4 ms·

Just because something is "developed" in the US doesn't mean that all of the developers are US citizens or even based in the US. Outsourcing makes it incredibl

Just because something is "developed" in the US doesn't mean that all of the developers are US citizens or even based in the US. Outsourcing makes it incredibly difficult to ensure that no backdoors, malware, etc. are inserted into source.

cabalamat 17y ago
> Just because something is "developed" in the US doesn't mean that all of the developers are US citizens or even based in the US. Absolutely. > Outsourcing makes it incredibly difficult to ensure that no backdoors, malware, etc. are inserted into source. If a program is (1) open source, and (2) widely used, there are likely to have been lots of eyeballs looking at it. It would probably be harder to put a backdoor in Linux of GCC, without people finding out, than in MS Windows or Microsoft's CLR. I'm leaning towards the point of view that security6 critical software should run on popular open source platforms (by platforms I mean OSes, Languages and APIs).
- MichaelGG 17y ago
  Do we have info on what backdoors in major commercial programs look like? I'm going to guess a large company isn't going to embed a whole large backdoor -- too much liability and risk of discovery. Instead, wouldn't it be better to make the backdoor another mundane security hole? And open soure can certainly ship plenty of those (FireFox?). So, really, in both cases, you need an experienced developer that can code in a security hole without being caught during review. Not every boring feature checked in gets the same level of "eyeballs".
  - gaius 17y ago
    Exactly. No-one's going to call an API openBackdoor(). It'll be something like the vmsplice exploit on Linux (which despite being Open Source yadda yadda made it into a lot of running production systems).
  - xiaoma 17y ago
    This reminded me of Ken Thompson's Turing paper about how a malicious compiler could make back doors invisible even to those who can look at the source. http://docs.google.com/viewer?a=v&q=cache:5Xr5GF-rQkEJ:citeseerx.ist.psu.edu/viewdoc/download%3Fdoi%3D10.1.1.84.8238%26rep%3Drep1%26type%3Dpdf+Ken+Thompson+self-reproducing+program+security&hl=en&pid=bl&srcid=ADGEESjgV0RpZWaqLp_ZUknoiVZCPXfF0UaXTyN8m4qQzTYjVt1SQ01d8bpYpJpXSZTAasGiGop_bwbLr2EiDGXfz4osDyDHjkbCcri79ZbTxtvJt4ZVd3F2EEHM9IX4Xg7G0eiRkR3T&sig=AHIEtbT8wWYDpL3tnqjjSPX7NHGIoqi1Lg http://docs.google.com/viewer?a=v&q=cache:5Xr5GF-rQkEJ:c...

cabalamat 17y ago

> Just because something is "developed" in the US doesn't mean that all of the developers are US citizens or even based in the US. Absolutely. > Outsourcing makes it incredibly difficult to ensure that no backdoors, malware, etc. are inserted into source. If a program is (1) open source, and (2) widely used, there are likely to have been lots of eyeballs looking at it. It would probably be harder to put a backdoor in Linux of GCC, without people finding out, than in MS Windows or Microsoft's CLR. I'm leaning towards the point of view that security6 critical software should run on popular open source platforms (by platforms I mean OSes, Languages and APIs).

MichaelGG 17y ago
Do we have info on what backdoors in major commercial programs look like? I'm going to guess a large company isn't going to embed a whole large backdoor -- too much liability and risk of discovery. Instead, wouldn't it be better to make the backdoor another mundane security hole? And open soure can certainly ship plenty of those (FireFox?). So, really, in both cases, you need an experienced developer that can code in a security hole without being caught during review. Not every boring feature checked in gets the same level of "eyeballs".
- gaius 17y ago
  Exactly. No-one's going to call an API openBackdoor(). It'll be something like the vmsplice exploit on Linux (which despite being Open Source yadda yadda made it into a lot of running production systems).
- xiaoma 17y ago
  This reminded me of Ken Thompson's Turing paper about how a malicious compiler could make back doors invisible even to those who can look at the source. http://docs.google.com/viewer?a=v&q=cache:5Xr5GF-rQkEJ:citeseerx.ist.psu.edu/viewdoc/download%3Fdoi%3D10.1.1.84.8238%26rep%3Drep1%26type%3Dpdf+Ken+Thompson+self-reproducing+program+security&hl=en&pid=bl&srcid=ADGEESjgV0RpZWaqLp_ZUknoiVZCPXfF0UaXTyN8m4qQzTYjVt1SQ01d8bpYpJpXSZTAasGiGop_bwbLr2EiDGXfz4osDyDHjkbCcri79ZbTxtvJt4ZVd3F2EEHM9IX4Xg7G0eiRkR3T&sig=AHIEtbT8wWYDpL3tnqjjSPX7NHGIoqi1Lg http://docs.google.com/viewer?a=v&q=cache:5Xr5GF-rQkEJ:c...