5 ms·

If you are really concerned about security, why would you trust an prebuilt binary of an open source project. The source is available, just grab the source and

by x0054 11y ago

If you are really concerned about security, why would you trust an prebuilt binary of an open source project. The source is available, just grab the source and build it your self. That way you at least know what you have.

pbhjpbhj 11y ago
You mean you can't tell what the program is doing by just glancing over the binary in a hex editor? /s You have to be a pretty good programmer to identify obfuscated code in something like Putty I'd imagine - particularly as all the parts needed for snooping are intended to be there: certainly I (a non-programmer) couldn't guarantee to spot a reverse SSH connection being used for key-logging. Configure-make-install I can do but proper security level code review is not something I'd expect most programmers could do (otherwise we wouldn't have things like Heartbleed, surely?). Web-of-trust in some form seems like the answer; but ultimately you need someone trustworthy to be paid (or equivalent) to do a proper review and oversee the securing/signing of that code as reviewed.
- x0054 11y ago
  You also can not assume that the original author of PuTTY isn't secretly working for NSA, or who ever. The fact is, the ONLY safe way to get PuTTY is to indeed grab the code, go through it line by line, and than build it, and hope that your compiler sin't infected as well. I am just point out that it's more difficult to hide things inside the code than it is in the built binary, not impossible, but more difficult. Web-of-trust, what ever that might mean, isn't helpful because you ultimately have to trust someone. How do you know the person you are trusting isn't an NSA agent?
  - pbhjpbhj 11y ago
    >How do you know the person you are trusting isn't an NSA agent? // You don't but the top node in your web has to be trusted by lots of other people, some ideally are able to confirm the code is kosher - you need a massive conspiracy to happen or to have put your trust in people who couldn't care less about putting their name to malicious software. It's like if dang tells you something is an official HN policy you might trust it, but if that statement by dang is signed by other HN officials then you're going to be pretty certain that's true. Kinda like a technical "social proof". If I know that Stallman, Torvalds, Wozniak are using a piece of software then I'm going to be pretty confident that it's been checked out as much as any piece of software. Yes they could _all_ be endorsing it because the NSA told them too.
TheLoneWolfling 11y ago
I just checked: PuTTY's Windows source code is ~190 files, or ~123145 lines. If you assume you can read a line a second (and you can't), that's more than 34 hours (!).
- lucaspottersky 11y ago
  look at the bright side, it's still a fraction of what you'd get if you were to build your own thing. :)

by x0054 11y ago

pbhjpbhj 11y ago

You mean you can't tell what the program is doing by just glancing over the binary in a hex editor? /s You have to be a pretty good programmer to identify obfuscated code in something like Putty I'd imagine - particularly as all the parts needed for snooping are intended to be there: certainly I (a non-programmer) couldn't guarantee to spot a reverse SSH connection being used for key-logging. Configure-make-install I can do but proper security level code review is not something I'd expect most programmers could do (otherwise we wouldn't have things like Heartbleed, surely?). Web-of-trust in some form seems like the answer; but ultimately you need someone trustworthy to be paid (or equivalent) to do a proper review and oversee the securing/signing of that code as reviewed.

x0054 11y ago
You also can not assume that the original author of PuTTY isn't secretly working for NSA, or who ever. The fact is, the ONLY safe way to get PuTTY is to indeed grab the code, go through it line by line, and than build it, and hope that your compiler sin't infected as well. I am just point out that it's more difficult to hide things inside the code than it is in the built binary, not impossible, but more difficult. Web-of-trust, what ever that might mean, isn't helpful because you ultimately have to trust someone. How do you know the person you are trusting isn't an NSA agent?
- pbhjpbhj 11y ago
  >How do you know the person you are trusting isn't an NSA agent? // You don't but the top node in your web has to be trusted by lots of other people, some ideally are able to confirm the code is kosher - you need a massive conspiracy to happen or to have put your trust in people who couldn't care less about putting their name to malicious software. It's like if dang tells you something is an official HN policy you might trust it, but if that statement by dang is signed by other HN officials then you're going to be pretty certain that's true. Kinda like a technical "social proof". If I know that Stallman, Torvalds, Wozniak are using a piece of software then I'm going to be pretty confident that it's been checked out as much as any piece of software. Yes they could _all_ be endorsing it because the NSA told them too.

TheLoneWolfling 11y ago

I just checked: PuTTY's Windows source code is ~190 files, or ~123145 lines. If you assume you can read a line a second (and you can't), that's more than 34 hours (!).

lucaspottersky 11y ago
look at the bright side, it's still a fraction of what you'd get if you were to build your own thing. :)