4 ms·

Because you've read the source code of user account logins of the OS you're running right now?

• cperciva 17y ago
  I don't know if he has, but I've read the source code used for user logins in the OS I'm running. Depending on exactly where you draw the line between "code used for user logins" and the rest of the OS, I may have fixed bugs in it, too.
  • mahmud 17y ago
    you are often the exception rather than the rule, cperciva.
    • wrinklz 17y ago
      It's the exceptional hackers that generally catch these problems early and patch them before they become a big problem, that is true.
      • wglb 17y ago
        And make the patch widely available, rather than remaining silent.
    • jerf 17y ago
      Yes, but knowledge about code is very transmittable. The fact that someone like cpercival can examine the code, and has, means that I can just freeride on his analysis, along with everybody else who has also read it. Only a fraction of users need to verify the code for all of use to benefit. And "only a fraction of users" for an open source project can still be a lot more users than Microsoft can bring to bear, and a higher caliber of users, too. Of course, Microsoft could do most of the same thing if they opened their source. People would read that too. But that's another issue, of course.
      • m_eiman 17y ago
        There's a slight problem with the "google the problem, find a patch and apply it": if you can't read and understand the patch, you're in no better (and probably worse) shape than you were before, security-wise. In some ways having a late patch from a trusted source is better than a quick one from some random place on the net. The best would be quick, trusted patches, of course. A GPG-style web of trust validation of patches, maybe?
        • gmartres 17y ago
          Typically, the guy who found the flaw and fixed it will submit it to the upstream developers which hopefully will be able to tell if the patch can be trusted or not, apply it to the development repository, eventually release a patched version, and warn vendors(mostly, Linux distributions) to upgrade. The user only has to keep up to date.
          • m_eiman 17y ago
            Sure, but then you're back to having to wait for the vendor to supply a patch.
            • m_eiman 17y ago
              So you're (you being the who downvoted my comment) saying that you're NOT waiting for a vendor to approve and distribute a patch if it's been propesed by an outside developer? Please elaborate.
• viraptor 17y ago
  I think he means that if the bug was in some open-source system, we could expect a patch to be ready from someone a few hours after such announcement, instead of "as of yet, Apple has been silent."
• omouse 17y ago
  More coders should be reading source code. Thanks for the idea, gonna spent a few hours reading the user account logins shit for GNU/Linux now ;p