undefined | Better HN

0 pointsspywaregorilla1y ago0 comments

100% of closed code is not inspected

0 comments

I have been involved in security audits for 110% closed code, code that's secret even within the company.

Auditing helps the company writing it, the auditors are usually experts in breaking stuff in fun ways, and it's good for business - we could slap "code security audited by XXX" on the sales pitch.

spywaregorillaOP1y ago

> and it's good for business - we could slap "code security audited by XXX" on the sales pitch.

You're on the precipice of discovering the problem of incentives when it comes to audits.

Audits are good, but they're inferior to source available

sodality21y ago

By you. Three comments above references "independent audits". Meaning professional cybersecurity firms

jeroenhd1y ago

From. what I can tell, Apple doesn't actually provide the source code itself, or provides the (cryptographically verified) binaries and VMs to run it. Reverse engineering will still need to take place, it seems.

j / k navigate · click thread line to collapse