4 ms·

Yeah, my mouse was hovering over the download button eager to test it out when my brain suddenly went "wait, don't do that!" If you wanna run this thing, you s

by OskarS 8y ago

Yeah, my mouse was hovering over the download button eager to test it out when my brain suddenly went "wait, don't do that!" If you wanna run this thing, you should probably build it from source yourself (don't trust the binaries) and even then run it in a pretty well sandboxed virtual machine. I would not be surprised at all if the NSA left some surprises in that thing.

pbhjpbhj 8y ago
Maybe it's all just an elaborate recruitment ad. :)
Goz3rr 8y ago
I hope you don't use Linux, because the NSA contributes to quite a lot of OSS. They also created SELinux for instance.
- mattigames 8y ago
  Those changes on OSS are reviewed by a lot of people, this here is just released and reviewed by themselves only.
  - AnIdiotOnTheNet 8y ago
    Sure, the ones officially contributed by the NSA. What you have to wonder is how much code was contributed by some seemingly normal community member that is actually a front for the NSA to introduce subtly flawed code that they can use to their advantage while being plausibly just a bug? There are those who suspect Heartbleed came about this way.
- AsyncAwait 8y ago
  - SELinux has been free-software for over a decade, with many open-source contributions. - Many people don't use SELinux, especially on distros like Arch, Gentoo etc. where it (luckily) doesn't come as part of the package, SELinux is far from universal.
dingaling 8y ago
If you're decompiling and analysing ANYTHING, you should be running it on a reflashable, airgapped machine in case it does something unexpected, even if it isn't intentionally malicious. Plus you probably don't want it phoning-home either...
doktrin 8y ago
> I would not be surprised at all if the NSA left some surprises in that thing. Huh. I would be extremely surprised if the NSA were to include some kind of malicious or pseudo-malicious easter egg in the open source RE toolkit they're releasing. How dumb would they have to be to pull a move like that, and for what? The self interest just doesn't line up.

by OskarS 8y ago

pbhjpbhj 8y ago

Maybe it's all just an elaborate recruitment ad. :)

Goz3rr 8y ago

I hope you don't use Linux, because the NSA contributes to quite a lot of OSS. They also created SELinux for instance.

mattigames 8y ago
Those changes on OSS are reviewed by a lot of people, this here is just released and reviewed by themselves only.
- AnIdiotOnTheNet 8y ago
  Sure, the ones officially contributed by the NSA. What you have to wonder is how much code was contributed by some seemingly normal community member that is actually a front for the NSA to introduce subtly flawed code that they can use to their advantage while being plausibly just a bug? There are those who suspect Heartbleed came about this way.
AsyncAwait 8y ago
- SELinux has been free-software for over a decade, with many open-source contributions. - Many people don't use SELinux, especially on distros like Arch, Gentoo etc. where it (luckily) doesn't come as part of the package, SELinux is far from universal.

dingaling 8y ago

If you're decompiling and analysing ANYTHING, you should be running it on a reflashable, airgapped machine in case it does something unexpected, even if it isn't intentionally malicious. Plus you probably don't want it phoning-home either...

doktrin 8y ago

> I would not be surprised at all if the NSA left some surprises in that thing. Huh. I would be extremely surprised if the NSA were to include some kind of malicious or pseudo-malicious easter egg in the open source RE toolkit they're releasing. How dumb would they have to be to pull a move like that, and for what? The self interest just doesn't line up.