Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

theguardian.com

Post reply on HN
Print view View original

41–49 of 49 posts

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#41

Post by zimpenfish »

stonogo wrote: post #40
zimpenfish wrote: post #26

Earlier quoted context omitted.

>How many people can authenticate a dollar bill? [...] nobody can audit these things. USGOV has a pretty comprehensive guide on how to validate them: https://www.uscurrency.gov/sites/default/files/downloadable-...

Please note the entire absence of the dollar bill from that document.

> Please note the entire absence of the dollar bill from that document.

A fair point. I took "dollar bill" to be the generic "US currency" rather than specifically "the $1 bill". But this page covers everything from $1 to $100 (although it seems the $1 and $2 have barely any.)

https://www.uscurrency.gov/denominations/

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#42

Post by zimpenfish »

manquer wrote: post #33
zimpenfish wrote: post #26

Earlier quoted context omitted.

>How many people can authenticate a dollar bill? [...] nobody can audit these things. USGOV has a pretty comprehensive guide on how to validate them: https://www.uscurrency.gov/sites/default/files/downloadable-...

There is also plenty of documentation and books to learn coding and start auditing if you want to. Fake validation is less like coding as to catch a really well made fake you would need years of experience seeing all sorts of fakes , while coding needs only experience to see what is good code to able to catch most issues

> coding needs only experience to see what is good code to able to catch most issues

If that were true, the software industry would have a much smaller problem re: bugs and errors than they currently do.

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#44

Post by manquer »

zimpenfish wrote: post #42
manquer wrote: post #33

Earlier quoted context omitted.

There is also plenty of documentation and books to learn coding and start auditing if you want to. Fake validation is less like coding as to catch a really well made fake you would need years of experience seeing all sorts of fakes , while coding needs only experience to see what is good code to able to catch most issues

> coding needs only experience to see what is good code to able to catch most issues If that were true, the software industry would have a much smaller problem re: bugs and errors than they currently do.

Less bugs would be there if the industry wanted it and paid for it.

Sadly the problem is good enough is how the industry sees everything, constant cost cutting , off shoring or replacing senior talent with fresh graduates , inadequate focus on security, debt is all too common, unless/until something affects bottomline there is no pressure.

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#45

Post by Traf444 »

pjmlp wrote: post #27
Traf444 wrote: post #24

Earlier quoted context omitted.

I guess you have never had commit rights to any Linux distribution or such? You don't get commit rights as a random person, so yes, a commit can usually be traced back to a person. Sure, the committer could have received a patch from a unknown person, but then he's still responsible for the commit.

I guess you are a security expert that knows how every single FOSS project that might be used as dependency works.

That's not what I tried to say. It's up to you as a user to make due diligence and make an informed decision if you want to use the software or not.

Any serious project would have some form of web of trust and know who has commit rights. It's up to you to decide if you trust their web of trust.

I guess from your comments that you are not actually interested in contributing to the discussion since you just sprout single line comments with no information at all.

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#46

Post by cassianoleal »

pjmlp wrote: post #31
cassianoleal wrote: post #30

Earlier quoted context omitted.

That may be so, but it's usually been through code reviews, pull requests and whatnot - which means a maintainer somewhere has approved that code. In any case, "a random nickname on the Internet, using a computer somewhere in the globe" is a lot more information than none. Finding out that that's the case for a given project is part of traceability.

How do ensure it wasn't a malicious maintainer? That information is meaningless if traces back to an empty room.

If the project has a malicious maintainer, it's easier to find out if it's in the open - and either forcing change or not using the project at all. It's impossible to do that when you have no access to that information in the first place.

It's not perfect but it's something vs nothing. I'll take something every time.

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#47

Post by pjmlp »

cassianoleal wrote: post #46
pjmlp wrote: post #31

Earlier quoted context omitted.

How do ensure it wasn't a malicious maintainer? That information is meaningless if traces back to an empty room.

If the project has a malicious maintainer, it's easier to find out if it's in the open - and either forcing change or not using the project at all. It's impossible to do that when you have no access to that information in the first place. It's not perfect but it's something vs nothing. I'll take something every time.

How do you track down a malicious maintainer, introducing a back door slowly during one year long, a little change at a time, given how long CVEs in OpenSSL have been unnoticed as example?

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#48

Post by pjmlp »

Traf444 wrote: post #45
pjmlp wrote: post #27

Earlier quoted context omitted.

I guess you are a security expert that knows how every single FOSS project that might be used as dependency works.

That's not what I tried to say. It's up to you as a user to make due diligence and make an informed decision if you want to use the software or not. Any serious project would have some form of web of trust and know who has commit rights. It's up to you to decide if you trust their web of trust. I guess from your comments that you are not actually interested in contributing to the discussion since you just sprout sing…

I contribute with experience instead of FOSS ideology absent from how things actually work.

Re: We see Project Pegasus, we must have Open Source Smartphones: let’s discuss

#49

Post by Traf444 »

pjmlp wrote: post #48
Traf444 wrote: post #45

Earlier quoted context omitted.

That's not what I tried to say. It's up to you as a user to make due diligence and make an informed decision if you want to use the software or not. Any serious project would have some form of web of trust and know who has commit rights. It's up to you to decide if you trust their web of trust. I guess from your comments that you are not actually interested in contributing to the discussion since you just sprout sing…

I contribute with experience instead of FOSS ideology absent from how things actually work.

No, you throw out nonsense single line sentences that say and contribute nothing.
Post reply on HN