2 ms·
What exactly this audit certifies? That the software has no bugs? But I don't think this is possible, even theoretically.
by EVa5I7bHFq9mnYK 5y ago
What exactly this audit certifies? That the software has no bugs? But I don't think this is possible, even theoretically.
- cpeterso 5y agoThe blog post links to Cure53's security audit report, which lists the issues found: https://blog.mozilla.org/security/files/2021/08/FVP-02-report.final_.pdf https://blog.mozilla.org/security/files/2021/08/FVP-02-repor...
- lucgommans 5y agoIt certifies what it says on the tin: an independent audit was performed by Cure53. You are correct in believing that certifying complex software to be free of bugs to be practically impossible at the moment. But which product would you rather use: one where you have to trust the developers, or one where you have to trust the developers plus an independent team got 5 weeks of paid time to study it for any flaws? As someone working in this industry, I can also say it's significantly harder to find exploitable bugs after another audit team went over it already. A criminal would have the same problem and might chose another target instead.