3 ms·
The point, though, is that releasing the source code under the pretense that it is the running code can create a legal obligation that what's released is what's
by gipp 12y ago
The point, though, is that releasing the source code under the pretense that it is the running code can create a legal obligation that what's released is what's run. No, it doesn't prevent them from running something else, but it at least creates the possibility of audits and consequences if they do so.
- zmmmmm 12y agoThanks - this is exactly my point.
- efaref 12y agoBut do you even trust the compiler they use? Computers you don't totally control are inherently untrustworthy: http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html For most things it doesn't matter enough, but for deciding who gets to run the country, I think we need a higher standard.
- SixSigma 12y agoSo why not also demand the object code. Then you can mistrust the hardware instead.
- bmm6o 12y agoI know everyone likes to cite that paper whenever they can, but it's not really relevant here. In this hypothetical, they give you the source but they compile it to binary. They do not provide you with the compiler or its source. The compiler can be malicious, but there's no need to hide its maliciousness - they don't even prove that the software running is in any way derived from the source they've given you! It would be a giant leap forward to have to design against KT-level shenanigans. The whole process can currently be subverted with CS 101-level jiggery pokery.
- esquivalience 12y agoThey already have a legal obligation to count appropriately. The publicity of the source code is irrelevant to that.