News for hackers. Stuff that matters.

A comment on Progress update from the Librem 5 hardware department. Parent comment

Re:Progress update from the Librem 5 hardware department by lucb1e on Tuesday September 04, 2018 @09:06PM (#17914297)
> Realistically the security research community who find things like phone exploits are very well accustomed to a lack of source code

Realisticaly, though, a manufacturer or intelligence agency will be the one paying security people for thorough reviews. Anyone doing this in the open would do this to build a reputation or for their own security, and will need much more time to review something that first needs to be reverse engineered. They will almost certainly not be able to look at everything.

It's not a logical argument to say that we security people are used to reading obfuscated binaries anyway and conclude that therefore no fewer bugs will be found compared to the situation in which it is open source.

[ Parent | on HN ]
Re:Progress update from the Librem 5 hardware department by tptacek on Tuesday September 04, 2018 @09:49PM (#17914502)
This is one of the rare instances in which there actually is a liquid market for viable vulnerabilities and exploits, so no, I don't think it's safe to say that the only people doing this kind of research are in the IC or vendors.
[ Parent | on HN ]