7 ms·

And the people who can do so are usually the same people who’d be perfectly capable of analyzing binaries directly. Besides, you’ll never know if the code you’

by rosndo 5y ago

And the people who can do so are usually the same people who’d be perfectly capable of analyzing binaries directly. Besides, you’ll never know if the code you’re looking at abuses some compiler quirk without studying the binary.

bee_rider 5y ago
Somebody should tell the folks designing high-level languages that their code is no easier to analyze than a binary, I guess.
- Ensorceled 5y ago
  The person you are responding to is specifically talking about looking for exploits that are hidden behind compiler bugs or obfuscated by language features. So you're missing the point, I guess.
- dangerface 5y ago
  Debugging C is usually done in assembly so I guess they know.
- dmitriid 5y ago
  Level of the language has little to do with the complexity of code. - a modern OS has anywhere upwards of 50 million lines of code (Linux kernel alone is ~30 million lines of code) [1] - a modern browser is anywhere upwards of 30 million lines of code [2] - there are over 3.5 million individual packages available for the various Linuxes [3] And so on. The pretence that there are people and resources readily available to analyse those sources, and understand them well enough to uncover complex vulnerabilities is just that: a pretence, a myth. As evidenced by high-profile bugs that existed in popular codebases for years. Does the availability of source code make analysis somewhat easier? Yes. There's a difference though between reviewing left-pad on GitHub and auditing OpenSSL, for example. There are thousands of people who can do the former, and perhaps 5 who can do the latter. That is why "the number of people who can properly analyse complex software to uncover what it actually does is a line asymptotically approaching zero". [1] https://www.linux.com/news/linux-in-2020-27-8-million-lines-of-code-in-the-kernel-1-3-million-in-systemd/ https://www.linux.com/news/linux-in-2020-27-8-million-lines-... [2] https://www.openhub.net/p/chrome/analyses/latest/languages_summary https://www.openhub.net/p/chrome/analyses/latest/languages_s... [3] https://repology.org/repositories/packages https://repology.org/repositories/packages
vaylian 5y ago
> And the people who can do so are usually the same people who’d be perfectly capable of analyzing binaries directly. I doubt that. And even the people who are good at analyzing binaries probably prefer to have the source code available to save a lot of time.

by rosndo 5y ago

bee_rider 5y ago

Somebody should tell the folks designing high-level languages that their code is no easier to analyze than a binary, I guess.

Ensorceled 5y ago
The person you are responding to is specifically talking about looking for exploits that are hidden behind compiler bugs or obfuscated by language features. So you're missing the point, I guess.
dangerface 5y ago
Debugging C is usually done in assembly so I guess they know.
dmitriid 5y ago
Level of the language has little to do with the complexity of code. - a modern OS has anywhere upwards of 50 million lines of code (Linux kernel alone is ~30 million lines of code) [1] - a modern browser is anywhere upwards of 30 million lines of code [2] - there are over 3.5 million individual packages available for the various Linuxes [3] And so on. The pretence that there are people and resources readily available to analyse those sources, and understand them well enough to uncover complex vulnerabilities is just that: a pretence, a myth. As evidenced by high-profile bugs that existed in popular codebases for years. Does the availability of source code make analysis somewhat easier? Yes. There's a difference though between reviewing left-pad on GitHub and auditing OpenSSL, for example. There are thousands of people who can do the former, and perhaps 5 who can do the latter. That is why "the number of people who can properly analyse complex software to uncover what it actually does is a line asymptotically approaching zero". [1] https://www.linux.com/news/linux-in-2020-27-8-million-lines-of-code-in-the-kernel-1-3-million-in-systemd/ https://www.linux.com/news/linux-in-2020-27-8-million-lines-... [2] https://www.openhub.net/p/chrome/analyses/latest/languages_summary https://www.openhub.net/p/chrome/analyses/latest/languages_s... [3] https://repology.org/repositories/packages https://repology.org/repositories/packages

vaylian 5y ago

> And the people who can do so are usually the same people who’d be perfectly capable of analyzing binaries directly. I doubt that. And even the people who are good at analyzing binaries probably prefer to have the source code available to save a lot of time.