Hacker News Reader

Comment by redthrowaway | Hacker News Reader

>The code itself is 50 times as big as the typical computer worm

All else aside, this is a clear pointer to government contractors.

I think they are confusing the terms here. What they mean is that the worm itself is 20 mb in size where as average is about 1 mb. So The worm's code is 20x. They probably don't know that worm's size and it's source code are two different things. They are NYT not a tech blog, so i guess this is excusable.

but i think they got their point across well enough; technical trvialities don't matter at all in this case.

How did they possibly know the code is 50 times that big. Is the code out in the open?

"Several layers of masking obscured the zero-day exploit inside, requiring work to reach it, and the malware was huge — 500k bytes, as opposed to the usual 10k to 15k." - http://www.wired.com/threatlevel/2011/07/how-digital-detecti...

This is a great read and very informative!

Yes it is, but your parent post was asking how they knew how large the source code was. This quotation is reporting the size of the final binary.

Where did the article say 'source code'? Machine code is still 'code'.

You have to consider the audience the NY Times is targeting. Just knowing what a compiler is puts one in relatively sparse company.

Yes.

The relationship between compiled code and source code is not as mysterious as you're making it out to be. This is not a hard analysis to conduct.

Incidentally, from friends who do serious malware reversing work (we do not do any malware work): the "50x bigger, feels like pro contractors" assessment rings true for several other reasons; for instance, the style of programming used in the worm itself.

Reply on news.ycombinator.com