3 ms·

Why is freedom so important? I've noticed many projects still give MD5 checksums, if any. That's a form of freedom, I guess, since the code is open source, but

Why is freedom so important? I've noticed many projects still give MD5 checksums, if any. That's a form of freedom, I guess, since the code is open source, but if no one has the time to secure things the open code just makes it easier to find 0 days... and then you don't need a 0 day if you can just hack the site to alter the binary and serve up a matching hash :/ The above is why for a long time I supported Apple -- I viewed it as paying for a team of folks to audit code etc, but they've made so many terrible decisions such as literally removing the function keys for a touchbar that my next laptop will probably be something that can run Debian well (then whatever else I need in a VM, since this device has a tiny hard drive and not a ton of ram nor a decent GPU since I got it back when I had a university affiliation and could SSH into all sorts of things rather than keep everything here or on a literal USB hard drive in a safe.)

pabs3 4y ago
An example of why software freedom is important in basebands; the proprietary PinePhone baseband software contains a vulnerability (IIRC RCE) and the vendor never fixed that issue, but the libre PinePhone baseband fixed that vulnerability. It is only through software freedom that people can control their devices and independently find and fix problems with them, including security issues. Since not everyone has the skills for that, those that do can band together forming open communities around projects and improving code quality collectively. I note that Asahi Linux now runs on Apple M1/M2 products, so you could continue to buy Apple hardware (since it is better than other hardware) but use Linux so you control your experience more.
- dontbenebby 4y ago
  >An example of why software freedom is important in basebands; the proprietary PinePhone baseband software contains a vulnerability (IIRC RCE) and the vendor never fixed that issue, but the libre PinePhone baseband fixed that vulnerability. I agree that's a great part of open source -- you can write a patch. My concern is that without some kind of security person on the project, what happens is often people notice a flaw and hoard it... or they inform a tiny project, ride out whatever window the jerks at CERT or whatever set, then start going buck wild with it. On my end, my big concern was privacy. You can't obtain privacy until you have security -- until you lock down your projects. And every time a project gets good enough to trust someone seems to come and fuck it up[1]. The classic example being Ubuntu -- just as I was ready to possibly switch to them from OSX, they added privacy invading features that made me think it was better to stick with Apple and start using VMs for the important stuff. (If you or others have thoughts on distros, I'm leaning towards Debian but I worry that if I switch to that some asshole will come make that one shit the bed in the MOTD[2] like happened with Ubuntu -- I used to have one that popped up an ASCII dinosaur and said "This is a Unix system, I know this" -- but no one except me and the folks at the Apple Store should know that.) [1] https://en.wikipedia.org/wiki/Ubuntu#Conformity_with_European_data_privacy_law https://en.wikipedia.org/wiki/Ubuntu#Conformity_with_Europea... [2] https://en.wikipedia.org/wiki/Ubuntu#System_terminal_advertising_controversies https://en.wikipedia.org/wiki/Ubuntu#System_terminal_adverti...
  - pabs3 4y ago
    There are tons of people hoarding flaws and exploits for ever piece of software imaginable (Apple included), often these people only work at the binary level and consequently having source code isn't that useful to them. The source code however is useful to users of and contributors to the projects, and to some types of security researchers that focus on open source. Using software means you will always be subject to security issues and privacy invasions, because programmers are human. Sticking with Apple just means you're still subject to privacy invasions and cannot fix them if you are allowed to find them, but going to Ubuntu means you can at least discover them or hear about them from other folks and patch them out. Debian definitely has myriad privacy issues (link below), mostly inherited from all the open source software out there. It also has a strong culture of fixing those issues, including basic things like locally installed documentation loading images or JavaScript from the web. More help fixing them is needed though. The only official telemetry we (I'm a member) have is popularity-contest, which is opt-in and that will never change. There is also the hw-probe tool, for optionally submitting to the external Linux Hardware database site. The hw-probe tool isn't well integrated into the Debian installer/etc but if it were, it would be optional. https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues https://popcon.debian.org/ https://popcon.debian.org/ https://qa.debian.org/popcon.php https://qa.debian.org/popcon.php https://wiki.debian.org/Hardware/Database https://wiki.debian.org/Hardware/Database If you're really worried about this stuff, I strongly suggest you look at QubesOS, it uses Xen VMs for compartmentalisation, both for security and privacy. It splits up your digital life into one VM per area, with temporary VMs for dealing with unsafe documents and stuff. The split is up to you and you can run whatever you want inside each VM, including Debian. https://www.qubes-os.org/ https://www.qubes-os.org/
greyw 4y ago
You should publish a paper about md5 preimage attacks if you know how to do what you just described. Im not aware of any existing ones. Are you maybe confusing collision attacks with preimage attacks?
- dontbenebby 4y ago
  Maybe. I probably misspoke. Why would I publish though? In the past it hasn’t lead to income, paired with snarky replies about known bad practices. Seems like it’s better to think and act like a magician - hoard esoteric knowledge and wield it as needed. (Though I’m mostly annoyed you seem to only be paid for RCE not “just” denial of service vulnerabilities.)

pabs3 4y ago

An example of why software freedom is important in basebands; the proprietary PinePhone baseband software contains a vulnerability (IIRC RCE) and the vendor never fixed that issue, but the libre PinePhone baseband fixed that vulnerability. It is only through software freedom that people can control their devices and independently find and fix problems with them, including security issues. Since not everyone has the skills for that, those that do can band together forming open communities around projects and improving code quality collectively. I note that Asahi Linux now runs on Apple M1/M2 products, so you could continue to buy Apple hardware (since it is better than other hardware) but use Linux so you control your experience more.

dontbenebby 4y ago
>An example of why software freedom is important in basebands; the proprietary PinePhone baseband software contains a vulnerability (IIRC RCE) and the vendor never fixed that issue, but the libre PinePhone baseband fixed that vulnerability. I agree that's a great part of open source -- you can write a patch. My concern is that without some kind of security person on the project, what happens is often people notice a flaw and hoard it... or they inform a tiny project, ride out whatever window the jerks at CERT or whatever set, then start going buck wild with it. On my end, my big concern was privacy. You can't obtain privacy until you have security -- until you lock down your projects. And every time a project gets good enough to trust someone seems to come and fuck it up[1]. The classic example being Ubuntu -- just as I was ready to possibly switch to them from OSX, they added privacy invading features that made me think it was better to stick with Apple and start using VMs for the important stuff. (If you or others have thoughts on distros, I'm leaning towards Debian but I worry that if I switch to that some asshole will come make that one shit the bed in the MOTD[2] like happened with Ubuntu -- I used to have one that popped up an ASCII dinosaur and said "This is a Unix system, I know this" -- but no one except me and the folks at the Apple Store should know that.) [1] https://en.wikipedia.org/wiki/Ubuntu#Conformity_with_European_data_privacy_law https://en.wikipedia.org/wiki/Ubuntu#Conformity_with_Europea... [2] https://en.wikipedia.org/wiki/Ubuntu#System_terminal_advertising_controversies https://en.wikipedia.org/wiki/Ubuntu#System_terminal_adverti...
- pabs3 4y ago
  There are tons of people hoarding flaws and exploits for ever piece of software imaginable (Apple included), often these people only work at the binary level and consequently having source code isn't that useful to them. The source code however is useful to users of and contributors to the projects, and to some types of security researchers that focus on open source. Using software means you will always be subject to security issues and privacy invasions, because programmers are human. Sticking with Apple just means you're still subject to privacy invasions and cannot fix them if you are allowed to find them, but going to Ubuntu means you can at least discover them or hear about them from other folks and patch them out. Debian definitely has myriad privacy issues (link below), mostly inherited from all the open source software out there. It also has a strong culture of fixing those issues, including basic things like locally installed documentation loading images or JavaScript from the web. More help fixing them is needed though. The only official telemetry we (I'm a member) have is popularity-contest, which is opt-in and that will never change. There is also the hw-probe tool, for optionally submitting to the external Linux Hardware database site. The hw-probe tool isn't well integrated into the Debian installer/etc but if it were, it would be optional. https://wiki.debian.org/PrivacyIssues https://wiki.debian.org/PrivacyIssues https://popcon.debian.org/ https://popcon.debian.org/ https://qa.debian.org/popcon.php https://qa.debian.org/popcon.php https://wiki.debian.org/Hardware/Database https://wiki.debian.org/Hardware/Database If you're really worried about this stuff, I strongly suggest you look at QubesOS, it uses Xen VMs for compartmentalisation, both for security and privacy. It splits up your digital life into one VM per area, with temporary VMs for dealing with unsafe documents and stuff. The split is up to you and you can run whatever you want inside each VM, including Debian. https://www.qubes-os.org/ https://www.qubes-os.org/

greyw 4y ago

You should publish a paper about md5 preimage attacks if you know how to do what you just described. Im not aware of any existing ones. Are you maybe confusing collision attacks with preimage attacks?

dontbenebby 4y ago
Maybe. I probably misspoke. Why would I publish though? In the past it hasn’t lead to income, paired with snarky replies about known bad practices. Seems like it’s better to think and act like a magician - hoard esoteric knowledge and wield it as needed. (Though I’m mostly annoyed you seem to only be paid for RCE not “just” denial of service vulnerabilities.)