4 ms·
Wouldn't open-source and/or auditing alleviate this?
by morjom 5y ago
Wouldn't open-source and/or auditing alleviate this?
- supermatt 5y agoYou would need reproducible builds and to manually verify the hash of the respective application bundle. But even then you need to trust the device to actually execute THAT bundle, of course... And even if it did, it could change its behaviour at runtime. Dont forget you are also trusting many layers below the app itself: Hardware design and manufacture, device manufacturers, distributers and vendors, the OS (and the 3rd party libs they depend on) developers and distributers, the underlying application libs, frameworks and runtime, the application notaries and distributers, etc. At any point there could be bugs/vulnerabilities/backdoors/etc.