Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of bendiken.net
	designates 74.125.82.41 as permitted sender)
	client-ip=74.125.82.41; envelope-from=arto@bendiken.net;
	helo=mail-wg0-f41.google.com; 
MIME-Version: 1.0
In-Reply-To: <20131004113517.GA8373@savin>
References: <CANEZrP1Sd8cK2YUr4OSvnOxEJrbWpmfdpor-qbap1f98tGqPwg@mail.gmail.com>
	<3552695.aET6a1zFq8@momentum> <20131004113517.GA8373@savin>
From: Arto Bendiken <arto@bendiken.net>
Date: Fri, 4 Oct 2013 13:58:51 +0200
Message-ID: <CAE7aNuS00t97g8K-sPJv4Xt+zWbWbDEjfkza8oBq4c5RjfRP1Q@mail.gmail.com>
To: Peter Todd <pete@petertodd.org>
Content-Type: text/plain; charset=UTF-8
Cc: bitcoin-development@lists.sourceforge.net
Subject: Re: [Bitcoin-development] Code review
Precedence: list

On Fri, Oct 4, 2013 at 1:35 PM, Peter Todd <pete@petertodd.org> wrote:
> The second caveat is more specific to Bitcoin: people tend to rebase
> their pull-requests over and over again until they are accepted, but
> that also means that code review done earlier doesn't apply to the later
> code pushed. Bitcoin is a particularly high profile, and high profit,
> target for people trying to get malicious code into the codebase.

On that note, this 2003 example of an attempt to backdoor the Linux
kernel is pertinent:

http://lwn.net/Articles/57135/

The backdoor in question came down to a single missing character,
easily overlooked by a reviewer if a spotlight hadn't been thrown on
it for other reasons. Compromising a Bitcoin implementation isn't
going to be as easy as that, one would hope, but certainly it seems
only a matter of time until there's an attempt at it.

Following these code review discussions with much interest.

-- 
Arto Bendiken | @bendiken | http://ar.to/