3 ms·
> it's in an open sourced package, so the assumption is someone is eventually going to see it, so it's not going to remain a secret and thus is useless as a s
by nly 13y ago
> it's in an open sourced package, so the assumption is someone is eventually going to see it, so it's not going to remain a secret and thus is useless as a stealth backdoor.
The fact that people can see the nature of the bug in the source code for themselves just makes the case that it was a deliberate backdoor even more deniable which, as Schneier is pointing out, is a very desirable property.
You're also assuming that a backdoor you can use indefinitely is desirable.
As an added side-benefit, any other proprietary or FOSS products that adopted this code are now vulnerable.
- nicholassmith 13y agoSure, it makes it even more deniable, but on the balance between 'well thought out conspiracy with I know-you know-I know you know I know' logic, and a fuck up, I'd err towards it being a fuck up.
- nly 13y agoYou're just casually brushing this off with Hanlon's Razor. You shouldn't discount the fact that as technical folk and programmers here on HN we're probably biased[0]. Our ability to recognise just how easily this flaw could have been both introduced and detected can both be used both against, and in defence, of the conspiracy theory. [0] https://en.wikipedia.org/wiki/Attribution_%28psychology%29#Defensive_attribution_hypothesis https://en.wikipedia.org/wiki/Attribution_%28psychology%29#D...
- nicholassmith 13y agoI've been a proponent of Hanlon's Razor a number of times, so guilty as charged. As technically minded people we intrinsically understand that it could be the work of someone malicious, but we should also understand from personal experiences that fuck ups happen significantly more often than brown envelopes full of cash.