3 ms·
Maybe we should have security-interested folks develop their own versions of popular open-source software which can then be “critical”, with formal methods. It’
by armchairhacker 4y ago
Maybe we should have security-interested folks develop their own versions of popular open-source software which can then be “critical”, with formal methods. It’s hard to audit or verify an existing codebase, it would likely be a lot easier to just start from scratch.
It would give security and formal-methods people something to do
- kjellsbells 4y agoIm not an OpenBSD insider, but this feels very much like what that team have reluctantly and yet repeatedly concluded that they need to do. LibreSSL and OpenNTPD and pf, for example. There's also the risk implicit in a stack with no single authority, which is a difference between a combined OS and runtime like the BSDs and the Linux distros. RH and Canonical do the lords work keeping up, but its never really going to be the same as the BSD people and their tight coupling. This probably makes me sound like a BSD bigot, which is not my intent, but it does seem to me that there is a cost to all this flexibility that Linux pays a high price for.