5 ms·
This is not only true for software developed with public funds, but with any software that becomes critical for providing public services, communication in part
by yholio 6y ago
This is not only true for software developed with public funds, but with any software that becomes critical for providing public services, communication in particular.
Take for example the recent 5G spying debacle. US claims that the Chinese can insert snooping tech in their hardware, which is of course true. But the same thing is true for gear produced by American or European companies, so we are expected to choose based on the respectability of the political regime or some such and keep our fingers crossed.
This whole issue goes away if all critical infrastructure services, regardless of origin, can only operate in "source available" mode, if full FOSS is not economically feasible.
- mulmen 6y agoHow do I know that the cell tower I connect to is running the firmware I personally verified on github.gov?
- yholio 6y agoThe trust you have in the phone company is another target of attack than the one discussed here, the fact that operators need to trust closed source blobs in their networks, often times provided by other states with strategic interests in what goes on over their networks.
- mulmen 6y agoMaybe I wasn’t clear. Even if the government publishes the source of whatever I am interacting with how do I know the source they publish is the same source I am interacting with? Nothing stops them from adding some malicious patch before deploying the open code. It’s all still based on trust.
- yholio 6y agoYou are talking about the full chain of trust. I'm an talking about a single link of that chain, the ability of the operators to know their hardware is not under the control of some foreign state actor. This is the topic of the 5G wars. It's a necessary but clearly insufficient condition for what you ask.
- majkinetor 6y agoThere could be regular random audits by relevant gov ministry.
- pydry 6y ago>US claims that the Chinese can insert snooping tech in their hardware, which is of course true. Huawei have been caught doing this (e.g. with the African Union HQ where they set everything up). This very much isn't true for a lot of Huawei equipment, though, where the source code is loaded manually, Huawei are very willing to allow manual inspection and the equipment forms part of the "dumb" routing infrastructure rather than the clever bits (where hacks would be easier to hide). Trump wants everything gone, though. This is more an economic war than it is a spying war. National security simply provides a very convenient excuse to sell domestically and an automatic exemption from WTO rules.
- adrianN 6y agoHow many backdoor accounts have been found in Cisco products so far? Dozens?
- UncleMeat 6y agoOne of the challenges is that FLOSS means so many different things. You say that the minimum thing is source availability for auditing. Others will say that the freedom to modify the code running on your systems is the most important thing. Others will say that the freedom to copy the code into new contexts is the most important thing. Still others will say that the ability to run the code for free is the most important thing. This makes it very difficult to navigate this topic.
- majkinetor 6y ago> minimum thing is source availability for auditing That is not FLOSS. Its normal and expected and usually required to give source code to stakeholder.
- UncleMeat 6y agoTake that up with OP, who merged these two concepts.