4 ms·

> it doesn't make logistical sense: it requires the NSA to already have installed software on the victim's computer. Well, if you have any of the closed-source

by benevol 10y ago

> it doesn't make logistical sense: it requires the NSA to already have installed software on the victim's computer. Well, if you have any of the closed-source companies' software on your system (and by definition, that is +/- 310mio citizens, in the US alone), you are sure to have NSA backdoors on your system. Such backdoors certainly do not require manual intervention for them to be exploited on large scale.

tptacek 10y ago
Explain?
- jonathankoren 10y ago
  No one outside of the software provider can audited the code, and presumably even they haven't audited the code. Recently there was the source code backdoor that was suspected to had been placed inside Juniper routers by the NSA. If I remember correctly, it wasn't found because it was hidden on a high right column.
  - simonh 10y ago
    The Juniper backdoor was a bit particular in that it was known that the code in question had been developed and distributed by the NSA. It's more of a stretch to accuse every single vendor of proprietary code in the USA of building NSA back doors into their products. It would require the knowing assistance of tens of thousands of people across those companies.
    - jonathankoren 10y ago
      My point was that you don't actually know, and you don't technically need all the vendors. Just the big ones, and there's not really that many. Even more to the point, you don't even need all of the big ones, just the ones on the biggest network, which honestly probably just one vendor on the whole network due to volume purchase discounts and interoperability concerns. But more to the point, you don't know what's going on in closed source code. It's trust. However the trust can, and has been violated in the past (whether by the provider or by a third party is immaterial). You just don't know. Now that doesn't mean that open source software is immune. I seem to remember there was a backdoor found in the Linux kernel a few years ago. These things happen, but at least it's easier to audit.

by benevol 10y ago

tptacek 10y ago

Explain?

jonathankoren 10y ago
No one outside of the software provider can audited the code, and presumably even they haven't audited the code. Recently there was the source code backdoor that was suspected to had been placed inside Juniper routers by the NSA. If I remember correctly, it wasn't found because it was hidden on a high right column.
- simonh 10y ago
  The Juniper backdoor was a bit particular in that it was known that the code in question had been developed and distributed by the NSA. It's more of a stretch to accuse every single vendor of proprietary code in the USA of building NSA back doors into their products. It would require the knowing assistance of tens of thousands of people across those companies.
  - jonathankoren 10y ago
    My point was that you don't actually know, and you don't technically need all the vendors. Just the big ones, and there's not really that many. Even more to the point, you don't even need all of the big ones, just the ones on the biggest network, which honestly probably just one vendor on the whole network due to volume purchase discounts and interoperability concerns. But more to the point, you don't know what's going on in closed source code. It's trust. However the trust can, and has been violated in the past (whether by the provider or by a third party is immaterial). You just don't know. Now that doesn't mean that open source software is immune. I seem to remember there was a backdoor found in the Linux kernel a few years ago. These things happen, but at least it's easier to audit.