[Discuss] Good and Bad Crypto

[invalid at pizzashack.org (Derek Martin)]

On Tue, Apr 22, 2014 at 06:37:51PM +0000, Edward Ned Harvey (blu) wrote:
> Supposing a bad guy writes software, open source, and makes it
> available for download in source form as well as precompiled binary,
> where he's compiled some trojan into the binary.

Yes, this can happen.  And only if the source is available to you, do
you have ANY opportunity to verify it or rule it out.  If there is no
source, there is no possible way for you to know.

> You're saying, that the only way anybody in the world can trust
> anything, is to literally download everything from source, *read*
> all the source, and compile it themselves.

That's not what I'm saying actually, but what you have said is
literally and factually a true statement.

You can also choose to trust the software, based on the vendor's
reputation, but this is a fantasy.  You can choose to trust them also
on the basis that if you are damaged you can sue them to recover your
damages, there's a very good chance that this also is a fantasy.
Nevertheless we must all do this to some extent, because there isn't
enough time (or expertise for that matter) to thoroughly individually
evaluate every piece of software we install, let alone every decision
we make.

But there are those who make their living by investigating the flaws
in published software.  Their work, by its nature, must be verifiable.
Their work, by its nature, is certainly easier when they have the
source code.

It's almost hard to follow some news source these days without running
afowl of some business or government corruption motivated by
self-interest.  Your lack of imagination in this regard is kind of
disturbing, for someone who claims to be "pretty good at this."

> I call BS.

Calling BS on something doesn't make it false.

-- 
Derek D. Martin    http://www.pizzashack.org/   GPG Key ID: 0xDFBEAD02
-=-=-=-=-
This message is posted from an invalid address.  Replying to it will result in
undeliverable mail due to spam prevention.  Sorry for the inconvenience.