Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>So now "easily" has turned into going to a third party App Store and either blindly trusting an app wont surreptitiously store and forward all of your data or either trusting that someone else has audited the code or audit the code yourself and to be doubly sure, build the code yourself.

The thing with open source reproducible builds of popular software is that somebody else has already done that verification, so you don't have to do anything. That's how easy it is.

To get the same level of assurance on an iOS device, you would have to reverse engineer the app binary. Of course, it's not even possible to begin with because Apple doesn't allow system-wide adblockers at all.



How well did that "open source reassurance" work for finding the security vulnerability that led to HeartBleed? The vulnerability went undiscovered for 1.5 years?


Much better than the lack of open source vetting that led to Xcodeghost and "goto fail."




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: