Hacker News Reader

Comment by claudiojulio | Hacker News Reader

I really do not understand any of this. I am in the 1st period of the Information Systems course. But I know one thing, it's much easier to find a backdoor with the open code than the other way around. Besides that nothing guarantees that with these techniques you do not miss something.

View on HN

One of my perennial favorite HN comments: you, the professional reverse engineer, could not possibly do what you do. I've never tried to do it, but I know you can't.

More like I the lowly software developer can read code but I can't reverse engineer - and why should I learn?

It's fine not to learn. What's less fine is stridently asserting, as you have all over this thread, that security advice from experts is flawed while at the same time huffing about how little time you have to learn about the details.

I have repeatedly asked you to actually provide some citations for your claims. Please do so.

Whether it's open or closed source, you have to examine the actual binary code to see what's running on the device. And the tools for this are very good. Both Android and iOS have been very heavily vetted.

Given enough googly eyes, all bugs are hilarious.

Explicit backdoors are a tiny part of the risk you are exposed to, so even if the risk of a undiscovered backdoor in a product is higher than in another, it can still be more secure overall. The article we are commenting on explains quite a few points counting in favor of iOS. An adversary doesn't care about backdoors if the thing you use has plain old unplanned vulnerabilities they can exploit instead.

If you don't understand this, then you're in the wrong business. I hope your school teaches that even vetted security code can be turned against you.

Many people who find bugs for a living would argue the opposite.

Reply on news.ycombinator.com