6 ms·

Consider that we have openssl and libressl (a fork) for open source ssl libraries (if I'm missing any please correct me). With gag orders and infiltration, is i

by 6AA4FD 6y ago

Consider that we have openssl and libressl (a fork) for open source ssl libraries (if I'm missing any please correct me). With gag orders and infiltration, is it unrealistic to assume that the NSA at least could backdoor both of them? Also consider things like adding bogus/weak crypto to NIST, intel ME and other hardware backdoors. Yes, with enough collective effort there are ways around all of it (option a), but ultimately with that much collective time and money it might be more effective to vote, advocate, and advertise (option b). Furthermore, if you go option a, anyone who poses a threat to whoever holds the reins can still be successfully abducted. (edit: and free speech/safety in political dissent is one of the major prizes everyone has their eyes on here)

zenhack 6y ago
It's not an either/or; we should be doing both.
- 6AA4FD 6y ago
  Agreed.
gcthomas 6y ago
How would the NSA gag-order work on a Canada-based organisation with open source code worked on by devs around the world? (Libressl is developed by OpenBsd)
- Gaelan 6y ago
  Presumably, there's at least one US citizen who is on the LibreSSL "core team." With a gag order, get them to write a subtle backdoor (see [0]), and add it to the codebase however they normally do. The developer is presumably trusted, so their code probably gets minimal code review, at least compared to some unknown person from the NSA trying to add it themselves. Alternatively, the US and Canadian governments are close enough that the NSA could conceivably get Canada to do that instead. [0]: http://underhanded-c.org http://underhanded-c.org
  - gcthomas 6y ago
    Wouldn't that require an NSA operative in that role? I'm probably mistaken, but what powers does the NSA have to force programmers to write code? National Security Letters, the ones that come with gag orders, are for requiring the handing over of surveillance data aren't they?
    - rvnx 6y ago
      Not at all. Once you write significant software, it's frequent that the NSA or police will offer you collaboration (eg. How CloudFlare started with Project Honeypot, or how Facebook got investment by the CIA, Crypto AG that got investment, etc). The intelligence services don't have to coerce you through a gag order; they can just make a generous offer. One of the LibreSSL author(s) maybe has financial problems. In this case, what is better for him ? Accept a juicy 5M USD consulting contract, be a nice boy, solve all the problems and beyond, or be the guy that will discover what it means to be sued to oblivion on frivolous charge (NSA will never charge you but they can share information). If the US companies respect orders of the NSA, it's because they don't want to end up sacrified. If the DoJ for example needs help from Facebook to capture documents from Airbus to give them to Boeing, you think Zuck will give away all his shares, stock, money, family, or just collaborate ? The CEOs will fight the decision until they can (because of the PR risk), but at some point if the pressure is strong enough they won't be able to refuse (and I respect their choice to protect their families and by extension, protecting the families of their employees by protecting their job). If someone knows your weaknesses he has unlimited power. It doesn't matter if it is a legal or illegal organization.
      - blaser-waffle 6y ago
        > One of the LibreSSL author(s) maybe has financial problems. In this case, what is better for him ? Accept a juicy 5M USD consulting contract, be a nice boy, solve all the problems and beyond, or be the guy that will discover what it means to be sued to oblivion on frivolous charge (NSA will never charge you but they can share information). Yeah that's my first thought: why would they use gag order when they can just bribe someone? Doesn't even have to be $5MM; a few $100k here or there could change someone's life. And then there are actual government contracts, e.g. how the US can dangle the GovCloud or other lucrative contracts over Facebook/Google/Red Hat/Microsoft/whoever, with some implied or explicitly demanded "add this to the stack..." requirements.

by 6AA4FD 6y ago

zenhack 6y ago

It's not an either/or; we should be doing both.

6AA4FD 6y ago
Agreed.

gcthomas 6y ago

How would the NSA gag-order work on a Canada-based organisation with open source code worked on by devs around the world? (Libressl is developed by OpenBsd)

Gaelan 6y ago
Presumably, there's at least one US citizen who is on the LibreSSL "core team." With a gag order, get them to write a subtle backdoor (see [0]), and add it to the codebase however they normally do. The developer is presumably trusted, so their code probably gets minimal code review, at least compared to some unknown person from the NSA trying to add it themselves. Alternatively, the US and Canadian governments are close enough that the NSA could conceivably get Canada to do that instead. [0]: http://underhanded-c.org http://underhanded-c.org
- gcthomas 6y ago
  Wouldn't that require an NSA operative in that role? I'm probably mistaken, but what powers does the NSA have to force programmers to write code? National Security Letters, the ones that come with gag orders, are for requiring the handing over of surveillance data aren't they?
  - rvnx 6y ago
    Not at all. Once you write significant software, it's frequent that the NSA or police will offer you collaboration (eg. How CloudFlare started with Project Honeypot, or how Facebook got investment by the CIA, Crypto AG that got investment, etc). The intelligence services don't have to coerce you through a gag order; they can just make a generous offer. One of the LibreSSL author(s) maybe has financial problems. In this case, what is better for him ? Accept a juicy 5M USD consulting contract, be a nice boy, solve all the problems and beyond, or be the guy that will discover what it means to be sued to oblivion on frivolous charge (NSA will never charge you but they can share information). If the US companies respect orders of the NSA, it's because they don't want to end up sacrified. If the DoJ for example needs help from Facebook to capture documents from Airbus to give them to Boeing, you think Zuck will give away all his shares, stock, money, family, or just collaborate ? The CEOs will fight the decision until they can (because of the PR risk), but at some point if the pressure is strong enough they won't be able to refuse (and I respect their choice to protect their families and by extension, protecting the families of their employees by protecting their job). If someone knows your weaknesses he has unlimited power. It doesn't matter if it is a legal or illegal organization.
    - blaser-waffle 6y ago
      > One of the LibreSSL author(s) maybe has financial problems. In this case, what is better for him ? Accept a juicy 5M USD consulting contract, be a nice boy, solve all the problems and beyond, or be the guy that will discover what it means to be sued to oblivion on frivolous charge (NSA will never charge you but they can share information). Yeah that's my first thought: why would they use gag order when they can just bribe someone? Doesn't even have to be $5MM; a few $100k here or there could change someone's life. And then there are actual government contracts, e.g. how the US can dangle the GovCloud or other lucrative contracts over Facebook/Google/Red Hat/Microsoft/whoever, with some implied or explicitly demanded "add this to the stack..." requirements.