4 ms·
How can a commercial solution prevent backdoors? A sensitive product like this would have to defend against well funded, patient, well resourced threats, inclu
by jasonjayr 2y ago
How can a commercial solution prevent backdoors?
A sensitive product like this would have to defend against well funded, patient, well resourced threats, including but not limited to infiltrating an organzation in order to plant code that only a few people may even be able to notice.
- 2OEH8eoCRo0 2y agoWell for one they need to show up in person. They can't be some anon anime character who hides their identity for totally legitimate reasons.
- dijit 2y agoIt's extremely easy for a three-letter agency or similar to plant a new employee. Corporate espionage may not be talked about very much, but it is still very fashionable. Even without state sponsored attackers.
- deleted 2y ago[deleted]
- toast0 2y agoAs an employee, I've typically needed to show up in person, but I've worked with contractors who never showed up in person. I've even been such a contractor at times. Lots of commercial products use contractors and licensed code in the final product. At least with most open source projects, a lot of the contribution process is in the open, so you could watch it you wanted to. As DonHopkins writes elsewhere, few people do, but it's possible. Not a lot of commercial projects offer that level of transparency into changes.
- kstrauser 2y agoI worked at my current job for 3 months before I met a coworker in person. That might slightly help at a legacy butts-in-seats factory, but doesn't do a lot for remote jobs. I could be proxying in from Romania for all they'd know.