5 ms·

So RMS was right after all, OpenSource gives you visible security where proprietary products are encumbered with all sorts of unwated and even dangerous "featur

So RMS was right after all, OpenSource gives you visible security where proprietary products are encumbered with all sorts of unwated and even dangerous "features". my 2c

scott_karana 12y ago
Open-source designs (for software or hardware) aren't a complete solution. You need to regularly audit the end-result, lest the compiler/fab add unwanted nasties to your design.
- api 12y ago
  Nobody has time to do that. Ultimately you have to trust someone, thus this is more a political problem than a technical one.
  - dllthomas 12y ago
    You have to trust someone, but we can move in either direction along the spectrum from "I have to trust all of these many people and if any of them is untrustworthy I'm boned" to "I have to trust some of these many people and if all of them are untrustworthy I'm boned". There are both technological and political elements to any solution here.
- lazyjones 12y ago
  We might want to move to mostly FPGA-based or similar reconfigurable systems, where what we perceive as hardware is more easily audited. OR we might want to go back to shopping anonymously "offline", hoping that the NSA will not bother backdooring every device on the market.
  - captainmojo 12y ago
    https://news.ycombinator.com/item?id=6350906 https://news.ycombinator.com/item?id=6350906
  - bri3d 12y ago
    What bitstream is the FPGA currently configured with? The one in flash? Really? What's to say the bitstream made it to the FPGA correctly? Can you tell? What if it reconfigured itself [1]? There's some research [2] into using authenticated, encrypted bitstreams, but even if the implementation matches the theory (and after all, it's crypto, we know how that goes...) this only reaches the same level of security as a fixed-configuration ASIC, since FPGAs are vulnerable to the same nefarious fab attacks as ASICs. 1: http://www.cmpe.boun.edu.tr/caslab/publications/selfreconf_final.pdf http://www.cmpe.boun.edu.tr/caslab/publications/selfreconf_f... 2: http://www.saardrimer.com/sd410/papers/bsauth.pdf http://www.saardrimer.com/sd410/papers/bsauth.pdf
    - makomk 12y ago
      FPGA bitstreams are big, sometimes even big enough that you couldn't fit another bitstream in hardware anywhere. What's more, making even a small change to the bitstream and re-synthesising tends to completely change how the design is laid out in hardware - so launching an attack that targets a specific bitstream, like most of the obvious nefarious-fab attacks, isn't much good.
- gss44 12y ago
  Regularly? Almost any major software/hardware project changes iteratively over time. You just have to audit the changes between major releases, which for firmware, are typically very irregular. Also, just transitioning to a more open process with an open codebase has the effect of "keeping them honest". Once the code is out there, they have no way of knowing who might be scrutinizing it and have no chance to retroactively cover something up. This is why it's such a big deal when companies make a commitment to openness (the real kind -- not the buzzword kind). It's a statement of being willing to forego most of the dirty tactics that being closed source allows and to playing a fair(er) game.
- superuser2 12y ago
  This doesn't do anything. NSA is intercepting specific shipments. Unless you happen to be a target of the same program, what you're auditing is not the same as what the target received.
themodelplumber 12y ago
Yeah, but you'd presumably need to have open source hardware shipped to you, right? And then you'd still need to inspect the hardware / software as shipped, right? RMS was right about a lot of things, but remember that his most important ideas are still waiting on lots of other things to happen first before they become practical.
- timtadh 12y ago
  Not perfect but the alix boards[1] ship with a full board schematic. They also ship with the source code for the bios and some information that would help you write your own. All the major open source router projects work on them. 6f2 even supports 3g modems so you can multi-home your connection. I know it is not perfect (you still have to trust the AMD chips and so forth) but it seems a lot better than just buying a linksys and hoping it works with OpenWRT. [1] http://pcengines.ch/alix.htm http://pcengines.ch/alix.htm
  - javert 12y ago
    Do we even need to trust a router? Seems better to just use encryption for everything and trust nothing in the middle, only the endpoints. Serious question.
    - tptacek 12y ago
      It's a good question, but also a begging question. On the one hand, yes: keeping security out of the middle of the network and pushing it to the endpoints is something that The End To End Argument In System Design predicted several decades ago, and is (to my eyes) clearly the right design principle for this problem. On the other hand, the endpoints doing the encryption are also going to be COTS equipment sourced from major industrial centers and acquired at a scale that probably precludes individual hardware verification, at least at the price point that enables their widespread deployment today.
    - dekhn 12y ago
      You have to trust that router delivers your packet to an endpoint. Encryption doesn't prevent that. And unless you're delivering extra packets to mask your control packets, it's trivial for the router to make drop decisions on packet flow data.
wes-exp 12y ago
Wouldn't it be even easier to tamper with open source devices? Since one essence of open source is that it is modifiable?
- blhack 12y ago
  Not unless you are only downloading pre-compiled binaries. Some linux distributions, for instance, try very hard to only every download source from the internet, and compile it locally. This is very slow (some things can take a very long time to compile). Gentoo is one such distribution.
  - PeterisP 12y ago
    What downloaded binaries? The question was, is it really useful to have the source and schematics for the chips on your hardware, if NSA (as described in the article) is modifying the hardware during shipping, so you don't really know if the chip you have does what it's supposed to. Hardware based rootkits can do pretty much everything to an OS running on that, and be undetectable from that OS.
bowlofpetunias 12y ago
RMS is (almost) always right. Just not always particularly pragmatic. Or agreeable.
- davidgerard 12y ago
  His track record of rightness is what pisses off his detractors most.
  - psykovsky 12y ago
    His track record of rightness is what attracts his supporters most.
- gss44 12y ago
  Being idealistic doesn't at all detract from the real practical progress that he and the FSF have made in the past 20+ years. He knows exactly what he's doing when he takes a hard line. Being weak-spirited and compromising isn't a very good way to get noticed.
- Crito 12y ago
  RMS reminds me of Ignaz Semmelweis. He is correct, but people stick their fingers in their ears and try to reject what he is saying because of how he delivers his message and because they are not comfortable with the implications of what he is saying.
mindslight 12y ago
Open source is not the whole story either. A decade ago I felt pretty smug with GNU/Linux; these days it has become such a large target that you can no longer ignore the countless non-open components in every system. And with things like heartbleed it's not clear that we're even defended against stochastic attackers, never mind intelligent ones. (apologies for beating the freshest dead horse) The topic keeps coming up from time to time to time, since it's not a straightforward thing to fix, but only manifests itself with publicity. I've written a few comments before as to what I see are some of ultimate contours: https://news.ycombinator.com/item?id=3658800 https://news.ycombinator.com/item?id=3658800 https://news.ycombinator.com/item?id=3658888 https://news.ycombinator.com/item?id=3658888 https://news.ycombinator.com/item?id=6149345 https://news.ycombinator.com/item?id=6149345
- RachelF 12y ago
  Open source depends on someone looking at the code. If Heartbleed proved anything, it is that most open source projects are pretty thinly funded and manned, and very few users ever bother to look at the source.
  - dredmorbius 12y ago
    Also those which have broken architecture and bad attitudes toward end-users. OpenSSL fits this label, but so do KDE and GNOME, IMO. Systemd as well, among the reasons I regard it so critically.
jrochkind1 12y ago
The NSA is intercepting shipments of routers, and installing their own... stuff in them. I don't know if the stuff is hardware or just software/firmware. How would 'open source' protect you from this? If the 'stuff' is firmware, then reflashing your own firmware after you get the device would protect you from it, but it doesn't particularly matter if the firmware you flash is open source or not. If the 'stuff' is hardware, then only someone inspecting the insides who's qualified to detect such hardware would protect you, and it's still got not much to do with open source.

So RMS was right after all, OpenSource gives you visible security where proprietary products are encumbered with all sorts of unwated and even dangerous "features". my 2c

scott_karana 12y ago

Open-source designs (for software or hardware) aren't a complete solution. You need to regularly audit the end-result, lest the compiler/fab add unwanted nasties to your design.

api 12y ago
Nobody has time to do that. Ultimately you have to trust someone, thus this is more a political problem than a technical one.
- dllthomas 12y ago
  You have to trust someone, but we can move in either direction along the spectrum from "I have to trust all of these many people and if any of them is untrustworthy I'm boned" to "I have to trust some of these many people and if all of them are untrustworthy I'm boned". There are both technological and political elements to any solution here.
lazyjones 12y ago
We might want to move to mostly FPGA-based or similar reconfigurable systems, where what we perceive as hardware is more easily audited. OR we might want to go back to shopping anonymously "offline", hoping that the NSA will not bother backdooring every device on the market.
- captainmojo 12y ago
  https://news.ycombinator.com/item?id=6350906 https://news.ycombinator.com/item?id=6350906
- bri3d 12y ago
  What bitstream is the FPGA currently configured with? The one in flash? Really? What's to say the bitstream made it to the FPGA correctly? Can you tell? What if it reconfigured itself [1]? There's some research [2] into using authenticated, encrypted bitstreams, but even if the implementation matches the theory (and after all, it's crypto, we know how that goes...) this only reaches the same level of security as a fixed-configuration ASIC, since FPGAs are vulnerable to the same nefarious fab attacks as ASICs. 1: http://www.cmpe.boun.edu.tr/caslab/publications/selfreconf_final.pdf http://www.cmpe.boun.edu.tr/caslab/publications/selfreconf_f... 2: http://www.saardrimer.com/sd410/papers/bsauth.pdf http://www.saardrimer.com/sd410/papers/bsauth.pdf
  - makomk 12y ago
    FPGA bitstreams are big, sometimes even big enough that you couldn't fit another bitstream in hardware anywhere. What's more, making even a small change to the bitstream and re-synthesising tends to completely change how the design is laid out in hardware - so launching an attack that targets a specific bitstream, like most of the obvious nefarious-fab attacks, isn't much good.
gss44 12y ago
Regularly? Almost any major software/hardware project changes iteratively over time. You just have to audit the changes between major releases, which for firmware, are typically very irregular. Also, just transitioning to a more open process with an open codebase has the effect of "keeping them honest". Once the code is out there, they have no way of knowing who might be scrutinizing it and have no chance to retroactively cover something up. This is why it's such a big deal when companies make a commitment to openness (the real kind -- not the buzzword kind). It's a statement of being willing to forego most of the dirty tactics that being closed source allows and to playing a fair(er) game.
superuser2 12y ago
This doesn't do anything. NSA is intercepting specific shipments. Unless you happen to be a target of the same program, what you're auditing is not the same as what the target received.

themodelplumber 12y ago

Yeah, but you'd presumably need to have open source hardware shipped to you, right? And then you'd still need to inspect the hardware / software as shipped, right? RMS was right about a lot of things, but remember that his most important ideas are still waiting on lots of other things to happen first before they become practical.

timtadh 12y ago
Not perfect but the alix boards[1] ship with a full board schematic. They also ship with the source code for the bios and some information that would help you write your own. All the major open source router projects work on them. 6f2 even supports 3g modems so you can multi-home your connection. I know it is not perfect (you still have to trust the AMD chips and so forth) but it seems a lot better than just buying a linksys and hoping it works with OpenWRT. [1] http://pcengines.ch/alix.htm http://pcengines.ch/alix.htm
- javert 12y ago
  Do we even need to trust a router? Seems better to just use encryption for everything and trust nothing in the middle, only the endpoints. Serious question.
  - tptacek 12y ago
    It's a good question, but also a begging question. On the one hand, yes: keeping security out of the middle of the network and pushing it to the endpoints is something that The End To End Argument In System Design predicted several decades ago, and is (to my eyes) clearly the right design principle for this problem. On the other hand, the endpoints doing the encryption are also going to be COTS equipment sourced from major industrial centers and acquired at a scale that probably precludes individual hardware verification, at least at the price point that enables their widespread deployment today.
  - dekhn 12y ago
    You have to trust that router delivers your packet to an endpoint. Encryption doesn't prevent that. And unless you're delivering extra packets to mask your control packets, it's trivial for the router to make drop decisions on packet flow data.

wes-exp 12y ago

Wouldn't it be even easier to tamper with open source devices? Since one essence of open source is that it is modifiable?

blhack 12y ago
Not unless you are only downloading pre-compiled binaries. Some linux distributions, for instance, try very hard to only every download source from the internet, and compile it locally. This is very slow (some things can take a very long time to compile). Gentoo is one such distribution.
- PeterisP 12y ago
  What downloaded binaries? The question was, is it really useful to have the source and schematics for the chips on your hardware, if NSA (as described in the article) is modifying the hardware during shipping, so you don't really know if the chip you have does what it's supposed to. Hardware based rootkits can do pretty much everything to an OS running on that, and be undetectable from that OS.

bowlofpetunias 12y ago

RMS is (almost) always right. Just not always particularly pragmatic. Or agreeable.

davidgerard 12y ago
His track record of rightness is what pisses off his detractors most.
- psykovsky 12y ago
  His track record of rightness is what attracts his supporters most.
gss44 12y ago
Being idealistic doesn't at all detract from the real practical progress that he and the FSF have made in the past 20+ years. He knows exactly what he's doing when he takes a hard line. Being weak-spirited and compromising isn't a very good way to get noticed.
Crito 12y ago
RMS reminds me of Ignaz Semmelweis. He is correct, but people stick their fingers in their ears and try to reject what he is saying because of how he delivers his message and because they are not comfortable with the implications of what he is saying.

mindslight 12y ago

Open source is not the whole story either. A decade ago I felt pretty smug with GNU/Linux; these days it has become such a large target that you can no longer ignore the countless non-open components in every system. And with things like heartbleed it's not clear that we're even defended against stochastic attackers, never mind intelligent ones. (apologies for beating the freshest dead horse) The topic keeps coming up from time to time to time, since it's not a straightforward thing to fix, but only manifests itself with publicity. I've written a few comments before as to what I see are some of ultimate contours: https://news.ycombinator.com/item?id=3658800 https://news.ycombinator.com/item?id=3658800 https://news.ycombinator.com/item?id=3658888 https://news.ycombinator.com/item?id=3658888 https://news.ycombinator.com/item?id=6149345 https://news.ycombinator.com/item?id=6149345

RachelF 12y ago
Open source depends on someone looking at the code. If Heartbleed proved anything, it is that most open source projects are pretty thinly funded and manned, and very few users ever bother to look at the source.
- dredmorbius 12y ago
  Also those which have broken architecture and bad attitudes toward end-users. OpenSSL fits this label, but so do KDE and GNOME, IMO. Systemd as well, among the reasons I regard it so critically.

jrochkind1 12y ago

The NSA is intercepting shipments of routers, and installing their own... stuff in them. I don't know if the stuff is hardware or just software/firmware. How would 'open source' protect you from this? If the 'stuff' is firmware, then reflashing your own firmware after you get the device would protect you from it, but it doesn't particularly matter if the firmware you flash is open source or not. If the 'stuff' is hardware, then only someone inspecting the insides who's qualified to detect such hardware would protect you, and it's still got not much to do with open source.