Re:iMac Pro's T2 chip
by ClassyJacket on Thursday January 04, 2018 @03:21PM
(#16073709)
"Those millions of potential eyeballs didn't find the Heartbleed bug."
Sorry, how would we be talking about it if they didn't find it?
Re:iMac Pro's T2 chip
by scarface74 on Thursday January 04, 2018 @03:27PM
(#16073760)
After two years when it was in open source code?
How is that any better of a track record than vulnerabilities found in closed source code?
We don't really know when it was first found, iirc, only when it was publicized.
Re:iMac Pro's T2 chip
by scarface74 on Friday January 05, 2018 @01:01AM
(#16076864)
That's not helping the case for open source software...
Exactly.. Open source is awesome, don't get me wrong, but it's not safer by definition. Sure, people can look for problems and openly discuss it and fix it, but that's assuming they are whitehats. Blackhats are also looking, all day every day, for exploits in open-source code. And they can find them before whitehats do.
Re:iMac Pro's T2 chip
by scarface74 on Thursday January 04, 2018 @03:39PM
(#16073867)
Yes. Not necessarily with the knowledge I currently possess or with the effort I'm currently willing to put in, but if I wanted to put in the necessary effort and study, I could. Having that option open to me has value in and of itself even if I choose not to exercise it.
And the option is also open to you to be really good and find security vulnerabilities in closed source software just like the researchers at Google do and all of the people who found jailbreaks.
But even then, that wouldn't have helped with the latest bug found in x86 microcode...
> he said he could do it
Yes. Not necessarily with the knowledge I currently possess or with the effort I'm currently willing to put in, but if I wanted to put in the necessary effort and study, I could. Having that option open to me has value in and of itself even if I choose not to exercise it.
There are people looking and finding security vulnerabilities in closed software. Why do you assume that it's any harder for a skilled assembly language coder to find vulnerabilities in closed source software. Heck back in the day I knew assembly language well enough to read and understand dissembled code and I wasn't that great at it.