4 ms·

Serious question, would source code be useful to a government agency? Is there enough knowledge and expertise that exists outside of the organization that build

by bko 11y ago

Serious question, would source code be useful to a government agency? Is there enough knowledge and expertise that exists outside of the organization that builds the software to be able to make much use of software as complex as iOS?

anon987 11y ago
In Windows NT 4.0 in 1999 they found this when Microsoft accidentally released the debug symbols: https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY Who you believe is up to you.
- tptacek 11y ago
  This is one of the oldest conspiracy theories on the Internet. It has been comprehensively and repeatedly debunked. It doesn't even make sense as a backdoor, given its function. Here's the best link on HN about it: https://news.ycombinator.com/item?id=9297787 https://news.ycombinator.com/item?id=9297787 You also didn't need the source code to find it; you could have found it with "strings".
- bduerst 11y ago
  That was just a naming convention. When asked why it was called NSAKEY, Microsoft said this: >This is simply an unfortunate name. The NSA performs the technical review for all US cryptographic export requests. The keys in question are the ones that allow us to ensure compliance with the NSA's technical review. Therefore, they came to be known within Microsoft as "the NSA keys", and this was used as a variable name for one of the keys. However, Microsoft holds these keys and does not share them with anyone, including the NSA.
- Razengan 11y ago
  > https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY Wow.. How come nobody is bringing THIS up whenever the FBI tries to assure us that the bypass they want from Apple will never get leaked into the wrong hands?
narrowingorbits 11y ago
The demand for source code would likely include accompanying documentation necessary to build/use.
- oneweekwonder 11y ago
  Documentation and getting to build/use it feels to me like support, and I feel that needs to be billable. The source code is the raw product, which is also of value/crown jewels. But it is easier to give it to someone, then to support it. So can the government force companies to assist them and to what extent? From the article it is suggested that Dell, Huawei, and Juniper have already done so. But how where they compensated, because engineering time is not cheap, or where they given software backdoors and told to integrate them. I don't think we will ever know. But would be interesting to know how managers had to explain to the bean counters, that limited resources was spent on project "top secret" instead of a real project making money.
  - woodman 11y ago
    > ...and I feel that needs to be billable. They get paid. Telecoms do as well, they actually have billing schedules for wiretaps. > ...managers had to explain to the bean counters... You've got it backwards, the lawyers explain to the executives who then explain to the department head who then explains to a manager who then explains to a senior team leader who then assigns the work. At the end of the telephone game it looks like any other incomprehensible contract requirement.
- azurezyq 11y ago
  It's hard and really expensive, I don't think any big company would like to do that. For large shops, source code building is non-trivial. It may require proprietary toolchains, metadata stored in some other dbs, or specific hardware / environments. And the toolchain may even not work outside the shop, e.g., depending on internal infras.
mtgx 11y ago
Well first they ask for iOS source code, then they ask for the update or app signing key (kind of how they asked for Lavabit's SSL key). Then the real fun begins. However, it's a little funny that the US gov uses the Lavabit case as an example - Lavabit shut down to avoid giving it the key.
- chopin 11y ago
  Afair Lavabit handed over the private key. It was shut down subsequently to avoid user compromise.
jlgaddis 11y ago
The NSA can apparently find vulnerabilities in iOS without the source code so I would assume they could find (more of) them more easily with the source code.

by bko 11y ago

anon987 11y ago

In Windows NT 4.0 in 1999 they found this when Microsoft accidentally released the debug symbols: https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY Who you believe is up to you.

tptacek 11y ago
This is one of the oldest conspiracy theories on the Internet. It has been comprehensively and repeatedly debunked. It doesn't even make sense as a backdoor, given its function. Here's the best link on HN about it: https://news.ycombinator.com/item?id=9297787 https://news.ycombinator.com/item?id=9297787 You also didn't need the source code to find it; you could have found it with "strings".
bduerst 11y ago
That was just a naming convention. When asked why it was called NSAKEY, Microsoft said this: >This is simply an unfortunate name. The NSA performs the technical review for all US cryptographic export requests. The keys in question are the ones that allow us to ensure compliance with the NSA's technical review. Therefore, they came to be known within Microsoft as "the NSA keys", and this was used as a variable name for one of the keys. However, Microsoft holds these keys and does not share them with anyone, including the NSA.
Razengan 11y ago
> https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY Wow.. How come nobody is bringing THIS up whenever the FBI tries to assure us that the bypass they want from Apple will never get leaked into the wrong hands?

narrowingorbits 11y ago

The demand for source code would likely include accompanying documentation necessary to build/use.

oneweekwonder 11y ago
Documentation and getting to build/use it feels to me like support, and I feel that needs to be billable. The source code is the raw product, which is also of value/crown jewels. But it is easier to give it to someone, then to support it. So can the government force companies to assist them and to what extent? From the article it is suggested that Dell, Huawei, and Juniper have already done so. But how where they compensated, because engineering time is not cheap, or where they given software backdoors and told to integrate them. I don't think we will ever know. But would be interesting to know how managers had to explain to the bean counters, that limited resources was spent on project "top secret" instead of a real project making money.
- woodman 11y ago
  > ...and I feel that needs to be billable. They get paid. Telecoms do as well, they actually have billing schedules for wiretaps. > ...managers had to explain to the bean counters... You've got it backwards, the lawyers explain to the executives who then explain to the department head who then explains to a manager who then explains to a senior team leader who then assigns the work. At the end of the telephone game it looks like any other incomprehensible contract requirement.
azurezyq 11y ago
It's hard and really expensive, I don't think any big company would like to do that. For large shops, source code building is non-trivial. It may require proprietary toolchains, metadata stored in some other dbs, or specific hardware / environments. And the toolchain may even not work outside the shop, e.g., depending on internal infras.

mtgx 11y ago

Well first they ask for iOS source code, then they ask for the update or app signing key (kind of how they asked for Lavabit's SSL key). Then the real fun begins. However, it's a little funny that the US gov uses the Lavabit case as an example - Lavabit shut down to avoid giving it the key.

chopin 11y ago
Afair Lavabit handed over the private key. It was shut down subsequently to avoid user compromise.

jlgaddis 11y ago

The NSA can apparently find vulnerabilities in iOS without the source code so I would assume they could find (more of) them more easily with the source code.