3 ms·

You are right.. Let me switch over to SELinux... but wait that was made by NSA themselves... Playing around the paranoia, don't you think the NSA would have ta

by nivla 13y ago

You are right.. Let me switch over to SELinux... but wait that was made by NSA themselves... Playing around the paranoia, don't you think the NSA would have taken a minute to think, Gee we forced Microsoft and Apple to include backdoors in their OSes, maybe we should now tackle the OS that powers 90% of the web? You know maybe we could slip a backdoor in the one of the utility apps such as "htop". Let's get serious, OpenSource is not always = Secure and Closed Source does not always = InSecure. Truecrypt is the perfect example: Open sourced but too complex to Audit, maintainers identities are unknown and offered binaries differ from manual compilation. A good rule of thumb: Assume anything you din't write or can't audit as insecure.

inthewind 13y ago
Yes, worrying. http://www.linuxjournal.com/content/allegations-openbsd-backdoors-may-be-true http://www.linuxjournal.com/content/allegations-openbsd-back... Not sure what was confirmed on that story, but I remember reading it and thinking there wasn't much chance that I'd ever be able to audit my own system.
- jodrellblank 13y ago
  There's no chance at all that you completely could. http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html Ken Thompson, 1984, explains how to get a system with perfectly clean source code to compile a hacked 'login' binary every time. "In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect."
mattl 13y ago
truecrypt isn't open source, its proprietary with published source.
- foobarbazqux 13y ago
  It's been open source since 2009, they just haven't gone through the formalities of getting the license approved: https://en.wikipedia.org/wiki/TrueCrypt#Licensing_and_Open_Source_status https://en.wikipedia.org/wiki/TrueCrypt#Licensing_and_Open_S...

by nivla 13y ago

inthewind 13y ago

Yes, worrying. http://www.linuxjournal.com/content/allegations-openbsd-backdoors-may-be-true http://www.linuxjournal.com/content/allegations-openbsd-back... Not sure what was confirmed on that story, but I remember reading it and thinking there wasn't much chance that I'd ever be able to audit my own system.

jodrellblank 13y ago
There's no chance at all that you completely could. http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html Ken Thompson, 1984, explains how to get a system with perfectly clean source code to compile a hacked 'login' binary every time. "In demonstrating the possibility of this kind of attack, I picked on the C compiler. I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode. As the level of program gets lower, these bugs will be harder and harder to detect. A well installed microcode bug will be almost impossible to detect."

mattl 13y ago

truecrypt isn't open source, its proprietary with published source.

foobarbazqux 13y ago
It's been open source since 2009, they just haven't gone through the formalities of getting the license approved: https://en.wikipedia.org/wiki/TrueCrypt#Licensing_and_Open_Source_status https://en.wikipedia.org/wiki/TrueCrypt#Licensing_and_Open_S...