Hacker News Reader

Comment by tptacek | Hacker News Reader

What "guesswork"? What "black box"? Microsoft's code is the most comprehensively reverse-engineered in the world.

Somehow, between the beginning of the Linux era and, say, 2005 or so, people forgot how to efficiently comprehend large assembly programs. But it's not 2005 anymore; it's fully ten years later. Virtually every software security team in the world has multiple people on staff who know what basic blocks and control flow graphs are. There are credible open-source competitors to IDA, and arguably the best disassembler currently available costs something like $80 and backs assembly out to C.

Closed source software imposes meaningful, significant costs. It's reasonable to prefer open-source code, or even to require it. But we cannot reasonably make the excuse that closed-source code is a "black box" anymore.

View on HN

That's all so irrelevant to our discussion I wonder why you bring it up. The point is that a black box takes the kind of effort you describe to review: "meaningful, significant costs" most can't or won't invest using specialist skills or tools most don't have. Are you telling me you fully reverse engineer all the state and code paths in every proprietary offering you consider along with a robust evaluation against known vulnerabilities? Or do you look at their stated claims, prior/current credibility, and perform some basic evaluation? Most of us do the latter for economic reasons and that leaves proprietary software as a black box.

As for Microsoft, there's all kinds of people reverse engineering their code with most doing it to write exploits. So far, nobody has shared a link to a bug-for-bug compatible source equivalent for Bitlocker to analyze for cryptography issues. I'd just be taking someone else's word that (a) they R.E.'d it enough to see all potential subversions, (b) they had the skill to spot clever subversions with little context, and (c) they weren't lying to me. Please link to papers showing such a full deconstruction of the Bitlocker code with a hash that we can use to confirm it's the same on our machines. It will boost everyone's confidence in the product. Otherwise, you're talking like it's been rigorously R.E.'d and reviewed while providing zero citations to back that. Meanwhile, the Internet is full of citations on Microsoft's security failures and deceptions. Status quo stands until you deliver proof otherwise.

This is a bit tangential, but which are the credible open-source competitors to IDA and the arguably best currently-available assembler you're referring to?

He's talking about HopperApp.

Reply on news.ycombinator.com