4 ms·

The real question should be how many more similar things there are in the entire Linux codebase I would bet good money there are more that haven't been detec

The real question should be how many more similar things there are in the entire Linux codebase I would bet good money there are more that haven't been detected. Every intelligence service in the world wants one or more. Many can hire truly bright programmers who will contribute to Linux over years, doing nothing nefarious at all, to build a trustworthy profile. and even contribute meaningful and positive features. Then, maybe 2 of 3 trusted profiles make tiny changes as part of a much larger valid contribution. each one a tiny adjustment, each one not particularly interesting from a security point of view, unless you look at all 3 at the same time, and of course they were not added at the same time. I am quite certain they have people who are working at Apple and Microsoft as well with the same mission.

jacknews 3y ago
It sounds like an outrageous conspiracy theory, but I'm also quite sure you are right, this is how these intelligence services operate.
- cpach 3y ago
  Indeed. For another wild example, see https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG
- appplication 3y ago
  It’s outrageous because it’s basically unprovable, though we have at least one data point the MO exists to some degree. It would be naive to think it’s not attempted at least. How does one go about becoming a corporate plant? If the CIA offered me $1M to inject a back door into some shenanigans corporate product and told me it was being used to target Bashar al-Assad or cripple Russia’s war effort, would I do it? I don’t know honestly. Principles say it’s not right, but I wouldn’t blame someone (or myself) for saying yes. Of course, being a data guy I’m probably not at risk of such a decision, since no one is injecting backdoors into corporate analytics. Dare to dream of a shadowy government payout I suppose.
  - SJC_Hacker 3y ago
    > How does one go about becoming a corporate plant? If the CIA offered me $1M to inject a back door into some shenanigans corporate product and told me it was being used to target Bashar al-Assad or cripple Russia’s war effort, would I do it? I don’t know honestly. Principles say it’s not right, but I wouldn’t blame someone (or myself) for saying yes. Why would that "not be right"?

jacknews 3y ago

It sounds like an outrageous conspiracy theory, but I'm also quite sure you are right, this is how these intelligence services operate.

cpach 3y ago
Indeed. For another wild example, see https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG
appplication 3y ago
It’s outrageous because it’s basically unprovable, though we have at least one data point the MO exists to some degree. It would be naive to think it’s not attempted at least. How does one go about becoming a corporate plant? If the CIA offered me $1M to inject a back door into some shenanigans corporate product and told me it was being used to target Bashar al-Assad or cripple Russia’s war effort, would I do it? I don’t know honestly. Principles say it’s not right, but I wouldn’t blame someone (or myself) for saying yes. Of course, being a data guy I’m probably not at risk of such a decision, since no one is injecting backdoors into corporate analytics. Dare to dream of a shadowy government payout I suppose.
- SJC_Hacker 3y ago
  > How does one go about becoming a corporate plant? If the CIA offered me $1M to inject a back door into some shenanigans corporate product and told me it was being used to target Bashar al-Assad or cripple Russia’s war effort, would I do it? I don’t know honestly. Principles say it’s not right, but I wouldn’t blame someone (or myself) for saying yes. Why would that "not be right"?