Linux codebase is fucking huge and not always written by experts. OpenBSD codebase is smaller and constantly audited

but you also have the fact that there are less eyeballs on openbsd's code

You can’t check for backdoors on proprietary software

Besides, you can't check for backdoors in open source software either https://en.m.wikipedia.org/wiki/Underhanded_C_Contest

You can

No unless you’re given access to the source code

No unless you’re given access to the source code

Reverse engineering exists

Besides, you can't check for backdoors in open source software either https://en.m.wikipedia.org/wiki/Underhanded_C_Contest

.

It is as easy to hide a backdoor in open source as it is to hide one in closed source

but you also have the fact that there are less eyeballs on openbsd's code

Linux has a wide user base but many less contribute to the code. OpenBSD is the opposite

If you think otherwise then you haven't seen an actual backdoor

Nah, it's just a bot doing random stuff with the kernel until it crashes

and it just does all the possible stuff until it crashes?

and it just does all the possible stuff until it crashes?

You want technical details?

It is as easy to hide a backdoor in open source as it is to hide one in closed source

it might be easy, but with closed source you dont even have to try, just put it there and call it a day

Well, essentially google compiles the kernel with kasan, ktsan and many other sanitizers

You want technical details?

yeah im curious

And then they wait for their injected code to crash the kernel

That's how 70-80% of linux kernel bugs are found

The remaining 10% are found by improving security of the kernel by adding exploit mitigation

There is a very tiny percentage of bugs that are ever found by reading code

still, you haven't given me a good reason to not strip down intel ME

It just isn't possible to find vulnerabilities by reading code and I'll show you why

So, go to the home page of the C standard

And just read it

You'll realise why reading the code is the worst way to find bugs

Just go and read it

It can do more depending on what the vendor lets it do

so the vendor basiclly does what it wants with the enclave and I have no control over it?

You're telling me that you can memorize several thousands of rules in that C standard? And that each of them would be on your tongue and you'd iterate through each of them for every single line of code you write?

That's just not how it works at scale

And you're trusting that the compiler implements the standard correctly

Which it doesn't

You're trusting that your standard library, malloc, etc respect the standard

Which they don't

Which they don't

why dont they? what is their reason?

Reading code is not going to help you find vulnerabilities

why dont they? what is their reason?

It's impossible to accurately implement something this complex

How would you do it?

How would you do it?

I can't, I just started learning C

I can't, I just started learning C

Yeah, so you haven't even been made aware that there's actually a standards body for it

If you read the standard

You'll agree with me

You cannot find vulnerabilities by reading code

You cannot remember all of those rules

Even if you memorized, iterating through all of that would be impossible

Btw if you want I can tell you how to setup linux and find your own vulnerability

You'll find your own vulnerability with 0 knowledge of C in 5 seconds - 5 hours

And once you do that you'll realise that vulnerability counts themselves have nothing to do with security

If you don't believe me I invite you to see for yourself

And once you do that you'll realise that vulnerability counts themselves have nothing to do with security

so what does count as security?

so what does count as security?

Well, I'll talk later

But essentially BSD does have a problem

BSD is like putting huge locks on your doors

But essentially BSD does have a problem

So what is your OS solution?

And having a really strong door

But leaving the windows wide open

....

So what is your OS solution?

none apparently at this point

none apparently at this point

Yep More Trolling IMO

So what is your OS solution?

Modern OSes like fuchsia running on zircon, formally verified oses like sel4

Modern OSes like fuchsia running on zircon, formally verified oses like sel4

even then there will still be userspace software with garbage security

even then there will still be userspace software with garbage security

It'll be irrelevant

Modern OSes like fuchsia running on zircon, formally verified oses like sel4

So you support Googles tracking

Fuchsia will sandbox everything

So you support Googles tracking

I hope its opensource so at least we can remove those components

Fuchsia will sandbox everything

Yep lik3 Chrome OS does and you still have to usw your Google account

Wonderful

So you support Googles tracking

I thought this was freebsd group but no, this is twitter Me: hey, I like roses Random guy: so, YOU hate vegetables! Or even better Me: I like pineapple Me: I like pizza Random guy: then you'll love pineapple pizza What

I hope its opensource so at least we can remove those components

If so... It would be good

I thought this was freebsd group but no, this is twitter Me: hey, I like roses Random guy: so, YOU hate vegetables! Or even better Me: I like pineapple Me: I like pizza Random guy: then you'll love pineapple pizza What

Oh you thought.... That is your fault Thinking....uuhhh....can be tricky

Yep ...let him troll

I hope its opensource so at least we can remove those components

Realise that android satisfies the definition of FLOSS

I don't see how google would close off fuchsia either

I don't see how google would close off fuchsia either

Get you money from Google?

Modern OSes like fuchsia running on zircon, formally verified oses like sel4

any other information about zircon? what's the origin of this kernel ?

any other information about zircon? what's the origin of this kernel ?

Zircon is a microkernel

any other information about zircon? what's the origin of this kernel ?

No feed for this troll

thanks

Completely written from scratch

Based off nothing

Zircon is what you'll eventually want in mission critical environments

just curious

You cannot remember all of those rules

I don't really agree with this. It's quite feasible to know almost all the weird edge cases to the C language standard, but I'd say it's mostly irrelevant. I doubt there are many vulnerabilities in C code that are due to weird edge cases in the language that most competent C programmers don't know about. It's more a case of analyzing code by hand being inherently difficult anyway when searching for bugs.

You cannot tolerate windows having a BSOD or Linux kernel panicking in your self driving car