5 ms·
For a whole computer stack, that's true enough. Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is
by emiliobumachar 5y ago
For a whole computer stack, that's true enough.
Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.
- ChrisLomont 5y agoI don't think that's true. Care to pick some metric to check it? If anything, having source also makes it easier to auto scan for flaws at the source level and find holes. I know from CVEs that OS projects has a significant number of high profile long standing holes in it.
- squarefoot 5y ago> Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source. Case in point, the famous Borland InterBase backdoor that went unnoticed for about 7 years and 3 versions of the software but was discovered in 8 months by one developer after Borland released InterBase as Open Source. https://www.zdnet.com/article/borland-interbase-backdoor-detected/ https://www.zdnet.com/article/borland-interbase-backdoor-det...
- StreamBright 5y ago> Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source. Citation needed. On the other hand: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG