5 ms·

So are we not concerned this is coming from the NSA anymore? Genuinely asking, as imo they wouldn't try to sneak something in the very first time it was release

So are we not concerned this is coming from the NSA anymore? Genuinely asking, as imo they wouldn't try to sneak something in the very first time it was released, all eyes were on them, but now?

unnouinceput 6y ago
Open source, so no, we're not.
- dumpsterdiver 6y ago
  Sometimes the best place to hide something is in plain sight :)
  - hunter-gatherer 6y ago
    Of all the things on the NSA priority list, it seems like trying to inject malicious software into the wild via random reverse engineers computers seems like the best use of their time.
    - unnouinceput 6y ago
      open source means you can review the code. pretty sure, since this comes from them, is intensely scrutinized. So again, not worried.
saagarjha 6y ago
Generally, no. Consider that the people who use this tool are probably the best to find malicious things in it.
- justaj 6y ago
  Except... isn't this a couple of million LoC? Doesn't the mere act of finding malicious things in it require some serious time and effort not likely to be accomplished by individuals?
  - jjoonathan 6y ago
    It's not just individuals using it, though.
    - justaj 6y ago
      Sure, but do you think companies using it can allocate some of their budget to audit the _entire_ codebase?
Jasper_ 6y ago
tbh, I just assume my computer already has about six dozen NSA rootkits in it already, so what's a couple more? :)
- bigiain 6y ago
  Yeah - once you've admitted your adversary is the NSA, you've already lost. Cosplaying secret agents with state level support is not going to end well. "Threat: The Mossad doing Mossad things with your email account. Solution: Magical amulets? Fake your own death, move into a submarine? YOU’RE STILL GONNA BE MOSSAD’ED UPON" -- https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
  - MauranKilom 6y ago
    Thank you for this article and the joy it has brought me!
  - praptak 6y ago
    The realistic threat model for a common person is an agency that doesn't have resources to target them personally but is happy to steal their private data if they can cheaply do it on a mass scale.
dumpsterdiver 6y ago
A fair point. Consider that the NSA has the ability to push code changes faster than the open source community can analyze. Also, it's entirely conceivable that the NSA has the expertise to inject RCE vulns into the codebase, and make it look like an honest mistake.
zelly 6y ago
Super secret spy agencies are much less competent than you'd be led to believe. I'd be more afraid of Google and Facebook.
- nix23 6y ago
  I would not say that they are not competent, but you are absolutely right about Google/Facebook/Amazon, the big difference is, the NSA/CIA have to justify their actions...Google/Facebook not so much.
  - rurban 6y ago
    Very naive. The CIA is per definition a lying, criminal, state-protected enterprise, which is accountable to no one. Not to the oversight committee and for sure not the president. They just keep lying, doing their own secret wars, media interference and election busting. Being fascist should also be concerning to some. There are tons of books on that. The only oversight was the Church commission, once. They collect and fabricate so much dirt on everyone that oversight is impossible. The NSA being accountable is also news to me. They routinely violate their own constitution, and many other laws. They also cooperate with said criminals, and similar criminal enterprises worldwide.
pjmlp 6y ago
Apparently most don't have an issue with LinuxSE either.
kryptiskt 6y ago
SELinux is from NSA, so they're already in your kernel.
nix23 6y ago
Just tell me why should the NSA expose itself with their own software..especially software that targets not only programmers but highly specialized software analysts? Your Plastic Router and your half-secured OS is a much better target...and your ISP (because metadata is the most important thing to start and justify a targeted attack).

So are we not concerned this is coming from the NSA anymore? Genuinely asking, as imo they wouldn't try to sneak something in the very first time it was released, all eyes were on them, but now?

unnouinceput 6y ago

Open source, so no, we're not.

dumpsterdiver 6y ago
Sometimes the best place to hide something is in plain sight :)
- hunter-gatherer 6y ago
  Of all the things on the NSA priority list, it seems like trying to inject malicious software into the wild via random reverse engineers computers seems like the best use of their time.
  - unnouinceput 6y ago
    open source means you can review the code. pretty sure, since this comes from them, is intensely scrutinized. So again, not worried.

saagarjha 6y ago

Generally, no. Consider that the people who use this tool are probably the best to find malicious things in it.

justaj 6y ago
Except... isn't this a couple of million LoC? Doesn't the mere act of finding malicious things in it require some serious time and effort not likely to be accomplished by individuals?
- jjoonathan 6y ago
  It's not just individuals using it, though.
  - justaj 6y ago
    Sure, but do you think companies using it can allocate some of their budget to audit the _entire_ codebase?

Jasper_ 6y ago

tbh, I just assume my computer already has about six dozen NSA rootkits in it already, so what's a couple more? :)

bigiain 6y ago
Yeah - once you've admitted your adversary is the NSA, you've already lost. Cosplaying secret agents with state level support is not going to end well. "Threat: The Mossad doing Mossad things with your email account. Solution: Magical amulets? Fake your own death, move into a submarine? YOU’RE STILL GONNA BE MOSSAD’ED UPON" -- https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
- MauranKilom 6y ago
  Thank you for this article and the joy it has brought me!
- praptak 6y ago
  The realistic threat model for a common person is an agency that doesn't have resources to target them personally but is happy to steal their private data if they can cheaply do it on a mass scale.

dumpsterdiver 6y ago

A fair point. Consider that the NSA has the ability to push code changes faster than the open source community can analyze. Also, it's entirely conceivable that the NSA has the expertise to inject RCE vulns into the codebase, and make it look like an honest mistake.

zelly 6y ago

Super secret spy agencies are much less competent than you'd be led to believe. I'd be more afraid of Google and Facebook.

nix23 6y ago
I would not say that they are not competent, but you are absolutely right about Google/Facebook/Amazon, the big difference is, the NSA/CIA have to justify their actions...Google/Facebook not so much.
- rurban 6y ago
  Very naive. The CIA is per definition a lying, criminal, state-protected enterprise, which is accountable to no one. Not to the oversight committee and for sure not the president. They just keep lying, doing their own secret wars, media interference and election busting. Being fascist should also be concerning to some. There are tons of books on that. The only oversight was the Church commission, once. They collect and fabricate so much dirt on everyone that oversight is impossible. The NSA being accountable is also news to me. They routinely violate their own constitution, and many other laws. They also cooperate with said criminals, and similar criminal enterprises worldwide.

pjmlp 6y ago

Apparently most don't have an issue with LinuxSE either.

kryptiskt 6y ago

SELinux is from NSA, so they're already in your kernel.

nix23 6y ago

Just tell me why should the NSA expose itself with their own software..especially software that targets not only programmers but highly specialized software analysts? Your Plastic Router and your half-secured OS is a much better target...and your ISP (because metadata is the most important thing to start and justify a targeted attack).