4 ms·

A relevant but still more general question: How can we protect ourself against backdoored products that are covertly subsidized by governments? Sure, demanding

by madez 9y ago

A relevant but still more general question: How can we protect ourself against backdoored products that are covertly subsidized by governments? Sure, demanding the sources is a necessary first step. But what happens when the manufaturer blocks and there is not enough competition in the market, see Intel and laptops? This situation has been a problem for years now. What can be done? What regulation or law would help? What should we demand?

gruez 9y ago
open source is only going to protect you from non-intentional backdoors. if the government really wanted a backdoor, there's nothing preventing them from loading a modified version that has a backdoor. short of dumping the firmware from nvram + reproducible builds, you won't be safe.
- madez 9y ago
  So we must also demand that we be able to change the software. For hardware, we could demand that universities get paid to look at samples of hardware to find backdoors, maybe.
- thomastjeffery 9y ago
  That's only part-true. We could use reproducible builds too. Either way, we shouldn't reject the only solution because it has edge cases.
thomastjeffery 9y ago
That is the problem: "we" don't have a solution. That's why we needed to get rid of DMCA Section 1201, and demand access to source code, at the very least, for security research.
- daddosi 9y ago
  I've always argued (not always seriously) that closed source anything should be illegal. The response is often: But how do I exploit? The desire to exploit is apparently as strong as the desire to cry CONSPIRACY THEORIES which in all honesty is just 1984 style crimestop. If gubberment can backdoor your head like that no system is safe :P Lets just make open sourcre the rule and be done with it. You all like open source and you are going to keep it. This is why you agree.
  - confounded 9y ago
    Are you mentioning conspiracy theories because of 1201a?
acdha 9y ago
> A relevant but still more general question: How can we protect ourself against backdoored products that are covertly subsidized by governments? There's a big issue with quality on devices but spreading conspiracy theories only harms that cause. There's no reason to believe this is connected to a government — and it's way below the level of craft we've seen in that regard – and making dubious claims is more likely to cause people to take you and the broader argument less seriously. > This situation has been a problem for years now. What can be done? What regulation or law would help? What should we demand? Two good starting points would be protection for security researchers and the requirement that manufacturers promptly support devices for a reasonable amount of time. Things like this happen because there's very little perceived cost to shipping something shoddy compared with not getting as many features to market as quickly as possible. A followup point, especially for restoring trust that there aren't sophisticated backdoors, would be not just source code but fully reproducible, user-installable builds. This is still fundamentally a losing game if you don't trust the hardware but it'd dramatically increase the odds of someone being able to notice an error, not to mention being a huge win for users’ ability to improve an orphaned device. The reason why that's unlikely to happen is that companies treat source code as a significant asset, which is why I first mentioned a longer support period. My favorite approach for this problem would be regulation requiring mandatory release of source code, the toolchain, signing keys, etc. if the manufacturer stops supporting something, so the places which want to keep their trade secrets can still do so but are required to help their users at the same time.
- saguro 9y ago
  > There's no reason to believe this is connected to a government Why the fuck not? Over the last 5 years, we have time and time again been shown that governments can and do engage in backdooring everything they can get their hands on. I mean, there's hard evidence that they were intercepting packages with cisco gear and making modifications to them. And with that kind of historical record you think there's no reason to believe government could be involved with WD? What?
  - acdha 9y ago
    We've also seen that the governmental attacks are sophisticated because they don't want it to be detected or used by an enemy. The NSA attacks were things like intercepting specific hardware shipments or network links – which reduces the number of people who could possibly notice the problem – or getting people to use a random number generator which only they have the key to reverse[1]. In contrast, this is a textbook example of a sloppy developer who doesn't understand security but is writing network facing code which is never properly audited, and it's consistent with the number of other bugs mentioned. Saying that it might be a government is like saying that because the CIA has killed people every pedestrian hit by a drunk driver is probably an assassination. 1. https://blog.cryptographyengineering.com/2013/12/28/a-few-more-notes-on-nsa-random-number/ https://blog.cryptographyengineering.com/2013/12/28/a-few-mo...
free2rhyme214 9y ago
Rely on decentralized solutions.
chiefalchemist 9y ago
So the government that subsidizes such things is the government that's going to protect us...from it (i.e., our government)? Not to go all tinfoil hat on you, but I think it's fairly obvious what side the gov is on. Hint: It's not the same side we're on.

by madez 9y ago

gruez 9y ago

open source is only going to protect you from non-intentional backdoors. if the government really wanted a backdoor, there's nothing preventing them from loading a modified version that has a backdoor. short of dumping the firmware from nvram + reproducible builds, you won't be safe.

madez 9y ago
So we must also demand that we be able to change the software. For hardware, we could demand that universities get paid to look at samples of hardware to find backdoors, maybe.
thomastjeffery 9y ago
That's only part-true. We could use reproducible builds too. Either way, we shouldn't reject the only solution because it has edge cases.

thomastjeffery 9y ago

That is the problem: "we" don't have a solution. That's why we needed to get rid of DMCA Section 1201, and demand access to source code, at the very least, for security research.

daddosi 9y ago
I've always argued (not always seriously) that closed source anything should be illegal. The response is often: But how do I exploit? The desire to exploit is apparently as strong as the desire to cry CONSPIRACY THEORIES which in all honesty is just 1984 style crimestop. If gubberment can backdoor your head like that no system is safe :P Lets just make open sourcre the rule and be done with it. You all like open source and you are going to keep it. This is why you agree.
- confounded 9y ago
  Are you mentioning conspiracy theories because of 1201a?

acdha 9y ago

> A relevant but still more general question: How can we protect ourself against backdoored products that are covertly subsidized by governments? There's a big issue with quality on devices but spreading conspiracy theories only harms that cause. There's no reason to believe this is connected to a government — and it's way below the level of craft we've seen in that regard – and making dubious claims is more likely to cause people to take you and the broader argument less seriously. > This situation has been a problem for years now. What can be done? What regulation or law would help? What should we demand? Two good starting points would be protection for security researchers and the requirement that manufacturers promptly support devices for a reasonable amount of time. Things like this happen because there's very little perceived cost to shipping something shoddy compared with not getting as many features to market as quickly as possible. A followup point, especially for restoring trust that there aren't sophisticated backdoors, would be not just source code but fully reproducible, user-installable builds. This is still fundamentally a losing game if you don't trust the hardware but it'd dramatically increase the odds of someone being able to notice an error, not to mention being a huge win for users’ ability to improve an orphaned device. The reason why that's unlikely to happen is that companies treat source code as a significant asset, which is why I first mentioned a longer support period. My favorite approach for this problem would be regulation requiring mandatory release of source code, the toolchain, signing keys, etc. if the manufacturer stops supporting something, so the places which want to keep their trade secrets can still do so but are required to help their users at the same time.

saguro 9y ago
> There's no reason to believe this is connected to a government Why the fuck not? Over the last 5 years, we have time and time again been shown that governments can and do engage in backdooring everything they can get their hands on. I mean, there's hard evidence that they were intercepting packages with cisco gear and making modifications to them. And with that kind of historical record you think there's no reason to believe government could be involved with WD? What?
- acdha 9y ago
  We've also seen that the governmental attacks are sophisticated because they don't want it to be detected or used by an enemy. The NSA attacks were things like intercepting specific hardware shipments or network links – which reduces the number of people who could possibly notice the problem – or getting people to use a random number generator which only they have the key to reverse[1]. In contrast, this is a textbook example of a sloppy developer who doesn't understand security but is writing network facing code which is never properly audited, and it's consistent with the number of other bugs mentioned. Saying that it might be a government is like saying that because the CIA has killed people every pedestrian hit by a drunk driver is probably an assassination. 1. https://blog.cryptographyengineering.com/2013/12/28/a-few-more-notes-on-nsa-random-number/ https://blog.cryptographyengineering.com/2013/12/28/a-few-mo...

free2rhyme214 9y ago

Rely on decentralized solutions.

chiefalchemist 9y ago

So the government that subsidizes such things is the government that's going to protect us...from it (i.e., our government)? Not to go all tinfoil hat on you, but I think it's fairly obvious what side the gov is on. Hint: It's not the same side we're on.