3 ms·
Julian Assange: Debian Is Owned By The NSA
- rainmaking 13y agoI missed a coherent logical thread to follow in this article.
- jmillikin 13y agoI wouldn't say you "missed" it, Bob.
- 001sky 13y agohttps://news.ycombinator.com/item?id=7565195#up_7565557 https://news.ycombinator.com/item?id=7565195#up_7565557 Already discussed + Killed
- deleted 13y ago[deleted]
- coldtea 13y agoLet me help you, it's the idea that paid contractors working for the military/agencies are fucking up Open Source code to get their backdoors in.
- lamby 13y ago> which was clearly sabotaged – a known fact Tell me more.
- hga 13y agoNo, not at all, it's an inevitable result of Debian's conceit of "fixing" upstream source trees. An ... I hesitate to call him an engineer ... used one of the standard lint tools or GCC or whatever on OpenSSL I think it was, and noticed the use of an uninitialized variable. This was deliberate, it was added to the entropy the program was using; might not be too random, but "it couldn't hurt". So he communicated with them, and they told him it was OK to eliminate it. Without further talking to them, he also eliminated akin bit where the serious entropy was added, so for years Debian generated trivially breakable keys. It'll be a while before anyone can judge if this or "Heartbleed" is the worse open-source security screwup, but until the latter just developed I certainly rated it as #1. However this is the first time I've heard it alleged it was sabotage; it could have been, disguised as stupidity, but that it was "clearly sabotaged – a known fact" is utterly false at this time.
- jlgaddis 13y agoFlagging this because of the rampant speculation and conspiracy theories disguised as "known fact".