Do you mind sharing some of your favorite software that passes your tests? Think that could be really helpful to some of the less technical folks around here!
I wouldn't really have a favourite, a lot of programs that don't meet those three no's would be mainstream open software like Chromium... but I can say what certain choices make me choose a program over another.
Take an example: when talking to Windows users, I often recommend the 7zip fork NanaZip over the original. NanaZip enables numerous Windows-specific exploit mitigation features such as Control Flow Guard, disabling dynamic code execution, enabling CET Shadow Stack support and much more. It's also packaged as an MSIX bundle, so registry and application filesystem is sandboxed for it. It stays up to date with 7zip.
Software that fully takes advantage of the security features the operating system is developed for gets bonus points. Android apps using the latest Target APIs and coding in Kotlin, being fully compatible with GrapheneOS security features is a plus on them.
Memory safety is another - I prefer software developed in memory safe languages. I really like Sparrow Wallet and being developed in Java is one of those reasons I like it so much.
Theres a lot of unique ways that different types of software can be reviewed... for example web browsers; You could review state partitioning, content blocking and tracking tests like https://privacytests.org/ or you could review how it performs sandboxing.
How would someone review cryptocurrency wallets? HW device support? Privacy features? Would be way too far to summarise here.
Take an example: when talking to Windows users, I often recommend the 7zip fork NanaZip over the original. NanaZip enables numerous Windows-specific exploit mitigation features such as Control Flow Guard, disabling dynamic code execution, enabling CET Shadow Stack support and much more. It's also packaged as an MSIX bundle, so registry and application filesystem is sandboxed for it. It stays up to date with 7zip.
Software that fully takes advantage of the security features the operating system is developed for gets bonus points. Android apps using the latest Target APIs and coding in Kotlin, being fully compatible with GrapheneOS security features is a plus on them.
Memory safety is another - I prefer software developed in memory safe languages. I really like Sparrow Wallet and being developed in Java is one of those reasons I like it so much.
Theres a lot of unique ways that different types of software can be reviewed... for example web browsers; You could review state partitioning, content blocking and tracking tests like https://privacytests.org/ or you could review how it performs sandboxing.
How would someone review cryptocurrency wallets? HW device support? Privacy features? Would be way too far to summarise here.
❤️2