Re: reverse engineer c or java

[cerebus () SACKHEADS ORG (Miller, Timothy)]

Bluefish <11a () GMX NET> writes:

> Anyway; given access to files, it is easier to create backdoored variants
> if the source code is open, or you use java (seems to be close to the same
> thing ;) But to rely upon C with none-open sourcecode is not the solution,
> because it simply makes it harder, it doesn't stop an inventive attacker
> with good programming knowledge.

Exactly so; I've seen more than enough binary patches in my time to
scare the bejeezus out of anyone.

However, with open access to the source, one can easily perform a
code-walk and a compile verification against distributed binaries.
The login/gcc backdoor aside, this provides a much greater degree of
assurance.