Hacker News Reader

Comment by xxs | Hacker News Reader

This is a very weak argument, eyeballs do find backdoors. Usually each commit is checked by few people and the introduction of the backdoor is rather obvious.

As for not knowing what has been downloading (if someone tempered with), the best approach is compiling it on your own.

View on HN

Can you cite any commits for any open source software where a back door was attempted to be introduced & code review found it pre-emptively?

The reason I ask is that this is an oft repeated claim about open source by developers yet when I talk to security people they don’t seem to care about open source nearly as much. To them inspecting binaries is table stakes anyway.

Meanwhile people write backdoors that aren’t obvious for fun. http://underhanded-c.org/

This is a very weak argument, eyeballs do find backdoors

Eventually, maybe. How many eyeballs and how long to find Heartbleed?

There's a difference between a potential backdoor and a bug. While a lot of eyeballs might oversee a bug, you have to make an effort to design your backdoor to go unnoticed.

Good backdoors are indistinguishable from bugs, for plausible deniability

The question isn't whether there won't ever be backdoors, but how likely that is, how long they will stay in place undetected, and what the effects on the reputation of the product/project/committer are once they are discovered.

Bringing this up as an argument is a sensible as claiming that transparency and democracy isn't any better than a dictatorship because there is still corruption.

Reply on news.ycombinator.com