4 ms·

The NSA would have a cache of remote code exec exploits in PFSense if they actually cared about exploiting. But they don't.

by wepple 10y ago

ryao 10y ago
PFSense is much easier to audit than the closed source stuff that the disclosed zero days targeted. Anything that they find in it is far more likely to be found by others and patched. It is a fundamental improvement that you only can get with OSS. That being said, organizations doing what the NSA does will always exist. Making decisions based on that premise that will lead to a much better result than blaming them for flaws in the things people use ever will.
- wepple 10y ago
  I definitely agree with your premise, that OSS can more easily be reviewed. In reality, do you think/know that happens? (I'm genuinely intrigued). I know almost all major software shops generally have some kind of formalized process for internal and external security review; and often have automated tooling to also support that process. I'm not saying it's perfect, but it's there, and catches a lot of bugs. Running with PFSense as our example, do they have regular codebase-wide and change-specific code reviews and security assessments? I'd be delighted to know they do, but haven't seen much about it.
  - ryao 10y ago
    There are tools being such as coverity run on it: https://www.google.com/#q=coverity+pfsense https://www.google.com/#q=coverity+pfsense https://www.google.com/#q=coverity+freebsd https://www.google.com/#q=coverity+freebsd That is a rather good tool provided to open source projects for free that finds bugs, including exploitable bugs. FreeBSD and pfSense by extension has the benefit of Clang's various tools for catching issues (e.g. its static analysis, address sanitizer, etcetera). I also know that there was a TrustedBSD hardening effort. You probably would want to ask the pfSense and FreeBSD guys for details. There are better people than me to ask, but given that it is open source the people doing things are under no obligation to talk about it, it is hard for anyone to know everything being done. Anyway, my point is that these sorts of things only happen with OSS. If a search researcher has an idea for a new way of catching bugs, he is likely going to use it on OSS code rather than closed source software by virtue of it being easier to do experiments on it. The same goes for non-profits devoting money to auditing code (which the Linux Foundation announced last year). You definitely will not see that happen with proprietary software. This gives OSS an intrinsic advantage.
    - wepple 10y ago
      >given that it is open source the people doing things are under no obligation to talk about it, it is hard for anyone to know everything being done. Actually, by nature of being Open source there's 100% increased likeliness they'll talk about it - they simply can. It's the thousands of security consultants working under NDA doing code review for software companies that legally cannot talk about it, even if they did want to. > Anyway, my point is that these sorts of things only happen with OSS. That's not correct. Software companies have much bigger budgets for security tooling than open source projects. They've got access to clang and coverity as well as a host of other tools that cost hundreds of thousands of dollars. > The same goes for non-profits devoting money to auditing code (which the Linux Foundation announced last year). You definitely will not see that happen with proprietary software. This gives OSS an intrinsic advantage. This is really awesome, I'm loving seeing this happen. But For every 1x security review of say truecrypt, you do realize that Microsoft and Apple would've had those exact same experts audit their own implementations several times a year, right?
      - ryao 10y ago
        Are those the same experts that missed gotofail? Static analysis should have caught that. Just because they can does not mean that they do. Having many developers sharing code means that they all have an incentive to do auditing. By the way, there are definitely people who do things with OSS code and never tell others. I cannot know what everyone is doing. I am neither God nor the NSA.

The NSA would have a cache of remote code exec exploits in PFSense if they actually cared about exploiting. But they don't.

by wepple 10y ago

The NSA would have a cache of remote code exec exploits in PFSense if they actually cared about exploiting. But they don't.

ryao 10y ago

PFSense is much easier to audit than the closed source stuff that the disclosed zero days targeted. Anything that they find in it is far more likely to be found by others and patched. It is a fundamental improvement that you only can get with OSS. That being said, organizations doing what the NSA does will always exist. Making decisions based on that premise that will lead to a much better result than blaming them for flaws in the things people use ever will.

wepple 10y ago
I definitely agree with your premise, that OSS can more easily be reviewed. In reality, do you think/know that happens? (I'm genuinely intrigued). I know almost all major software shops generally have some kind of formalized process for internal and external security review; and often have automated tooling to also support that process. I'm not saying it's perfect, but it's there, and catches a lot of bugs. Running with PFSense as our example, do they have regular codebase-wide and change-specific code reviews and security assessments? I'd be delighted to know they do, but haven't seen much about it.
- ryao 10y ago
  There are tools being such as coverity run on it: https://www.google.com/#q=coverity+pfsense https://www.google.com/#q=coverity+pfsense https://www.google.com/#q=coverity+freebsd https://www.google.com/#q=coverity+freebsd That is a rather good tool provided to open source projects for free that finds bugs, including exploitable bugs. FreeBSD and pfSense by extension has the benefit of Clang's various tools for catching issues (e.g. its static analysis, address sanitizer, etcetera). I also know that there was a TrustedBSD hardening effort. You probably would want to ask the pfSense and FreeBSD guys for details. There are better people than me to ask, but given that it is open source the people doing things are under no obligation to talk about it, it is hard for anyone to know everything being done. Anyway, my point is that these sorts of things only happen with OSS. If a search researcher has an idea for a new way of catching bugs, he is likely going to use it on OSS code rather than closed source software by virtue of it being easier to do experiments on it. The same goes for non-profits devoting money to auditing code (which the Linux Foundation announced last year). You definitely will not see that happen with proprietary software. This gives OSS an intrinsic advantage.
  - wepple 10y ago
    >given that it is open source the people doing things are under no obligation to talk about it, it is hard for anyone to know everything being done. Actually, by nature of being Open source there's 100% increased likeliness they'll talk about it - they simply can. It's the thousands of security consultants working under NDA doing code review for software companies that legally cannot talk about it, even if they did want to. > Anyway, my point is that these sorts of things only happen with OSS. That's not correct. Software companies have much bigger budgets for security tooling than open source projects. They've got access to clang and coverity as well as a host of other tools that cost hundreds of thousands of dollars. > The same goes for non-profits devoting money to auditing code (which the Linux Foundation announced last year). You definitely will not see that happen with proprietary software. This gives OSS an intrinsic advantage. This is really awesome, I'm loving seeing this happen. But For every 1x security review of say truecrypt, you do realize that Microsoft and Apple would've had those exact same experts audit their own implementations several times a year, right?
    - ryao 10y ago
      Are those the same experts that missed gotofail? Static analysis should have caught that. Just because they can does not mean that they do. Having many developers sharing code means that they all have an incentive to do auditing. By the way, there are definitely people who do things with OSS code and never tell others. I cannot know what everyone is doing. I am neither God nor the NSA.