4 ms·
Anyone who doesn't think that NSA has backdoor access in Linux is a naïve optimist. All that the NSA needs is a security hole. They can generate them by submi
by btilly 6y ago
Anyone who doesn't think that NSA has backdoor access in Linux is a naïve optimist.
All that the NSA needs is a security hole. They can generate them by submitting reasonable code whose misbehavior is hard to spot, like http://www.underhanded-c.org/ http://www.underhanded-c.org/, or by searching for holes that already exist in the wild. And if you wind up putting a proprietary driver into your computer and they got a hole in the driver, you do even better.
Given the NSA's resources and the rate at which groups like Project Zero find bugs, they certainly have multiple ways in to any system that they want.
- generalizations 6y agoI wonder if the same is true for OpenBSD systems, given their greater focus on security.
- boomboomsubban 6y agoIt was alleged that the FBI paid someone to put that kind of backdoor masquerading as a bug into OpenBSD, but no evidence was ever found. OpenBSD being discussed as a possible target by an ex-FBI consultant is enough for me to assume they have something.
- st1x7 6y agoThis just made me wonder about the engineering culture at the FBI. Do they have standups and roadmaps? What's their relationship with the rest of the FBI? Do they search stackoverflow like the rest of us? Are they in on all the latest programmer memes? Maybe it's just the secrecy but there's something fascinating about all of this.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- cmr10 6y agoIt is a great OS, they do focus on security. On the other hand they use old compilers for license reasons and threading is not yet on the same level as in FreeBSD or NetBSD. The kernel itself should hopefully be unaffected by these issues though.
- ben_bai 6y agoThey do update compilers now. Except for some architectures. $ cc -v OpenBSD clang version 10.0.1 Target: amd64-unknown-openbsd6.8 Thread model: posix InstalledDir: /usr/bin Threading is plenty fast, and the kernel has, like everything, bugs.
- __s 6y agoI came across some slides once which compared bugs in Linux & BSDs. Overall it found that bugs per lines of code was relatively consistent across projects, but OpenBSD came out ahead since they tend to have less lines of code But it definitely wasn't zero
- fsflover 6y agoDo you also think that Qubes OS (https://qubes-os.org https://qubes-os.org) has an NSA backdoor, too?
- boomboomsubban 6y agoI've never heard of Qubes doing significant in-distro kernel hardening, so if they think Linux does Qubes would too.
- fsflover 6y agoThis is not so simple. Qubes implements security through isolation. Dom0 has not Internet access, so you can only have a backdoor in VMs. Some VMs also have no Internet access, so they're safe. Others are reset every reboot. In addition, all VMs can rely on different Linux distributions (Arch, Debian, Fedora etc.). I think Qubes provides a good defense against such attacks. Upd: > I've never heard of Qubes doing significant in-distro kernel hardening https://github.com/QubesOS/qubes-issues/issues/4233 https://github.com/QubesOS/qubes-issues/issues/4233 https://github.com/QubesOS/qubes-issues/issues/2748 https://github.com/QubesOS/qubes-issues/issues/2748 https://github.com/QubesOS/qubes-issues/issues/2045 https://github.com/QubesOS/qubes-issues/issues/2045
- seqizz 6y agoBetter defense of course, but reminds me this [0] quote. [0] https://news.ycombinator.com/item?id=7585031 https://news.ycombinator.com/item?id=7585031
- fsflover 6y agoQubes OS v4+ does not use typical software virtualization methods. VT-d hardware virtualization it uses was broken only once, and it was done by the Qubes founder: https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software)
- Lammy 6y ago> reasonable code whose misbehavior is hard to spot Like this one! https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/ https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-...
- CraigJPerry 6y agoWhy do they need to submit code? Why not just do the same as for Windows and MacOS back doors they’ve uncovered? https://en.m.wikipedia.org/wiki/Zero-day_(computing)#Vulnerabilities_Equities_Process https://en.m.wikipedia.org/wiki/Zero-day_(computing)#Vulnera...
- darig 6y agoNSA gets their backdoors through Intel chip bugs. There is a reason Linus is ranting about Intel nerfing ECC lately.[1] [1] https://forums.theregister.com/forum/all/2021/01/04/linus_torvalds_intel_killed_ecc/ https://forums.theregister.com/forum/all/2021/01/04/linus_to...
- dastx 6y agoI don't think people think that NSA doesn't have backdoor access in Linux. But I think there's a huge difference between the maintainers purposefully implemented a backdoor for the NSA, and the NSA found exploits to gain backdoor. Given that, what I'm more interested in is why Linus would say no when asked.
- Shared404 6y agoHe lives in the US currently, right? That being the case, I can think of a number of reasons to say no.
- blackrock 6y agoLike the Apple double semicolon bug? Stealthy. That was like using a secret door knock to get root.
- xorcist 6y ago> reasonable code whose misbehavior is hard to spot, Have you submitted code to Linux? It's routine that people are told to rewrite something in a more clear way. I'm not saying that it's impossible, far from it, but it's not like you could just submit something and have it accepted. You'd have to put a lot of work over a long time and be very careful, preferably with one of the more obscure drivers. Then again, enormous patience and budgets are what the three letter agencies are best at.