Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

How would we know unless we can read (and compile) the source code?


People have, and do have access to it. Windows Research kernel. Kernel leaks, etc.

Generally the code quality is considered good.


I'm sure that the NSA agrees with you.


Yes they do! They also apparently like OSX, iOS, and RHEL.[1]

Oh wait, you were just trying to score cheap snark points, weren't you?

[1] - https://www.nsa.gov/ia/mitigation_guidance/security_configur...


Your link shows us how the NSA would like you to secure your systems, not their love for hiding their exploits behind closed sourced code. No snark points needed here!


Why would NSA bother with OSs, if they could get direct access to firmware, theoretically?


Costs?


Good point, actually. :)


Considering how few people read and compile the Linux source code, how do you know on Linux? Most distributions are binary, not source.


Fortunately that will change for Debian, and, we can hope, Debian-based distributions.

https://wiki.debian.org/ReproducibleBuilds

(I gave a talk about this at CCC. The status quo is a reason why free software doesn't have some of the transparency benefits over proprietary software we might expect, if you fear some developer is attacking you or someone is attacking some developers' infrastructure.)


jeez, great post. sorry for my bad humour at you the other day. es tut mir leid.


While that's true, I still know people who compile their own OS from scratch; I've gone through the experience of compiling my entire system from source via Linux From Scratch[0].

There are many thousands of people who have done the same thing, and this gives us a "web of trust". And if you don't want to trust anyone, you can always compile it yourself.

That's the difference: I have the freedom to learn and study anything and everything. It might not be likely, and it might not be convenient, but it is possible.

[0] - http://www.linuxfromscratch.org/lfs/view/stable/


I'm not sure about reading, but several distributions (notably, Gentoo and Slackware) encourage (and in the former case, require) users to configure and compile Linux from source instead of relying on a binary installation.

Of course, this doesn't do anything against a malicious install environment or a backdoored compiler, but it's a start.


Yes, and that's why so few people use those distributions.


Never claimed they were popular. Just that Linux From Scratch isn't the only option for those wishing to to run a kernel they built from source.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: