4 ms·
This idea seems to rely on the flawed assumption that you can’t security audit closed source software. This is not an assumption I’ve ever seen an actual securi
by kasey_junk 3y ago
This idea seems to rely on the flawed assumption that you can’t security audit closed source software. This is not an assumption I’ve ever seen an actual security researcher make.
Quite the opposite, they start with techniques they work on the binary and only use the source (if available) as a helpful reference. Hiding back doors in source has a long and storied history so relying on it to audit security has long been out of favor.
- kaliqt 3y agoWhat are the best ways to test for backdoors though? Phoning home I get. But what about just breaking in because there's a backdoor left in for when "they" single you out for persecu- I mean investigation.
- tptacek 3y agoYou read the compiled artifact. It's not complicated. Source code gives you valuable added context about programmer intent, which is helpful to understand how a program is structured, but you can't trust that intent if you're looking for surreptitious code anyways, and you don't need to to work out what the program is doing.