Traf444 5y ago
      I guess you have never had commit rights to any Linux distribution or such? You don't get commit rights as a random person, so yes, a commit can usually be traced back to a person. Sure, the committer could have received a patch from a unknown person, but then he's still responsible for the commit.
      - pjmlp 5y ago
        I guess you are a security expert that knows how every single FOSS project that might be used as dependency works.
        Traf444 5y ago
        That's not what I tried to say. It's up to you as a user to make due diligence and make an informed decision if you want to use the software or not. Any serious project would have some form of web of trust and know who has commit rights. It's up to you to decide if you trust their web of trust. I guess from your comments that you are not actually interested in contributing to the discussion since you just sprout single line comments with no information at all.
        pjmlp 5y ago
        I contribute with experience instead of FOSS ideology absent from how things actually work.
        Traf444 5y ago
        No, you throw out nonsense single line sentences that say and contribute nothing.
    - cassianoleal 5y ago
      That may be so, but it's usually been through code reviews, pull requests and whatnot - which means a maintainer somewhere has approved that code. In any case, "a random nickname on the Internet, using a computer somewhere in the globe" is a lot more information than none. Finding out that that's the case for a given project is part of traceability.
- zimpenfish 5y ago
  >How many people can authenticate a dollar bill? [...] nobody can audit these things. USGOV has a pretty comprehensive guide on how to validate them: https://www.uscurrency.gov/sites/default/files/downloadable-materials/files/quick-reference-guide-5-10-20-50-100.pdf https://www.uscurrency.gov/sites/default/files/downloadable-...
  - manquer 5y ago
    There is also plenty of documentation and books to learn coding and start auditing if you want to. Fake validation is less like coding as to catch a really well made fake you would need years of experience seeing all sorts of fakes , while coding needs only experience to see what is good code to able to catch most issues
    - zimpenfish 5y ago
      > coding needs only experience to see what is good code to able to catch most issues If that were true, the software industry would have a much smaller problem re: bugs and errors than they currently do.
      - manquer 5y ago
        Less bugs would be there if the industry wanted it and paid for it. Sadly the problem is good enough is how the industry sees everything, constant cost cutting , off shoring or replacing senior talent with fresh graduates , inadequate focus on security, debt is all too common, unless/until something affects bottomline there is no pressure.
  - stonogo 5y ago
    Please note the entire absence of the dollar bill from that document.
    - zimpenfish 5y ago
      > Please note the entire absence of the dollar bill from that document. A fair point. I took "dollar bill" to be the generic "US currency" rather than specifically "the $1 bill". But this page covers everything from $1 to $100 (although it seems the $1 and $2 have barely any.) https://www.uscurrency.gov/denominations/ https://www.uscurrency.gov/denominations/
ac29 5y ago
I think its fair to call it 0%. Auditing a large, modern code base is going to be impossible for a single person. For example, the Linux kernel is 27.8M lines of code (as of Jan 2020, [0]). Yes, a lot of that code is for drivers you wont use, or platforms you aren't running on. But still, no one person is going to be able to get through all of it with enough attention to detail to notice things like subtle race conditions, especially if they were inserted maliciously. [0] https://www.phoronix.com/scan.php?page=news_item&px=Linux-Git-Stats-EOY2019 https://www.phoronix.com/scan.php?page=news_item&px=Linux-Gi...