3 ms·

On the other hand, MacOS is closed source, so governments and Apple most likely have backdoors. Spyware counts too, when discussing malware.

by aborsy 4y ago

microtonal 4y ago
Why do you believe governments don't have backdoors in the open source ecosystem? It's very easy to slip innocent looking bugs into open source projects with plausible deniability. See e.g. heartbleed or the Debian OpenSSL bug. Note that I am not claiming that these bugs are made by state actors. Just to show that it is easy to slip vulnerabilities in billions of lines of open source code that are used in a Linux desktop system. Heck, the FBI even tried to slip backdoors in OpenBSD which is only a marginal project in terms of high-value targets [1]. If any government has backdoors in macOS outside open source software in macOS, it is probably very limited (the US government if any, but Apple seems to resist most attempts at weakening security). [1] https://arstechnica.com/information-technology/2010/12/fbi-accused-of-planting-backdoor-in-openbsd-ipsec-stack/ https://arstechnica.com/information-technology/2010/12/fbi-a...
- aborsy 4y ago
  It’s much easier to put in a backdoor, or actually implement a small monitoring system, in a closed source operating system. That’s much harder with open source software, not due to technical reasons, but because there is a good chance that eventually it will be discovered by some developer or security researcher. That will cause distrust of the government, and people going to defensive mode, making it much harder for governments to routinely hack into devices. So, for example, the discovery of the flaw in the Debian random number generator had a huge impact. People who design security systems really pay attention to PRNGs nowadays (to the point that it seems weak PRNGs are no longer a significant concern in the mainstream desktop operating systems, though the issue obviously remains in IoT, virtual machines, HSMs etc). Hiding the code for malware is common sense. That’s also why governments severely punish leaks these days.
  - gls2ro 4y ago
    I think your logic stands when thinking about individuals or private organisations. But when thinking about state actors they almost have unlimited money/resources thus even if adding a backdoor is a bit harder on open source having unlimited money/resources makes it irrelevant. Where “unlimited” = to the size of the open source organisation that maintains a bit of software.
px43 4y ago
It's easy to hide backdoors in open source applications. It's easy to detect backdoors in closed source applications. People should definitely be using open source for as much as possible, because I want to live in a world that makes it as easy as possible for beginners to understand how their underlying software systems are working. The whole "backdoor" FUD just seems lazy though.

On the other hand, MacOS is closed source, so governments and Apple most likely have backdoors. Spyware counts too, when discussing malware.

by aborsy 4y ago

On the other hand, MacOS is closed source, so governments and Apple most likely have backdoors. Spyware counts too, when discussing malware.

microtonal 4y ago

Why do you believe governments don't have backdoors in the open source ecosystem? It's very easy to slip innocent looking bugs into open source projects with plausible deniability. See e.g. heartbleed or the Debian OpenSSL bug. Note that I am not claiming that these bugs are made by state actors. Just to show that it is easy to slip vulnerabilities in billions of lines of open source code that are used in a Linux desktop system. Heck, the FBI even tried to slip backdoors in OpenBSD which is only a marginal project in terms of high-value targets [1]. If any government has backdoors in macOS outside open source software in macOS, it is probably very limited (the US government if any, but Apple seems to resist most attempts at weakening security). [1] https://arstechnica.com/information-technology/2010/12/fbi-accused-of-planting-backdoor-in-openbsd-ipsec-stack/ https://arstechnica.com/information-technology/2010/12/fbi-a...

aborsy 4y ago
It’s much easier to put in a backdoor, or actually implement a small monitoring system, in a closed source operating system. That’s much harder with open source software, not due to technical reasons, but because there is a good chance that eventually it will be discovered by some developer or security researcher. That will cause distrust of the government, and people going to defensive mode, making it much harder for governments to routinely hack into devices. So, for example, the discovery of the flaw in the Debian random number generator had a huge impact. People who design security systems really pay attention to PRNGs nowadays (to the point that it seems weak PRNGs are no longer a significant concern in the mainstream desktop operating systems, though the issue obviously remains in IoT, virtual machines, HSMs etc). Hiding the code for malware is common sense. That’s also why governments severely punish leaks these days.
- gls2ro 4y ago
  I think your logic stands when thinking about individuals or private organisations. But when thinking about state actors they almost have unlimited money/resources thus even if adding a backdoor is a bit harder on open source having unlimited money/resources makes it irrelevant. Where “unlimited” = to the size of the open source organisation that maintains a bit of software.

px43 4y ago

It's easy to hide backdoors in open source applications. It's easy to detect backdoors in closed source applications. People should definitely be using open source for as much as possible, because I want to live in a world that makes it as easy as possible for beginners to understand how their underlying software systems are working. The whole "backdoor" FUD just seems lazy though.