Hacker News Reader

1. Since most changes are compiled binaries, you would have to rely on the submitter to self-report what changed.

Things open source developers say because they don’t have experience with binary analysis. Not to say that Apple’s reviewers are going to be looking at IDA or Ghidra dumps, but they can see added capabilities, frameworks, symbols, or assembly and call graph changes.

Not that it matters, because they don’t have the time to manually review source code changes either. At best there’s likely some automated static analysis for undocumented API symbols and common malware signatures.

A larger issue is that to review these kinds of changes you need to have a baseline competency in understanding how code works, and that’s expensive to procure at the scale needed to do proper review.

A bad actor can just carefully exclude the reviewers from ever seeing those changes (and it's routinely done on a large scale).

Reply on news.ycombinator.com