4 ms·
Okay, event you are assured that the source code you see are the origin of the binary you run, still no one can guarantee you there are no security concerns. Th
by mrjin 5y ago
Okay, event you are assured that the source code you see are the origin of the binary you run, still no one can guarantee you there are no security concerns.
The reason is simple: software are written by human, at best they were created with good will and there were due diligence. But doesn't matter how careful the developers and the auditors(if there were any) were, there are for sure security related bugs. Making it worse, there have been and going to have lots of deliberately planted backdoors. Given the complexity of the software and the cost of auditing, even if you have all the original source code, most likely you are unable to reveal planted backdoors. And if you indeed found something, how can you tell whether it was bug or a backdoor?
- pabs3 5y agoThis part of the subthread was about ensuring the binary you run was built from the source code you have. Of course there could be bugs in that source code and or bugs in the resulting binary, so you have to audit both of them and fix anything suspicious.