4 ms·
Hahaha, distrust goes both ways though! Suppose you're trying to coerce people into using this browser knowing that you've (NSA) already snuck in some backdoors
by socceroos 11y ago
Hahaha, distrust goes both ways though! Suppose you're trying to coerce people into using this browser knowing that you've (NSA) already snuck in some backdoors?
They used to say that you have to trust the compiler. But not even that is true these days. Perhaps you've read about the secret hdd partitions that the NSA were using.
These days it goes like this: open-source hardware, open-source firmware, open-source compiler, open-source software.
Only when an entity can follow this path to build their own trusted stack can we begin to move with high confidence.
- bigiain 11y agoEven open source hardware isn't sufficient against an attacker as seriously resource rich (both cash and technical ability-wise) as the NSA. You can't trust the supply chain any more, you can't even trust the silicon unless you made it (and all the machines you used to make it) yourself. Are you _sure_ that network chip, usb controller, or flash ram you built your open source hardware out of isn't exploited? If you're on the fence about whether you're "too paranoid" or "not paranoid enough", make sure you've read what some people do for free, just for fun/curiosity/geek-cred/reputation: http://travisgoodspeed.blogspot.com.au/2012/07/emulating-usb-devices-with-python.html http://travisgoodspeed.blogspot.com.au/2012/07/emulating-usb... http://www.bunniestudios.com/blog/?p=3554 http://www.bunniestudios.com/blog/?p=3554 Then imagine what their grey-suited counterparts on 200K salaries at the NSA with (for all intents and purposes) unlimited research budgets might be up to.
- socceroos 11y agoI wholeheartedly agree, but that is what I meant by 'own trusted stack'. From the ground up (literally), you have to control each part of the process.