New answers tagged

0

As others have mentioned, actually verifying that code has no malicious behavior is neigh impossible. There are a handful of special cases, where code was written to be verifiable, such as the seL4 kernel, but the general case is easily demonstrated as unsolvable. In practical situations there are steps you can take to decrease the likelihood of an issue: ...


1

Yes, if one blindly downloads and compiles source code, that code could contain an exploit that, if run, could harm one's system. What's more, the resulting binary may not need to be explicitly run. In his 1984 classic Reflections On Trusting Trust, Ken Thompson demonstrated how one might go about creating C code that, when compiled, exploited the compiler ...


4

Short of reading and understanding every line of code and how it all fits together you realistically can't. The best you can really do it to download it as a package from a reputable source who vet the packages in advance, to minimise the risk to the user. However there are times when even full blown operating systems are are hacked (such as Mint Linux ...


0

I think what you are asking for is "static analysis" (as opposed to "dynamic analysis" which analyzes running code). The web security group OWASP has a page talking about static source code security analysis in broad terms. If you simply google for "static source code security analysis" you will find many product available (some payware, some free). The ...



Top 50 recent answers are included