Elon Musk emails employees about 'extensive and damaging sabotage' by employee

Re:Elon Musk emails employees about 'extensive and damaging ... by gchadwick on Tuesday June 19, 2018 @09:30AM (#17346376)

As the under-handed C contest (http://www.underhanded-c.org/) demonstrates it's perfectly possible to write code that both looks innocent and apparently is innocent when run in a testing environment. You cannot produce a set of tests that show 'this code never causes anything bad to happen' so a sufficiently skilled malicious programmer could certainly write something that could cause issues that would pass stringent code review, testing and other quality control processes (especially when they have an in-depth understanding of those processes themselves).

I have no idea what has happened at Tesla, it's perfectly possible they lack processes they really should have, but you cannot prove that from the information available.

[ Parent | on HN ]

Re:Elon Musk emails employees about 'extensive and damaging ... by londons_explore on Tuesday June 19, 2018 @02:28PM (#17349137)

And even if they do lack review processes, it can't be said that putting in even the strictest of review procedures would stop a determined attacker.

It's almost childs play to hide a security vulnerability into a large 1000 line PR, down some error path, through a use after free, hidden deep in a library, a buffer overflow, a debug handler, or anything else really.

[ Parent | on HN ]