[Cryptography] [cryptography] Question About Best Practices for Personal File Encryption

[Theodore Ts'o]

On Sun, Aug 17, 2014 at 03:06:58PM -0700, Andy Isaacson wrote:
> The intellectual labor of decompiling a program delivered as a binary is
> not especially large compared to the labor required to do a thorough
> systematic review.  Given IDA Pro and a non-obfuscated Win32 or Linux
> app, people I trust say the decompilation process is on the order of
> 10%-20% of the total effort of a review.

That may be true --- although decompilation doesn't give you any code
comments and/or code history, which significantly eases the work
needed to review a portion of code.  

Even if we accept those figures, you are assuming that the only choice
is "no review at all" and a "thorough review".  It may only be 10-20%
of a very large amount of effort to do a total, thorough review.  But
it is enough work that it prevents anyone from doing a casual review.
A casual review won't find all bugs, but if enough people look at
different parts of the code, the probability that a vulnerability will
be noticed increases significantly.  This is especially true if people
are doing not-so-casual reviews of the code in preparation for making
changes.

Of course, the changes might introduce additional vulnerabilities ---
but not all vulnerabilities will be catastrophic vulnerabilities of
the sort that a backdoor might introduce.

So yes, granted, open source doesn't solve the backdoor problem; but
by your own admission, it makes the problem at least 20% easier, and I
suspect the situation is much better than that.

Regards,

					- Ted