Hacker News Reader

Hacker News

Comment by INTPenis | Hacker News Reader

Parent Full thread

INTPenis

I'm not the person you replied to but I agree, because it's related to public safety.

Same with aviation software.

Anything that deals with public safety should be audited by the public.

View on HN

It should be audited by professionals, but available for public reviews / additional audits.

General folks and even most devs do not have the skills to audit code.

Nothing prevents the owner of the code to audit it themselves, but everyone else should also be able to.

I think if you release code related to important everyday things like cars, everyone who is able will want to take a look. And you never know who will think outside the box and stumble across something they can then escalate and investigate with other people who are more capable. It happens in open source all the time.

Auditing your own code doesn't help if you have a blindspot. You will miss it while developing and auditing.

> Everyone who is able will want to take a look.

This is not true. Auditing is very skill intensive and time intensive. There needs to be compensation for it either direct (you pay for professional auditors) or indirect (you're an academic and you get reputation and grants for breaking WPA3, SGX, Mega or SIKE, or fame for breaking the PS3).

You can easily get in a situation with "The Emperor has no clothes" where everyone thought open-source code must have been audited by someone because it's open, when in fact no one did because they didn't care or had no incentives.

We live now in a world where the most qualified people are explicitly not part of the old definition of "qualified professionals"

What do you mean?

There's a lot of airplane enthusiasts which have very extensive knowledge in the field but never will be included in any of these "qualified professional" lists.

The knowledge nowadays is spread.

Do they have background in fuzzing or formal verification? That's what you need if you want to make high-assurance software.

I'm sure there's a lot of people specialized in that as well

There isn't

And here 2 years to find a buffer overflow vulnerabity in glibc that was found via a fuzzer: https://news.ycombinator.com/item?id=39194093

In a library used on billions of devices.

if that was a private project at some company, it would still probably be there. In the long run openness always win for reviews. That's what inevitably happens in a world where the knowledge is accessible to anybody. The only way to go against that is pour some tremendous amount of money and the result isn't even guaranteed.

It's a project used by millions of people yet it took 2 years.

What about projects used by 10~50 people?

What kind of strange argument is this? If it wasn't public, it would have never been found at all.

I'm going to trust more a project peer reviewed by the best devs on the planets compared to some homebrew homemade software where the devs allegedly know better than everybody else (and they don't)

Your argument is that asking for professional auditor is not necessary for open-source code.

My argument is that open-source is not enough when high-assurance is needed and devs or end-user should still ask for a professional audits.

I'm not saying professional auditors are useless, just that they will never reach the feedback you get from peer reviews and are not a replacement for peer reviews anyways.

We're not in the 90s anymore and it's time to acknowledge that the software world and even the world in general has changed. Knowledge is now spread and the most knowledgeable devs aren't working at an audit firm and might not even hold a computer degree!

The people who found the bug in glibc worked at an audit firm.

Peers aren't enough. Finding vulnerabilities require training and an adversarial mindset that is rare.

There is a reason why in cryptography people say "don't roll your own crypto"

Maybe we could start with this much less general principle:

Whenever the output of software is offered as evidence against you in court, you should be entitled to the source code of the software.

The post office workers in the UK who where f-ed over by the government because the software was reporting things incorrectly could really have used this as well. Should all our financial systems be open source too?

Maybe it should be like Copyright or patents, you can keep things private for a while for an advantage, but then you would need to release all code as open source / public domain or similar? It should also be available before that to be reviewed by professionals following a formal process of some sort.

> Should all our financial systems be open source too?

Yes.

That's really a good thing you are on to there.

More downvotes than upvotes. :/

HN doesn't like calls to take responsibility for what we produce. Regulation and responsibility are anathema here. But no worries, the world is fortunately a lot larger than that and little by little the tide seems to be turning towards holding the producers of software accountable for the works they produce, just like every other engineering discipline.

I can't wait.

Reply on news.ycombinator.com