4 ms·
The problem is, anyone who is serious about security is going to need to read the source and compile the binary they load onto their phone. Nontechnical people
by zwass 14y ago
The problem is, anyone who is serious about security is going to need to read the source and compile the binary they load onto their phone. Nontechnical people aren't going to be able to do that.
- hollerith 14y agoA tech guy can ask a non-tech guy if he can examine his phone. If the binary on the phone differs from any binary the tech guy can get by compiling clean source code, he can raise questions. This is how a group of tech guys who are in communication with each other can protect the privacy of a much larger population of non-tech guys.
- xyzzy123 14y agoRight; if you don't understand the technology (or like most of us, haven't taken the time to comprehensively review it) you have to rely on social proof.
- drivebyacct2 14y agoWell with those two sentences you've pretty much ensured that this is never, ever possible. You'd have to have a trust system from the silicon up, signed bootloader, hypervisor, no exploits, etc to guarantee that the system you're booting is executing the binaries you think it is. At some point "good enough" has to be enough. Okay, you built the APK, how do you know I don't control the VM and just swap out that JIT'd method with one that I've altered? (Repeat this until you get all the way back to the initial power-up)
- acuozzo 14y agoAh, good old "Reflections on Trusting Trust".
- xyzzy123 14y agoThinking about this really hard, I'm not sure how nontechnical people can ever be sure that they can trust technical artifacts?