5 ms·

So developer discusses with his boss. Developer A adds back door. Developer B then patches back door. Boss fires developer A. Developer A then uses this TAR cra

So developer discusses with his boss. Developer A adds back door. Developer B then patches back door. Boss fires developer A. Developer A then uses this TAR crap to sue government for forcing him to do something and lose his job. I can’t see the government being able to defend itself. We elect the government to serve the people and the decisions of the government are negatively impacting the people no matter which way you spin it. My 2cents.

deleted 8y ago
[deleted]
ENGNR 8y ago
'developer discusses with his boss' => that's 5 years prison right there, not joking It's 5 for not doing it and 5 for telling anyone, 10 for both
- maldeh 8y ago
  Assuming it could be proven, surely? And there have to be limitations as to how far an individual could go as to subterfuge, so if your company enforces a 2-person code review and there aren't other authorized Australian nationals at hand, you could point at process preventing you from doing so without others' knowledge (how naive this defense is, I have no idea)
  - int_19h 8y ago
    You opt into participating that process by accepting the job, though. So from Australia's perspective, the way to comply with their law is to not take such jobs, and to leave if the process changes prevent you from complying.
    - viraptor 8y ago
      I think you're inventing scenarios here that are too unlikely even for a pretty corrupt country. There probably exist laws in a number of countries which would technically jail you for taking some not-explicitly-illegal job. But this is absurd. Unless you're an actual lawyer giving opinion here?
      - Nasrudith 8y ago
        I think if you trust people to not be corrupt you will wind up with corruption. A bad law is one that requires the empowered to not abuse it. A good law can't be abused. Harsh and cynical but true - reducto ad absurdum giving someone the legal power to murder anyone and relying on it to "not be abused" is a law literally bad enough to be causus beli for a civil war.
    - bryanrasmussen 8y ago
      Unless you're an Australian lawyer I'm going to think this interpretation is a little far out by most Western legal traditions.
      - int_19h 8y ago
        Can you explain why? It seems like a straightforward application of the law making some activity illegal, when its jurisdiction is explicitly defined as extending beyond the nation's borders. If you forget the border for a moment and just consider it all a single jurisdiction, aren't you basically saying that somebody can break the law and claim immunity from prosecution on the basis that their job requirements demanded that law to be broken?
        bryanrasmussen 8y ago
        What I expect would happen is as follows: 1. you take job at place with code review. 2. Australian police say place a backdoor. 3. You say we have code review the backdoor will be caught. Now at this point the following might happen. 4a. make sure your code is reviewed by X. 4b. ok I guess it won't work. 4c. here is the code to put in, it has a very hard to catch bug that we can exploit. in no way would I expect them to say 4d. well we're going to take you to court because you took a job that makes entering backdoors difficult. on edit: improved formatting on 2nd edit: I removed the leading No but, because I can't remember why I started off with that.
        _Nat_ 8y ago
        Is there a protection that prevents the government from requiring an employee take an action that may be discovered? Or even a reason? I mean, unless the backdoor has a hard-coded URL like `www.ThisIsAGovernmentBackdoor.gov.au`, then a backdoor wouldn't seem to automatically implicate the government. Then an employer might well assume that the employee is just doing their own hacking. And presumably the employee can't say otherwise, right? Or does the law say that employees can refuse if they fear discovery? And if so, couldn't employees always just refuse on that basis?
  - adrianN 8y ago
    The obfuscated C coding contest shows that you probably won't catch backdoors with code reviews
    - mcv 8y ago
      Obfuscated code shouldn't pass code review.
      - GorgeRonde 8y ago
        Maybe the poster above was referring to the Underhanded C Contest > The Underhanded C Contest is an annual contest to write innocent-looking C code implementing malicious behavior. In this contest you must write C code that is as readable, clear, innocent and straightforward as possible, and yet it must fail to perform at its apparent function. To be more specific, it should perform some specific underhanded task that will not be detected by examining the source code. Source: http://www.underhanded-c.org/_page_id_2.html http://www.underhanded-c.org/_page_id_2.html
        Klathmon 8y ago
        I highly encourage everyone to go look at the hall of fame, it was extremely eye opening when I first did! Even knowing there is an exploit in the code, I probably would never be able to find most of them. My favorite is 2008's winner who's goal is to write a redaction program to redact text. It doesn't use any buffer/array hacks, the code is very straightforward and simple and small, and it would work in languages other than C. It's a terrifying example of how easy it is to write malicious code that would pass multiple code reviews but still has a backdoor! http://www.underhanded-c.org/_page_id_17.html http://www.underhanded-c.org/_page_id_17.html
    - LifeLiverTransp 8y ago
      I bet Zero day backdoors are the retirement plan of half the security relevant coders here.
deleted 8y ago
[deleted]
mises 8y ago
> We elect the government to serve the people Quit making me laugh, buddy. Unfortunately, I think we all know that once they get their office, they do very little to serve the people. Not sure about the case with Australia, but you can't sue the American government unless it lets you. Otherwise, it just claims sovereign immunity. Wrong as that is, it's a very good defense as it keeps them out of court. This might lead the employee to sue the employer ("I was complying with a lawful government order; you can't fire me for that!"), making Australians even more of a liability.
- philpem 8y ago
  That could lead to some interesting court cases. Employee gets fired for introducing a backdoor, but "may or may not have been" subject to one of these assistance notes (the Government won't comment either way, the employee insists they had a Technical Assistance Note). Employee sues the employer for wrongful dismissal because of the alleged unprovable TAN. I wonder which way that court case would go... sounds like a recipe for deadlock.
  - mises 8y ago
    Another possible concern is that the employee sues for wrongful termination, alleging they were "just following the law" (which they would have been). The employee shouldn't lose his job for following the law, the company shouldn't have such problems for trying to protect its users, and this whole mess was caused by government intervention. But yes, it will be interesting to see how the courts rule. Not familiar with Australian law, so if anybody has thoughts about this, please feel free to enlighten me.
  - JoshTriplett 8y ago
    Even better: employee gets criminally prosecuted in a (slightly) more sensible jurisdiction for having intentionally introduced the backdoor.
AdmiralAsshat 8y ago
Considering the number of times I've seen a developer quickly patch something and deploy their private build to the customer (not maliciously, but because the customer is screaming and needs it right now and wouldn't wait for normal QA process), I don't think it would be terribly difficult for the compromised developer to create a malicious binary outside of the committed codebase.

deleted 8y ago

[deleted]

ENGNR 8y ago

'developer discusses with his boss' => that's 5 years prison right there, not joking It's 5 for not doing it and 5 for telling anyone, 10 for both

maldeh 8y ago
Assuming it could be proven, surely? And there have to be limitations as to how far an individual could go as to subterfuge, so if your company enforces a 2-person code review and there aren't other authorized Australian nationals at hand, you could point at process preventing you from doing so without others' knowledge (how naive this defense is, I have no idea)
- int_19h 8y ago
  You opt into participating that process by accepting the job, though. So from Australia's perspective, the way to comply with their law is to not take such jobs, and to leave if the process changes prevent you from complying.
  - viraptor 8y ago
    I think you're inventing scenarios here that are too unlikely even for a pretty corrupt country. There probably exist laws in a number of countries which would technically jail you for taking some not-explicitly-illegal job. But this is absurd. Unless you're an actual lawyer giving opinion here?
    - Nasrudith 8y ago
      I think if you trust people to not be corrupt you will wind up with corruption. A bad law is one that requires the empowered to not abuse it. A good law can't be abused. Harsh and cynical but true - reducto ad absurdum giving someone the legal power to murder anyone and relying on it to "not be abused" is a law literally bad enough to be causus beli for a civil war.
  - bryanrasmussen 8y ago
    Unless you're an Australian lawyer I'm going to think this interpretation is a little far out by most Western legal traditions.
    - int_19h 8y ago
      Can you explain why? It seems like a straightforward application of the law making some activity illegal, when its jurisdiction is explicitly defined as extending beyond the nation's borders. If you forget the border for a moment and just consider it all a single jurisdiction, aren't you basically saying that somebody can break the law and claim immunity from prosecution on the basis that their job requirements demanded that law to be broken?
      - bryanrasmussen 8y ago
        What I expect would happen is as follows: 1. you take job at place with code review. 2. Australian police say place a backdoor. 3. You say we have code review the backdoor will be caught. Now at this point the following might happen. 4a. make sure your code is reviewed by X. 4b. ok I guess it won't work. 4c. here is the code to put in, it has a very hard to catch bug that we can exploit. in no way would I expect them to say 4d. well we're going to take you to court because you took a job that makes entering backdoors difficult. on edit: improved formatting on 2nd edit: I removed the leading No but, because I can't remember why I started off with that.
        _Nat_ 8y ago
        Is there a protection that prevents the government from requiring an employee take an action that may be discovered? Or even a reason? I mean, unless the backdoor has a hard-coded URL like `www.ThisIsAGovernmentBackdoor.gov.au`, then a backdoor wouldn't seem to automatically implicate the government. Then an employer might well assume that the employee is just doing their own hacking. And presumably the employee can't say otherwise, right? Or does the law say that employees can refuse if they fear discovery? And if so, couldn't employees always just refuse on that basis?
- adrianN 8y ago
  The obfuscated C coding contest shows that you probably won't catch backdoors with code reviews
  - mcv 8y ago
    Obfuscated code shouldn't pass code review.
    - GorgeRonde 8y ago
      Maybe the poster above was referring to the Underhanded C Contest > The Underhanded C Contest is an annual contest to write innocent-looking C code implementing malicious behavior. In this contest you must write C code that is as readable, clear, innocent and straightforward as possible, and yet it must fail to perform at its apparent function. To be more specific, it should perform some specific underhanded task that will not be detected by examining the source code. Source: http://www.underhanded-c.org/_page_id_2.html http://www.underhanded-c.org/_page_id_2.html
      - Klathmon 8y ago
        I highly encourage everyone to go look at the hall of fame, it was extremely eye opening when I first did! Even knowing there is an exploit in the code, I probably would never be able to find most of them. My favorite is 2008's winner who's goal is to write a redaction program to redact text. It doesn't use any buffer/array hacks, the code is very straightforward and simple and small, and it would work in languages other than C. It's a terrifying example of how easy it is to write malicious code that would pass multiple code reviews but still has a backdoor! http://www.underhanded-c.org/_page_id_17.html http://www.underhanded-c.org/_page_id_17.html
  - LifeLiverTransp 8y ago
    I bet Zero day backdoors are the retirement plan of half the security relevant coders here.

deleted 8y ago

[deleted]

mises 8y ago

> We elect the government to serve the people Quit making me laugh, buddy. Unfortunately, I think we all know that once they get their office, they do very little to serve the people. Not sure about the case with Australia, but you can't sue the American government unless it lets you. Otherwise, it just claims sovereign immunity. Wrong as that is, it's a very good defense as it keeps them out of court. This might lead the employee to sue the employer ("I was complying with a lawful government order; you can't fire me for that!"), making Australians even more of a liability.

philpem 8y ago
That could lead to some interesting court cases. Employee gets fired for introducing a backdoor, but "may or may not have been" subject to one of these assistance notes (the Government won't comment either way, the employee insists they had a Technical Assistance Note). Employee sues the employer for wrongful dismissal because of the alleged unprovable TAN. I wonder which way that court case would go... sounds like a recipe for deadlock.
- mises 8y ago
  Another possible concern is that the employee sues for wrongful termination, alleging they were "just following the law" (which they would have been). The employee shouldn't lose his job for following the law, the company shouldn't have such problems for trying to protect its users, and this whole mess was caused by government intervention. But yes, it will be interesting to see how the courts rule. Not familiar with Australian law, so if anybody has thoughts about this, please feel free to enlighten me.
- JoshTriplett 8y ago
  Even better: employee gets criminally prosecuted in a (slightly) more sensible jurisdiction for having intentionally introduced the backdoor.

AdmiralAsshat 8y ago

Considering the number of times I've seen a developer quickly patch something and deploy their private build to the customer (not maliciously, but because the customer is screaming and needs it right now and wouldn't wait for normal QA process), I don't think it would be terribly difficult for the compromised developer to create a malicious binary outside of the committed codebase.