11 ms·

I don't even know anymore. We're gonna have to raise the bar on what it means to be a "tinfoil hatter"; the original definition has become reality. "Trust no o

• r4pha 13y ago
  I remember reading about Richard Stallman's setup [0] and thought it sounded indeed crazy. I couldn't understand why he needed so much 'freedom'. I do now. [0]: http://richard.stallman.usesthis.com/ http://richard.stallman.usesthis.com/
• claudius 13y ago
  Regarding the kernel.org hack: Even with git’s hashing, wouldn’t an attack on Linus’ – or even a subsystem maintainer’s – computer still be a viable way to get code into the kernel, as said code would be a variant of new, unpublished code rather than changed old code?
  • jlgreco 13y ago
    It wouldn't be particularly easier to do it that way than just submitting your subversive code normally. Either way your change would need to be "underhanded" such that anybody viewing it wouldn't suspect anything. In fact, trying to slip it in under the radar like that would actually just increase the chances of getting caught, because then it becomes something that isn't suppose to be there instead of merely something that does something that it isn't suppose to do.
    • javajosh 13y ago
      There is every possibility, however, that there is open-source code in the Linux kernel that, at runtime, interacts with specific microcode instructions that can backdoor a system. Runtime remote backdoor triggers are more useful anyway, because the one thing the NSA can't do is hide from network sniffers. (Of course the best way to hide would be piggybacking on something like automatic software update requests - which I happen to disable, as a nod to my tinfoil wearing brethren.)
    • Amadou 13y ago
      If you can come up with a backdoor that requires the non-obvious interaction of multiple parts of the kernel (or parts of the kernel and certain user-space actions) then it would be reasonable to break up the necessary changes and slip each one in as a part of a larger demonstrable improvement to each specific subsystem. For example (completely hypothetical), you could create a race condition in the kernel's page allocator that can be reliably be triggered by filling up physical ram and then forcing the kernel to allocate more memory for itself by filling up the proc table past a certain size. So in one patch you include an improvement to the allocator that has this obscure race condition but otherwise makes the allocator work much faster. Then in another patch you increase the maximum size of the proc table (under the pretense of supporting some big-iron system that practically no one outside of some HPC centers own) so that filling it up will force a kernel page allocation. So then you can force the exploit to occur on any system with both patches installed simply by allocating all the physical ram and then creating a ton of do-nothing processes that max out the proc table. If you are an organization like the NSA you could even have the submissions come from what appear to be completely independent developers. It is kind of the exploit version of "parallel construction." You know the exploit you want to put into the kernel, you just need to come up with reasonable sounding explanations for every little patch that ultimately gets you to the end goal.
      • nitrogen 13y ago
        That reminds me of a story I read about how the satellite companies foiled carders by slowly building up a new decryption system out of apparent garbage released across a long string of updates. I don't dare to search for it though, so I don't have a link.
        • khoffrath 13y ago
          http://www.codinghorror.com/blog/2008/05/revisiting-the-black-sunday-hack.html http://www.codinghorror.com/blog/2008/05/revisiting-the-blac... Original article: http://news.slashdot.org/story/01/01/25/1343218/directvs-secret-war-on-hackers http://news.slashdot.org/story/01/01/25/1343218/directvs-sec... Fascinating background story here: http://www.wired.com/politics/security/news/2008/05/tarnovsky?currentPage=all http://www.wired.com/politics/security/news/2008/05/tarnovsk...
    • derekp7 13y ago
      How many security exploits have been found in the Linux kernel, or other trusted software? How many of those were around for a "long time"? Every one of those got by the normal peer review process. So the question is, which is harder: does it take more skill to accidently insert a bug that gets by (sometimes for years), or to do so on purpose?
• jlgreco 13y ago
  Meanwhile the way Bruce Schneier is now using GPG is really only one conceptual leap away from full-blown Tinfoil Hat Linux usage: http://en.wikipedia.org/wiki/Tinfoil_Hat_Linux http://en.wikipedia.org/wiki/Tinfoil_Hat_Linux The difference between "tinfoil hatters" and reasonable people like Bruce Schneier now seems to be how concerned they are with their ability to destroy a harddrive, and TEMPEST.
  • sillysaurus2 13y ago
    the way Bruce Schneier is now using GPG Which way is that? Also, from your Tinfoil Hat Linux link, this idea is hilariously awesome: Keystroke monitoring — THL has gpggrid, a wrapper for GPG that lets you use a video game style character entry system instead of typing in your passphrase. Keystroke loggers get a set of grid points, not your passphrase. I wonder if it might be possible to implement that idea into other operating systems?
    • MacsHeadroom 13y ago
      >Which way is that? https://www.schneier.com/contact.html https://www.schneier.com/contact.html All default settings, except the 4096-bit key length. See: https://www.schneier.com/blog/archives/2013/09/my_new_gpgpgp_a.html https://www.schneier.com/blog/archives/2013/09/my_new_gpgpgp...
    • jlgreco 13y ago
      Air gapped with new hardware: "Since I started working with the Snowden documents, I bought a new computer that has never been connected to the internet. If I want to transfer a file, I encrypt the file on the secure computer and walk it over to my internet computer, using a USB stick. To decrypt something, I reverse the process. This might not be bulletproof, but it's pretty good." http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema... Air gapping is certainly not unprecedented, but individuals using it have traditionally been considered pretty "tinfoil-y". edit: "I wonder if it might be possible to implement that idea into other operating systems?" gpggrid itself could probably just be built on any other Linux install. Certainly it could be recreated. One of the neat features of TFL that I really like is the idea of blinking LEDs on the users keyboard instead of displaying things on screen. Effective? Who knows... but certainly amusing.
• sliverstorm 13y ago
  The original idea of a "tinfoil hatter" was that the "hatter" wore a head garment made of tinfoil, to block the mind-control radio waves the [government|aliens] were using to take over people's brains. I don't think we have any particular indication that is likely, yet.
  • mike-cardwell 13y ago
    If the technology existed, you better believe they'd use it.
    • sliverstorm 13y ago
      Who cares if they would? I don't believe it exists or will exist in the near future, so it's immaterial.
      • guerrilla 13y ago
        Everyone cares if they would [and that they are]. What is immaterial is what technology the governments use to spy on their people, especially unlawfully.
    • samstave 13y ago
      http://www.google.com/patents/US3951134 http://www.google.com/patents/US3951134
  • skidoo 13y ago
    To be fair, there is plenty of documentation that diverse subliminals find their ways into television programming, and even the music in supermarkets. Just like Fight Club. https://en.wikipedia.org/wiki/Subliminal_message https://en.wikipedia.org/wiki/Subliminal_message
    • superuser2 13y ago
      There is also plenty of research that these don't actually work, or at least not nearly as well as you think they do.
• pnathan 13y ago
  > I don't even know anymore. We're gonna have to raise the bar on what it means to be a "tinfoil hatter"; the original definition has become reality. That's sort of where I've gotten to this summer. It's really frustrating and saddening. Although mind-control waves still aren't, TO THE BEST OF MY KNOWLEDGE, a thing.
  • VladRussian2 13y ago
    >Although mind-control waves still aren't, TO THE BEST OF MY KNOWLEDGE, a thing. knowing that you're under constant surveilance and your every step/action is recorded makes wonders in the way of shaping and controlling your behavior.
  • zanny 13y ago
    Mainstream media bombardment and constant advertising harassment do a pretty good job of mind control, though. Also, culture is the best mind control. Raise people with a mind set the way you want it and you never have to do anything directly, because they already are siding with you even through cognative dissonance.
    • baddox 13y ago
      Public schools are far more significant than the media.
      • a3n 13y ago
        You could be right. Or it could be the exact opposite. Or something else. It doesn't matter. Fundamentally we do it to ourselves, because we're herd/pack/social animals. We shun anyone too different from the tribe, it's in our DNA. Because of that, we are highly evolved to fit in. Yeah, we're self aware and all that, we have choices, but what we generally choose to do is identify with some group and hate opposing groups. It's what we do. The chimpanzees are laughing at us.
        • 001sky 13y ago
• saraid216 13y ago
  > "Trust no one! Suspect EVERYTHING!", I can say today without sounding crazy. It's really not that hard to say this seriously without wearing a tinfoil hat. I've been doing that since high school. The key is thinking in terms of operations, rather than in terms of generic trust. You need to know what you're doing, maintain opsec and have a strong, realistic threat analysis. For me, the Snowden cascade hasn't changed anything: if someone can penetrate the USGov's defenses, then they can almost certainly penetrate mine. And that has always been true. The revelations are a matter of ideological trust--trust in whether or not someone agrees with you--, but the USGov has never had much of this kind of trust, not even at its founding, nor has it ever acquired it.
• 001sky 13y ago
  "Trust no one! Suspect EVERYTHING!", I can say today without sounding crazy. What's seemingly worse/more crazy is many of these materials date for 4-5 years ago (2008-09). If these data were public, it would have potenially casued huge behavioural shifts. In that way, its reminiscent of 9-11 where the damage was done not on that day, but the years earlier when the bad guys were training in plain daylight.
• babuskov 13y ago
  http://abstrusegoose.com/536 http://abstrusegoose.com/536