3 ms·

I've consulted for dod contractors and have witnessed such stupidity as buying a half -written ipv6 stack from a vendor rather than taking it from the Linux cod

I've consulted for dod contractors and have witnessed such stupidity as buying a half -written ipv6 stack from a vendor rather than taking it from the Linux codebase because 'a foreigner may have touched that code.' Never mind the fact that the vendor was free to hire foreigners. Or that Linux is already used by dod. Or that the vendor is clueless and charging you out the ass.

tptacek 16y ago
It's no doubt a very clumsily-executed policy that has a net effect of decreasing the quality and increasing the cost of all software DoD buys, but "a foreigner touched it" is not a crazy security control. You wouldn't necessarily know just by looking at the code whether it it fatally compromised security, and the IP stack is among the more security critical components of the system. Please don't take this comment the wrong way. Can DoD meaningfully control for this risk? No. What they're doing is no doubt stupid and unhelpful. But the original notion, that maybe "foreigners" shouldn't be touching the IPv6 stack of something DoD depends on, is valid.
- jrockway 16y ago
  It's probably more likely, though, that bugs are introduced by Good Old Americans that are simply incompetent. If only the government had a policy about not hiring incompetent people...
  - tptacek 16y ago
    Agreed. The US may have the right idea regarding not adopting foreign-tainted code, but they don't have the stones to follow up on the other half of the policy, which is "we're not allowed to run any code whose origin isn't traceable and that hasn't been validated line-by-line and in simulated fault injection by NSA". They want to have it both ways; the might as well just contract the crypto engine out to China.
- deleted 16y ago
  [deleted]
  - tptacek 16y ago
    Again: you're right. I'm sure the policy as implemented is both counterproductive and utterly ineffective. Having said that: just because you can inspect the source code doesn't mean it's safe to run. I don't believe for 1 millisecond that an entire industry of "security-conscious American programmers" would be effective at assuring the Linux IPv6 stack --- not without an actual overt program to arrange for that to happen. The top vulnerability researchers routinely find game-over flaws in open source code long after the code hits the release branch, and often long after the code has been vetted several times over by other vulnerability researchers. If my goal was to mess with the US by backdooring critical infrastructure software, I'd almost certainly not do that by inserting code like "look for secret passphrase at offset X from IPv6 extension header Y". Instead, I'd introduce extremely subtle bugs, perhaps depending object lifecycles and concurrency, and I'd make sure they were planted in changesets that improved code quality overall and/or added valuable capabilities to the code.
    - aswanson 16y ago
      I'd introduce extemely subtle bugs... You sinister bastard. ;) Nuff said, point taken.
    - euroclydon 16y ago
      That has the making of a good novel. Some researcher notices this subtle bug, but rather than blow the whistle overtly, works with the NSA and project gatekeeper to allow the bug through, but with some way to track who might try to take advantage of it. Global tech thriller ensues...

tptacek 16y ago

It's no doubt a very clumsily-executed policy that has a net effect of decreasing the quality and increasing the cost of all software DoD buys, but "a foreigner touched it" is not a crazy security control. You wouldn't necessarily know just by looking at the code whether it it fatally compromised security, and the IP stack is among the more security critical components of the system. Please don't take this comment the wrong way. Can DoD meaningfully control for this risk? No. What they're doing is no doubt stupid and unhelpful. But the original notion, that maybe "foreigners" shouldn't be touching the IPv6 stack of something DoD depends on, is valid.

jrockway 16y ago
It's probably more likely, though, that bugs are introduced by Good Old Americans that are simply incompetent. If only the government had a policy about not hiring incompetent people...
- tptacek 16y ago
  Agreed. The US may have the right idea regarding not adopting foreign-tainted code, but they don't have the stones to follow up on the other half of the policy, which is "we're not allowed to run any code whose origin isn't traceable and that hasn't been validated line-by-line and in simulated fault injection by NSA". They want to have it both ways; the might as well just contract the crypto engine out to China.
deleted 16y ago
[deleted]
- tptacek 16y ago
  Again: you're right. I'm sure the policy as implemented is both counterproductive and utterly ineffective. Having said that: just because you can inspect the source code doesn't mean it's safe to run. I don't believe for 1 millisecond that an entire industry of "security-conscious American programmers" would be effective at assuring the Linux IPv6 stack --- not without an actual overt program to arrange for that to happen. The top vulnerability researchers routinely find game-over flaws in open source code long after the code hits the release branch, and often long after the code has been vetted several times over by other vulnerability researchers. If my goal was to mess with the US by backdooring critical infrastructure software, I'd almost certainly not do that by inserting code like "look for secret passphrase at offset X from IPv6 extension header Y". Instead, I'd introduce extremely subtle bugs, perhaps depending object lifecycles and concurrency, and I'd make sure they were planted in changesets that improved code quality overall and/or added valuable capabilities to the code.
  - aswanson 16y ago
    I'd introduce extemely subtle bugs... You sinister bastard. ;) Nuff said, point taken.
  - euroclydon 16y ago
    That has the making of a good novel. Some researcher notices this subtle bug, but rather than blow the whistle overtly, works with the NSA and project gatekeeper to allow the bug through, but with some way to track who might try to take advantage of it. Global tech thriller ensues...