3 ms·

There's a talk that was given in Belgium / Brussels at FOSDEM2014 two months ago or so by Poul-Henning Kamp (FreeBSD) regarding the NSA and how he'd do it if he

There's a talk that was given in Belgium / Brussels at FOSDEM2014 two months ago or so by Poul-Henning Kamp (FreeBSD) regarding the NSA and how he'd do it if he had to create holes in software: http://www.youtube.com/watch?v=fwcl17Q0bpk http://www.youtube.com/watch?v=fwcl17Q0bpk He's talking specifically about OpenSSL quite a lot (basically saying it's too complex to ever be secure and probably received many "security patches" from NSA employees). The entire talk is an eye opener. He explains how NSA shills are reading reddit / HN and poisoning communities / standards / protocols / etc. How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things. He talks about shills submitting a few correct patches over the months / years, slowly gaining reputation among the community and then misusing that trust to submit (not so) subtle patches introducing security holes on purpose. He mentions a few of the "common mantra" repeated often (including here) by people who have an interest in the status quo. He explains why SSL/TLS is broken and says that the "SEC" part of "DNSSEC" is not going to be that secure ; ) I think that the problem is much worse than most people think and that Poul-Henning Kamp is closer to the truth than the ones constantly repeating "bug happens" as if nothing malicious was ever going on.

glomph 13y ago
Too be fair it is obviously intended to be a talk on what could be happening and not what certainly is.
- sentenza 13y ago
  It is, however, reasonable to assume that "they" are as smart as we are, so "how would I do it" analysis is quite called for.
  - philh 13y ago
    Yes, but it's not reasonable to assume that our armchair "how I would do it" theorizing is, in fact, how they would do it. We can assume that they have come up with the idea, but maybe they discarded it for reasons that aren't obvious to us.
_pmf_ 13y ago
> How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things. Ah, so that's why OpenSSL is not implemented as a RoR web application with REST-API and Cucumber tests in a TDD way so that Johnny Webmonkey can easily contribute. I always assumed it had to do with portability and performance.
obsurveyor 13y ago
> How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things. Developers are quite willing and able to do this all on their own. Feature/scope creep is pretty horrible these days.
pvnick 13y ago
I'm watching this right now, it's brilliant! This is exactly the kind of stuff I love to think about, but PHK has done a wonderful job thinking it out to a lot of detail. I suggest everyone drop what you're doing and watch it asap. It's exciting and really holds your interest.
- ableal 13y ago
  I did watch, thanks, but anyone in a hurry can get just the slides here: http://phk.freebsd.dk/_downloads/FOSDEM_2014.pdf http://phk.freebsd.dk/_downloads/FOSDEM_2014.pdf I particularly appreciated the "QUEEN success example: SSC" (self-signed certificates, starts at slide 23), which also got a good laugh from the audience ... (if you're just watching the video, this is the text of the second slide in the PDF, not shown at FOSDEM: """ What is this ? This is a ficticious NSA briefing I gave as the closing keynote at FOSDEM 2014 The intent was to make people laugh and think, but I challenge anybody to prove it untrue. Playlist spoiler: Electric Light ORCHESTRA: Confusion ABBA: Money, Money, Money Backman Turner OVERDRIVE: Taking Care Of Business QUEEN: Bicycle Race Beastie BOYS: Sabotage PASADENA Roof Orchestra: Pennies From Heaven """ )
blazespin 13y ago
Reality is NSA has to do very very little to make this happen. Tiny nudges here and there. Profit motive encourages people to move towards complexity. Simple software commodifies too quickly.
jroes 13y ago
Here's an interesting thought. The NSA isn't the only entity who could stand to benefit from a privately held exploit to most SSL implementations. The NSA is also not the only group who could actually accomplish this. Who's to say there aren't groups out there that are doing this already to steal and profit from corporate information, credit cards, etc.?
headShrinker 13y ago
Sorry to introduce the hyperbole, or not moderate it. When the government runs a campaign to cause the public to fear and doubt your neighbor that is the beginning of a dark time ahead. This idea that they are one of you, or someone on reddit is just poison. On an emotional level, more and more Edward Showden is becoming a mystical figure.

glomph 13y ago

Too be fair it is obviously intended to be a talk on what could be happening and not what certainly is.

sentenza 13y ago
It is, however, reasonable to assume that "they" are as smart as we are, so "how would I do it" analysis is quite called for.
- philh 13y ago
  Yes, but it's not reasonable to assume that our armchair "how I would do it" theorizing is, in fact, how they would do it. We can assume that they have come up with the idea, but maybe they discarded it for reasons that aren't obvious to us.

_pmf_ 13y ago

> How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things. Ah, so that's why OpenSSL is not implemented as a RoR web application with REST-API and Cucumber tests in a TDD way so that Johnny Webmonkey can easily contribute. I always assumed it had to do with portability and performance.

obsurveyor 13y ago

> How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things. Developers are quite willing and able to do this all on their own. Feature/scope creep is pretty horrible these days.

pvnick 13y ago

I'm watching this right now, it's brilliant! This is exactly the kind of stuff I love to think about, but PHK has done a wonderful job thinking it out to a lot of detail. I suggest everyone drop what you're doing and watch it asap. It's exciting and really holds your interest.

ableal 13y ago
I did watch, thanks, but anyone in a hurry can get just the slides here: http://phk.freebsd.dk/_downloads/FOSDEM_2014.pdf http://phk.freebsd.dk/_downloads/FOSDEM_2014.pdf I particularly appreciated the "QUEEN success example: SSC" (self-signed certificates, starts at slide 23), which also got a good laugh from the audience ... (if you're just watching the video, this is the text of the second slide in the PDF, not shown at FOSDEM: """ What is this ? This is a ficticious NSA briefing I gave as the closing keynote at FOSDEM 2014 The intent was to make people laugh and think, but I challenge anybody to prove it untrue. Playlist spoiler: Electric Light ORCHESTRA: Confusion ABBA: Money, Money, Money Backman Turner OVERDRIVE: Taking Care Of Business QUEEN: Bicycle Race Beastie BOYS: Sabotage PASADENA Roof Orchestra: Pennies From Heaven """ )

blazespin 13y ago

Reality is NSA has to do very very little to make this happen. Tiny nudges here and there. Profit motive encourages people to move towards complexity. Simple software commodifies too quickly.

jroes 13y ago

Here's an interesting thought. The NSA isn't the only entity who could stand to benefit from a privately held exploit to most SSL implementations. The NSA is also not the only group who could actually accomplish this. Who's to say there aren't groups out there that are doing this already to steal and profit from corporate information, credit cards, etc.?

headShrinker 13y ago

Sorry to introduce the hyperbole, or not moderate it. When the government runs a campaign to cause the public to fear and doubt your neighbor that is the beginning of a dark time ahead. This idea that they are one of you, or someone on reddit is just poison. On an emotional level, more and more Edward Showden is becoming a mystical figure.