4 ms·

The open-source approach is our own chance to purge corruption in the technology layer. We may not yet have implemented the idea perfectly, but keep in mind the

The open-source approach is our own chance to purge corruption in the technology layer. We may not yet have implemented the idea perfectly, but keep in mind the following: With every new player (government, company, user) joining the open-source approach, we get additional eyes on the code/hardware. Imagine all world governments using only open-source code/hardware: Given the current budgets at play, we would have 100% secure code/hardware in a matter of seconds - for everybody on the Planet. Why is this not happening? Because governments (currently) still do not fully represent the citizens' interests. They mainly represent their interests first (which is the protection and expansion of their power monopoly). This is called the principal-agent problem.

nfoz 9y ago
Let's suppose that hardware is open-source. How do I know that my instance of the hardware is faithful to the spec? That my vendor didn't modify the hardware? Let's suppose that I have a 3D printer sophisticated enough to print open-source circuitboards. How do I trust my 3d printer? I think there's a hardware "trusting trust" problem; I can't imagine how your optimism could ever be realized. I hope I'm missing something!
- SXX 9y ago
  There will always be trust related issues, but that doesnt mean we shouldnt improve overall situation. Currently its possible there are all kind of backdoors in: hardware itself, firmware, drivers, some of closed source software. If we would limit it only to hardware itself that would be huge win.
- hdhzy 9y ago
  I think the parent doesn't mean that open source will cure all problems but that it will move the bar higher for malicious players. If the designs were published and it'd be possible for anyone to review and build such a thing then it's exponentially harder to hide something.
- simias 9y ago
  You're not missing anything, it's just that with each added "hop" it becomes harder to implement a backdoor and have it undetected. Your futuristic 3D printer could be backdoored to recognize certain patterns and modify them sneakily but that would be pretty sophisticated and somebody validating thoroughly the output could detect the unexpected divergence. Designing a generic backdoor that would work on any CPU design without being obvious sounds very tricky indeed. It would also be very difficult to hide the code generating the backdoor if the software of the printer is open source itself. Then you'd have to insert inconspicuous code in the printer's driver which would have the very complex task of messing with the model to insert a backdoor in an arbitrary user-controlled design.
StreamBright 9y ago
I am not sure if you understand the complexity of validating crypto or finding backdoors in software. It is possible to find bugs in closed source software and as the link I provided proves it is possible to "hide" backdoors in open source software. 100% secure? You must be joking. Since there is no code without bugs and certain percentage of bugs have security implications there is no 100% secure.

nfoz 9y ago

Let's suppose that hardware is open-source. How do I know that my instance of the hardware is faithful to the spec? That my vendor didn't modify the hardware? Let's suppose that I have a 3D printer sophisticated enough to print open-source circuitboards. How do I trust my 3d printer? I think there's a hardware "trusting trust" problem; I can't imagine how your optimism could ever be realized. I hope I'm missing something!

SXX 9y ago
There will always be trust related issues, but that doesnt mean we shouldnt improve overall situation. Currently its possible there are all kind of backdoors in: hardware itself, firmware, drivers, some of closed source software. If we would limit it only to hardware itself that would be huge win.
hdhzy 9y ago
I think the parent doesn't mean that open source will cure all problems but that it will move the bar higher for malicious players. If the designs were published and it'd be possible for anyone to review and build such a thing then it's exponentially harder to hide something.
simias 9y ago
You're not missing anything, it's just that with each added "hop" it becomes harder to implement a backdoor and have it undetected. Your futuristic 3D printer could be backdoored to recognize certain patterns and modify them sneakily but that would be pretty sophisticated and somebody validating thoroughly the output could detect the unexpected divergence. Designing a generic backdoor that would work on any CPU design without being obvious sounds very tricky indeed. It would also be very difficult to hide the code generating the backdoor if the software of the printer is open source itself. Then you'd have to insert inconspicuous code in the printer's driver which would have the very complex task of messing with the model to insert a backdoor in an arbitrary user-controlled design.

StreamBright 9y ago

I am not sure if you understand the complexity of validating crypto or finding backdoors in software. It is possible to find bugs in closed source software and as the link I provided proves it is possible to "hide" backdoors in open source software. 100% secure? You must be joking. Since there is no code without bugs and certain percentage of bugs have security implications there is no 100% secure.