3 ms·
Security auditing an app by source is not automatically easier than security auditing an app from its actual runtime behavior. Source can be a 1mloc tangled mes
by throwaway290 3y ago
Security auditing an app by source is not automatically easier than security auditing an app from its actual runtime behavior. Source can be a 1mloc tangled mess or have some vulnerable dependency deep in your dependency tree causing app to behave insecurely which could be quickly detected by monitoring how the app behaves in use, network packets sent, memory etc. How else do you think many 0days to closed products were found?
What you say can be true if source is readable and well written and you have somehow a guarantee that source is not modified before publishing the app. Or if you just are inexperienced with auditing the app other than reading the code (I know I am).
- NoImmatureAdHom 3y agoThis is really helpful for understanding, thank you. Perhaps the question is improved by incorporating the intent of the maintainers. An example: If we're interested in whether WhatsApp's developers have implemented the Signal protocol in good faith, because we suspect they have not (we suspect they've put in backdoors at the behest of bad governments), then having the source available (and reproducible builds to use) allows us to check that more easily than analysis on the binary's behavior. This is because the primary way the duplicitous maintainers would do this is in their own source. It's possible (and for three letter agencies probably common and desirable) to deliberately introduce bugs in dependencies that provide the desired behavior in some end product, but it probably shouldn't be our base case. Our base case should be: you swear your code implements the Signal protocol without backdoors...ok, great, you show us the code.