4 ms·

It should be audited by professionals, but available for public reviews / additional audits. General folks and even most devs do not have the skills to audit c

It should be audited by professionals, but available for public reviews / additional audits. General folks and even most devs do not have the skills to audit code.

INTPenis 3y ago
Nothing prevents the owner of the code to audit it themselves, but everyone else should also be able to. I think if you release code related to important everyday things like cars, everyone who is able will want to take a look. And you never know who will think outside the box and stumble across something they can then escalate and investigate with other people who are more capable. It happens in open source all the time.
- mratsim 3y ago
  Auditing your own code doesn't help if you have a blindspot. You will miss it while developing and auditing. > Everyone who is able will want to take a look. This is not true. Auditing is very skill intensive and time intensive. There needs to be compensation for it either direct (you pay for professional auditors) or indirect (you're an academic and you get reputation and grants for breaking WPA3, SGX, Mega or SIKE, or fame for breaking the PS3). You can easily get in a situation with "The Emperor has no clothes" where everyone thought open-source code must have been audited by someone because it's open, when in fact no one did because they didn't care or had no incentives.
realusername 3y ago
We live now in a world where the most qualified people are explicitly not part of the old definition of "qualified professionals"
- mratsim 3y ago
  What do you mean?
  - realusername 3y ago
    There's a lot of airplane enthusiasts which have very extensive knowledge in the field but never will be included in any of these "qualified professional" lists. The knowledge nowadays is spread.
    - mratsim 3y ago
      Do they have background in fuzzing or formal verification? That's what you need if you want to make high-assurance software.
      - realusername 3y ago
        I'm sure there's a lot of people specialized in that as well
        mratsim 3y ago
        There isn't
        mratsim 3y ago
        And here 2 years to find a buffer overflow vulnerabity in glibc that was found via a fuzzer: https://news.ycombinator.com/item?id=39194093 https://news.ycombinator.com/item?id=39194093 In a library used on billions of devices.
        realusername 3y ago
        if that was a private project at some company, it would still probably be there. In the long run openness always win for reviews. That's what inevitably happens in a world where the knowledge is accessible to anybody. The only way to go against that is pour some tremendous amount of money and the result isn't even guaranteed.
        3y ago

It should be audited by professionals, but available for public reviews / additional audits. General folks and even most devs do not have the skills to audit code.

INTPenis 3y ago

Nothing prevents the owner of the code to audit it themselves, but everyone else should also be able to. I think if you release code related to important everyday things like cars, everyone who is able will want to take a look. And you never know who will think outside the box and stumble across something they can then escalate and investigate with other people who are more capable. It happens in open source all the time.

mratsim 3y ago
Auditing your own code doesn't help if you have a blindspot. You will miss it while developing and auditing. > Everyone who is able will want to take a look. This is not true. Auditing is very skill intensive and time intensive. There needs to be compensation for it either direct (you pay for professional auditors) or indirect (you're an academic and you get reputation and grants for breaking WPA3, SGX, Mega or SIKE, or fame for breaking the PS3). You can easily get in a situation with "The Emperor has no clothes" where everyone thought open-source code must have been audited by someone because it's open, when in fact no one did because they didn't care or had no incentives.

realusername 3y ago

We live now in a world where the most qualified people are explicitly not part of the old definition of "qualified professionals"

mratsim 3y ago
What do you mean?
- realusername 3y ago
  There's a lot of airplane enthusiasts which have very extensive knowledge in the field but never will be included in any of these "qualified professional" lists. The knowledge nowadays is spread.
  - mratsim 3y ago
    Do they have background in fuzzing or formal verification? That's what you need if you want to make high-assurance software.
    - realusername 3y ago
      I'm sure there's a lot of people specialized in that as well
      - mratsim 3y ago
        There isn't
        mratsim 3y ago
        And here 2 years to find a buffer overflow vulnerabity in glibc that was found via a fuzzer: https://news.ycombinator.com/item?id=39194093 https://news.ycombinator.com/item?id=39194093 In a library used on billions of devices.
        realusername 3y ago
        if that was a private project at some company, it would still probably be there. In the long run openness always win for reviews. That's what inevitably happens in a world where the knowledge is accessible to anybody. The only way to go against that is pour some tremendous amount of money and the result isn't even guaranteed.
        3y ago