Dear Seth Alan Woolley, --Saturday, May 8, 2004, 2:14:49 AM, you wrote to [EMAIL PROTECTED]:
SAW> Anybody using a CVS build of KDE is taking an inherent risk for such SAW> things as this. Anybody using an official release would of course have SAW> a plethora of people reviewing each commit. It only took them 1.5 hours SAW> according to the Russian article to spot the code comments. I'd say the SAW> KDE team passed with flying colors. It's always possible to insert "backdoor" into code in a way it will probably never be caught during audit, if code is rather large and is not perfectly styled. It may be a call to wrong function in a case of some race conditions or another "unexpected" situation - things almost impossible to catch for a person who didn't wrote this code from beginning. It's true for both open source and commercial software, but commercial developers at least have signed contracts. Any exploitable bug found in software could actually be a backdoor. It's a question of trust. -- ~/ZARAZA ЭНИАКам - по морде! (Лем) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
