4 ms·

Nothing prevents the owner of the code to audit it themselves, but everyone else should also be able to. I think if you release code related to important every

Nothing prevents the owner of the code to audit it themselves, but everyone else should also be able to. I think if you release code related to important everyday things like cars, everyone who is able will want to take a look. And you never know who will think outside the box and stumble across something they can then escalate and investigate with other people who are more capable. It happens in open source all the time.

mratsim 3y ago
Auditing your own code doesn't help if you have a blindspot. You will miss it while developing and auditing. > Everyone who is able will want to take a look. This is not true. Auditing is very skill intensive and time intensive. There needs to be compensation for it either direct (you pay for professional auditors) or indirect (you're an academic and you get reputation and grants for breaking WPA3, SGX, Mega or SIKE, or fame for breaking the PS3). You can easily get in a situation with "The Emperor has no clothes" where everyone thought open-source code must have been audited by someone because it's open, when in fact no one did because they didn't care or had no incentives.