Vetting the cargo [LWN.net]

Vetting the cargo

Posted Jun 13, 2022 8:45 UTC (Mon) by taladar (subscriber, #68407)
In reply to: Vetting the cargo by edeloget
Parent article: Vetting the cargo

> but such a large number of dependencies will always mean that you cannot develop reasonably secure programs with them - no amount of public audit will ever help.

As if a small number of extremely large dependencies (think Qt or Boost) would be better here. If anything the large dependencies make it much easier to overlook a suspicious change.

to post comments

Vetting the cargo

Posted Jun 13, 2022 11:51 UTC (Mon) by hkario (subscriber, #94864) [Link] (3 responses)

large dependencies also usually have large number of developers, and those developers are concentrated on that one project, causing much more eyes looking at the code every day

Vetting the cargo

Posted Jun 13, 2022 12:33 UTC (Mon) by farnz (subscriber, #17727) [Link]

Only if most developers range over the entire project; in my employer's codebase, there is a foundational library that is part of a big dependency where I know for a fact that there is only one person in the entire company who looks at the code regularly, and gets their code reviewed by a selection of people who trust them to get it right. If they were malicious, they have a very good chance of slipping bad code in without being caught despite code review.

At least with small dependencies, the effort to rewrite if upstream is malicious is low.

Vetting the cargo

Posted Jun 13, 2022 13:09 UTC (Mon) by colejohnson66 (subscriber, #134046) [Link] (1 responses)

The "many eyes" theory is complete bogus. OpenSSL had Heartbleed in it for literal years and no one noticed.

Vetting the cargo

Posted Jun 13, 2022 13:22 UTC (Mon) by Wol (subscriber, #4433) [Link]

"Many eyes makes bugs shallow".

Which is true. It's extremely easy to look straight through something you're not expecting to see, many eyes on their own are useless. Note also the "makes bugs shallow". It doesn't say it makes them easy to notice. It *does* mean that once you know there is a bug, it's not going to be able to hide for long.

Which has been borne out many times. What is the expected life-time of a bug once it's been spotted? Hours? Certainly not much more.

(But then, of course, in addition to the time at the start where no-one knew there was a bug, you also have the long tail where the bug has been fixed, but the fix has not been deployed.)

Cheers,
Wol