4 ms·
1. Since most changes are compiled binaries, you would have to rely on the submitter to self-report what changed.
by joshspankit 4y ago
1. Since most changes are compiled binaries, you would have to rely on the submitter to self-report what changed.
- dvzk 4y agoThings open source developers say because they don’t have experience with binary analysis. Not to say that Apple’s reviewers are going to be looking at IDA or Ghidra dumps, but they can see added capabilities, frameworks, symbols, or assembly and call graph changes. Not that it matters, because they don’t have the time to manually review source code changes either. At best there’s likely some automated static analysis for undocumented API symbols and common malware signatures.
- saagarjha 4y agoA larger issue is that to review these kinds of changes you need to have a baseline competency in understanding how code works, and that’s expensive to procure at the scale needed to do proper review.
- realusername 4y agoA bad actor can just carefully exclude the reviewers from ever seeing those changes (and it's routinely done on a large scale).