3 ms·

Stupid question here -- whats the most efficient way to evaluate for vulnerabilities (i.e. remove the low level risk like 95% of the cases)? Is it trust the pa

• bee_rider 3y ago
  I’d love to be surprised, but I think there isn’t any way to evaluate for vulnerabilities other than read all the code (fairly carefully). I don’t think the ecosystem is set up to make it easy.
  • s9df898r32h 3y ago
    That's wrong because even coders can't write code without vulnerabilities inside their own software... You probably instead should use a throwaway computer (or VM if you trust them), and not do anything personal on that computer, and then burn it.
• keepamovin 3y ago
  Like 0ther folks say elsewhere in these threads, the most efficient way is not to eval for vulns, but to assume compromise. So, folks adopt the (admittedly ridiculous, but, in the strict sense, necessary) 0-trust step of running everything in QubesOS, then in a VM, and maybe then in Docker. Essentially each application gets its own fresh OS to fuck up or not...as it goes. I get this (but I don't condone it). It's not practical for dev purposes, only if you are endlessly testing the waters for each little thing. But, prolly, eventually we will be wowed by a shiny-thing that achieves infinity-virtualization with bare metal performance but perfect isolation so we can easiily run infinvm run github.com/malware/repo And all will be right with the world. We ain't there yet tho. Hahaha :)