trusting software

[Doug Merritt]

ogr at wyvern.wyvern.com (Jason Plank) said:
>Penned by Doug Merritt:
>> Furthermore, even close reading won't absolutely *guarantee* the lack of
>> backdoors in all cases, even if the reader is an expert on relevant
>> subjects.
>
>	Why not?  Read *every* line of code and the spaces in between two or
>three times.

Surely. A certain percentage of people will. A certain percentage of
people lack the expertise to do so. That was my primary point.

My secondary point is that even those who *do* may not detect the presence
of a backdoor. The decade-and-a-half controversy over whether DES has
a backdoor, despite the fact that the alogorithm is public, is an example
of this. The eventual answer to the question is less important than the
period of debate...think about it.

Reading source code is never a guarantee; it is only a *statistically* safe
measure. Worse yet, the statistical issues tend to be hard to analyze,
and in no case does one attain a 100% confidence.

This is a limited response to a limited question; I'm aware that there
are a million other issues as well.
	Doug