In the audit coding process, some theme names and definitions were revised.
Audit coding, to ensure accuracy and consistency, was performed by the first author (author 1), an experienced qualitative researcher.
Some recommended competencies include, but are not limited to, technical audits, code base reviews, vulnerability assessments, architectural risk analysis, secure development lifecycle process reviews, etc. Taking a multi-stakeholder approach, we welcome input and recommendations from interested parties at [email protected]".com
The project has a policy of continually auditing code for problems, work that developer Marc Espie has described as "never finished... more a question of process than of a specific bug being hunted".
And this sort of mutual trust, with its give-and-take and allowance for common error, cannot be supplanted by the ever more expensive techniques of arms-length supervision: audits, codes and performance league-tables.
However, a concrete and planned mechanism for auditing coding is missing at the national level.
Of course security researchers will want to audit the code.
Everything is open source so security experts can audit the code themselves.
They would trust the REPL to audit my code and use the time to address more general points.
Stealthy plans to open source their protocol and mobile product so that anybody can audit their code.
Andrew Lewman, executive director of the TOR project, told me "Free and open source software at least gives someone the ability to review, improve, and audit the code on which the app is based".
