3 ms·
NSA releasing an open-source tool? My first thought is, better subject it to serious, in-depth security review before installing it locally. Even then, build it
by TimTheTinker 8y ago
NSA releasing an open-source tool? My first thought is, better subject it to serious, in-depth security review before installing it locally. Even then, build it from source.
- mahmoudimus 8y agoApache NiFi was also released by the NSA & has seen commercial success in the enterprise.
- snazz 8y agoNot to mention SELinux, which was partly developed by the NSA. Red Hat is much more involved in that, though.
- TimTheTinker 8y agoRight, but it’s probably been reviewed and we’re not using NSA binaries.
- rplst8 8y agoAnd Accumulo.
- hermitdev 8y agoWans't Tor initially developed by NSA/CIA as well?
- grzm 8y ago> "The core principle of Tor, "onion routing", was developed in the mid-1990s by United States Naval Research Laboratory employees, mathematician Paul Syverson, and computer scientists Michael G. Reed and David Goldschlag, with the purpose of protecting U.S. intelligence communications online. Onion routing was further developed by DARPA in 1997." https://en.wikipedia.org/wiki/Tor_(anonymity_network)#History https://en.wikipedia.org/wiki/Tor_(anonymity_network)#Histor...
- appleflaxen 8y agoIt would also make me want to consider Ken Thompson's compiler trojan, and whether there is any similar vulnerability that could be inserted into an RE tool. http://wiki.c2.com/?TheKenThompsonHack http://wiki.c2.com/?TheKenThompsonHack
- TimTheTinker 8y agoDo RE tools commonly output binaries? Note that unless your compiler is already bugged (or you’re using a bugged binary), community review of the source should turn out any possible issues... unless there’s a significant competence gap between the NSA and the security community — which may be possible, but I don’t think security professionals are worried about it.
- saagarjha 8y agoSure, many can patch binaries.