3 ms·
Yes I'm sure. It would be much more difficult, because that vulnerability could be possibly detected by many people reviewing the code, so it must be more sophi
by kbart 13y ago
Yes I'm sure. It would be much more difficult, because that vulnerability could be possibly detected by many people reviewing the code, so it must be more sophisticated and hidden than the one buried in the precompiled binary. Also I haven't seen any discovered backdoor/vulnerability on widespread open source product yet, contrary to the countless examples of products by big names. Not saying that open source is 100% secure, but it's still much safer than proprietary programs.
[EDIT] Thanks for pointing out Debian SSL example, I wasn't aware of that. But it still doesn't deny the key point I mentioned - that there are more discovered backdoors and vulnerabilities in proprietary software than the open one.
- claudius 13y ago> Also I haven't seen any discovered backdoor/vulnerability on widespread open source product yet. One could argue that the Debian SSL issue[0] would qualify as such a backdoor/vulnerability, although I don’t want to argue that it was introduced maliciously, merely that it could have been introduce with such intentions. [0] http://www.debian.org/security/2008/dsa-1571 http://www.debian.org/security/2008/dsa-1571
- DanBC 13y agoAll those people reviewing the code took two years to discover the Debian SSL bug. https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number... https://wiki.debian.org/SSLkeys https://wiki.debian.org/SSLkeys
- sneak 13y agoNow how long would that have taken WITHOUT source code? Would we _ever_ have known (without keyfiles on disk to analyze)?