5 ms·

And this is why I'm glad my main OS is linux. Not impossible for NSA to get in but a lot more difficult.

by Fuxy 13y ago

romanovcode 13y ago
> I use Ubuntu, take that NSA! You're cute.
- Fuxy 13y ago
  Close... It's Arch though.
  - computer 13y ago
    So the only thing the NSA has to do is hack/convince/rendition/break-into-house a single person who holds a package signing key, and then they can MITM your pacman updater and have you as well. And there's enough people with such a key to choose from: https://www.archlinux.org/master-keys/ https://www.archlinux.org/master-keys/. (I run Arch as well, but I have no such illusions of security.)
    - Fuxy 13y ago
      As i said not impossible but at least we're not giving the NSA information about vulnerabilities months in advance of us fixing it. Where there's a will there's a way especially if you have billions of dollars in funding and the freedom to do so i just aim to make it as difficult as possible.
      - clarry 13y ago
        Is running Linux all you can do to make it as difficult as possible?
        Fuxy 13y ago
        No obviously not. There's a lot of things you can do to protect you privacy but it all starts with a good choice of OS and hardware. If the foundation is compromised there's no point in anything else you do to protect your privacy. Edit: Yes Arch it's not particularly security conscious I choose to compromise some security to stay on the bleeding edge now that could mean that I get some bad code sometimes but that also means that it gets fixed sooner too. Having a rolling release system that you can mold to your needs is worth it for me.
        clarry 13y ago
        I'm not trying to bash Arch, but it never looked like a particularly security-conscious or focused distro. To me it looked like it's about being cool and bleeding edge and Gentoo with binary packages... and I have a faint recollection of seeing some rather unimpressive packaging, though that was long time ago. So it runs on i686 and amd64 only. How do you select "good" hardware?
        Fuxy 13y ago
        In an ideal world it would be open source hardware where you can review anything from the circuit diagram to the firmware. However since there's no such thing you will have to choose who you trust.
    - danieldk 13y ago
      Or just employ people to contribute to some of the many popular upstream projects to slip in a vulnerability or two. Edit: not to discredit Linux of FLOSS, at least there is the possibility to analyse the source code.
voidlogic 13y ago
While Linux is probably slightly harder for a sophisticated attacker (and a lot harder for a unsophisticated one), a lot of your protection probably comes from the fact that they spend most of their time targeting the 98% of the desktop software base- that isn't Linux. Of course maybe their server oriented efforts make this moot.
- Fuxy 13y ago
  The most vulnerable part of a server is the fact that it's a server. It's a lot easier to attack the website running on the server and escalate from there then attack the OS directly. So the vulnerability would have to be in something that both servers and desktops have in common.
logn 13y ago
I seriously doubt linux presents a challenge for them. Think about all the web servers that are linux, you think they don't have an army of experts that can pwn those OS's?
- Crito 13y ago
  > Think about all the web servers that are linux None, unless you install them and activate them? What sort of desktop distro comes with pre-configured webservers?
  - sentenza 13y ago
    I think you misunderstood the GP. He means that the internet runs on linux, so the OS is a high-value target. Thus, it is reasonable to assume that the intelligence agencies have collected some as-of-now-unknown-to-the-public vulnerabilities for libraries that are typically used with Linux.
fc6e65dd360f10 13y ago
I don't think it's hard at all for the NSA to hack your Linux install if you were manually targetted. * The NSA probably has a few 0day exploits for typical Linux software ready. Remember that most critical servers use Linux and the NSA would love to get access to them. * Even though you are tech-savvy and install most software from repositories, you probably will run some code which comes from a potentially compromisable source. This includes: Any kind of random "utility script", any installer that downloads data from the Internet, and any download of software from unencrypted HTTP. * If you were savvy enough to protect yourself, they could even get someone to come to your house and install some backdoor to your system. Also, I guess the correlation between the people who take paranoid-level anti-hacking measures and people who they want to surveill is pretty high, so as unlikely as this may sound, I don't believe it's this impossible. My particular take on it: * Assume that everything you do on your regular install, whatever it is, may be compromissed and/or surveilled right now. * If you want to do something anonymously, download TAILS. Check the integrity of the image with PGP and some other, random source. Burn it to a non-modifiable media and watermark it. * If you want to store data securely, use something like TrueCrypt (TAILS includes it, though it's disabled by default). Use whole drive encryption. Do NEVER connect any unencrypted storage media in the same session you mount your volume unless you plan to wipe it immediately later. Do NEVER connect to the Internet in the same session you mount the volume. (If you want to send some of your encrypted volume data to the Internet, make a temporary partition to hold it. Put the data to it while offline, send it, then wipe it). * If your unencrypted partitions have ever contained unencrypted data or you slip, consider them "tainted". You need to wipe them. (NOTE: SDDs and USB thumb drives are hard to securely erase. Either use at least 3 random whole-drive passes, or physically destroy them). Yes, I'm a paranoid.

And this is why I'm glad my main OS is linux. Not impossible for NSA to get in but a lot more difficult.

by Fuxy 13y ago

And this is why I'm glad my main OS is linux. Not impossible for NSA to get in but a lot more difficult.

romanovcode 13y ago

> I use Ubuntu, take that NSA! You're cute.

Fuxy 13y ago
Close... It's Arch though.
- computer 13y ago
  So the only thing the NSA has to do is hack/convince/rendition/break-into-house a single person who holds a package signing key, and then they can MITM your pacman updater and have you as well. And there's enough people with such a key to choose from: https://www.archlinux.org/master-keys/ https://www.archlinux.org/master-keys/. (I run Arch as well, but I have no such illusions of security.)
  - Fuxy 13y ago
    As i said not impossible but at least we're not giving the NSA information about vulnerabilities months in advance of us fixing it. Where there's a will there's a way especially if you have billions of dollars in funding and the freedom to do so i just aim to make it as difficult as possible.
    - clarry 13y ago
      Is running Linux all you can do to make it as difficult as possible?
      - Fuxy 13y ago
        No obviously not. There's a lot of things you can do to protect you privacy but it all starts with a good choice of OS and hardware. If the foundation is compromised there's no point in anything else you do to protect your privacy. Edit: Yes Arch it's not particularly security conscious I choose to compromise some security to stay on the bleeding edge now that could mean that I get some bad code sometimes but that also means that it gets fixed sooner too. Having a rolling release system that you can mold to your needs is worth it for me.
        clarry 13y ago
        I'm not trying to bash Arch, but it never looked like a particularly security-conscious or focused distro. To me it looked like it's about being cool and bleeding edge and Gentoo with binary packages... and I have a faint recollection of seeing some rather unimpressive packaging, though that was long time ago. So it runs on i686 and amd64 only. How do you select "good" hardware?
        Fuxy 13y ago
        In an ideal world it would be open source hardware where you can review anything from the circuit diagram to the firmware. However since there's no such thing you will have to choose who you trust.
  - danieldk 13y ago
    Or just employ people to contribute to some of the many popular upstream projects to slip in a vulnerability or two. Edit: not to discredit Linux of FLOSS, at least there is the possibility to analyse the source code.

voidlogic 13y ago

While Linux is probably slightly harder for a sophisticated attacker (and a lot harder for a unsophisticated one), a lot of your protection probably comes from the fact that they spend most of their time targeting the 98% of the desktop software base- that isn't Linux. Of course maybe their server oriented efforts make this moot.

Fuxy 13y ago
The most vulnerable part of a server is the fact that it's a server. It's a lot easier to attack the website running on the server and escalate from there then attack the OS directly. So the vulnerability would have to be in something that both servers and desktops have in common.

logn 13y ago

I seriously doubt linux presents a challenge for them. Think about all the web servers that are linux, you think they don't have an army of experts that can pwn those OS's?

Crito 13y ago
> Think about all the web servers that are linux None, unless you install them and activate them? What sort of desktop distro comes with pre-configured webservers?
- sentenza 13y ago
  I think you misunderstood the GP. He means that the internet runs on linux, so the OS is a high-value target. Thus, it is reasonable to assume that the intelligence agencies have collected some as-of-now-unknown-to-the-public vulnerabilities for libraries that are typically used with Linux.

fc6e65dd360f10 13y ago

I don't think it's hard at all for the NSA to hack your Linux install if you were manually targetted. * The NSA probably has a few 0day exploits for typical Linux software ready. Remember that most critical servers use Linux and the NSA would love to get access to them. * Even though you are tech-savvy and install most software from repositories, you probably will run some code which comes from a potentially compromisable source. This includes: Any kind of random "utility script", any installer that downloads data from the Internet, and any download of software from unencrypted HTTP. * If you were savvy enough to protect yourself, they could even get someone to come to your house and install some backdoor to your system. Also, I guess the correlation between the people who take paranoid-level anti-hacking measures and people who they want to surveill is pretty high, so as unlikely as this may sound, I don't believe it's this impossible. My particular take on it: * Assume that everything you do on your regular install, whatever it is, may be compromissed and/or surveilled right now. * If you want to do something anonymously, download TAILS. Check the integrity of the image with PGP and some other, random source. Burn it to a non-modifiable media and watermark it. * If you want to store data securely, use something like TrueCrypt (TAILS includes it, though it's disabled by default). Use whole drive encryption. Do NEVER connect any unencrypted storage media in the same session you mount your volume unless you plan to wipe it immediately later. Do NEVER connect to the Internet in the same session you mount the volume. (If you want to send some of your encrypted volume data to the Internet, make a temporary partition to hold it. Put the data to it while offline, send it, then wipe it). * If your unencrypted partitions have ever contained unencrypted data or you slip, consider them "tainted". You need to wipe them. (NOTE: SDDs and USB thumb drives are hard to securely erase. Either use at least 3 random whole-drive passes, or physically destroy them). Yes, I'm a paranoid.