full-disclosure - Is Marty Lying?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: BlueBoar at thievco.com (Blue Boar)
Subject: Is Marty Lying?

security snot wrote:
> The "code audit" that you guys did to make sure nothing was backdoored was
> quite thorough too, considering since then remote bugs in Snort have been
> published.  If you can't even spot the vulnerable code you introduce into
> your source tree by accident, how can you definitively argue that no one
> else snuck in subtle bugs that you also didn't catch?

I'm sure it would have been extraordinarily difficult to run 'diff' on
the codebase before the intrusion and the one after, to see if any of
the changes weren't accounted for.

					BB