5 ms·

Audited code can still have bugs.

• throw10920 5y ago
  Of course! But it generally has fewer bugs than it did before, and you have greater confidence that it has fewer bugs. Perfect security is not achievable - you just make the best trade-offs that you can. Log4j has, to my knowledge, never been audited.
  • als0 5y ago
    I'm just pointing out that you assume Apple deployed unaudited code, just because the code had a bug. I would not make that assumption.
    • throw10920 5y ago
      My apologies, I wasn't clear. I agree, audited code can have bugs - but I'm not assuming that the presence of the bug was the indicator that it hadn't been audited. I'm taking the fact that I haven't heard of log4j being audited, the fact that I haven't heard of Apple auditing an external product before importing it into their environment, and the fact that auditing open-source software isn't standard practice among tech companies to make that assumption. ...although, the bug is sort of blatant. I would hope that an audit would catch this particular one, at least.