3 ms·
Out of curiousity how are you auditing the pre compiled binaries of otherwise open source software? I spent 2 months going through the signal code base checkin
by shapefrog 5y ago
Out of curiousity how are you auditing the pre compiled binaries of otherwise open source software?
I spent 2 months going through the signal code base checking it and now I need to audit the production code on their servers as well as the binaries they have compiled. Any tips?
- foresto 5y agoI find it's much easier to audit the source code, and build the binaries yourself from that code. Also, it's a collaborative effort. If you build your binaries from the same sources that other people use, then you can split up the work, and you all benefit from anyone's discoveries. Obviously, we don't have perfect verification of the code we run. People can overlook things. Compilers can be subverted. Operating systems can be pwned. Malicious hardware can undermine all of our efforts. But let's not let perfect be the enemy of good, and let's not fool ourselves into thinking that faith in a corporation is a substitute for transparency.
- hvidgaard 5y agoYou have to assume that everything you do not control and monitor is compromised.