4 ms·

If you use Linux, both issues are pretty much sorted. Repositories provide a great way to install trusted software, if you're careful about which repositories y

If you use Linux, both issues are pretty much sorted. Repositories provide a great way to install trusted software, if you're careful about which repositories you install on your system.

andrewstuart2 11y ago
Well, the issue of "nobody checks the source" is not necessarily solved. Just because anyone can check the source doesn't mean anyone actually does. Additionally, just because a repository has been historically trustworthy never means it can't be corrupted. There are real people behind all levels of these projects, and people are vulnerable to corruption, coercion, etc.
- e12e 11y ago
  True. But with signed source (if you can trust the verifier... turtles all the way down) and projects for reproducible builds, like[1] -- the job of checking can be distributed, and you can trust several different parties to do part of the work. Now, I still think it makes sense to single out the opaque-ness of CA trust. The Raison-de-etre for the whole CA system is trust, more specifically delegating trust. It provides nothing else. Which is why it's so ridiculous that by default the browsers will trust the Chinese and German governments to vouch for Swiss banks, American companies to vouch for wikileaks -- even if the Swiss banks or Wikileaks don't trust those entities. [1] https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds
- nickpsecurity 11y ago
  Exactly. I'll add that we keep seeing obvious vulnerabilities in open source code that go back years. Hence my essay on different types of Source Sharing and Review that shows the actual assurance is in the review not source sharing agreement. Hard to assess how much review any given FOSS got and obviously harder for most proprietary. Sometimes impossible for both. https://www.schneier.com/blog/archives/2014/05/friday_squid_bl_424.html#c6051639 https://www.schneier.com/blog/archives/2014/05/friday_squid_...
  - walterbell 11y ago
    Tangent: is there an easy way to find/download all the comments you have posted to Schneier's blog? They would be more accessible in a github Jekyll repo, or any source format which could be converted to a single PDF for offline reading.
    - nickpsecurity 11y ago
      Haven't gotten around to doing that since I've been so busy past few years and... the posts added up to a lot of work. Call it my technical debt. ;) Hadn't thought of PDF. Nice idea. Right now I have two things: textfile with links to many key posts there with headings; a zip file with a good chunk of those in local text copies. I've always used text because it's the safest and most portable format (except on modern devices lol). I can give you a pastebin with the links or a link to the zip with containing the subset I've downloaded so far. Whatever you prefer. Eventually I'll have one link to an actual web site haha.
      - walterbell 11y ago
        Zip of local text copies would be great, thanks!
        nickpsecurity 11y ago
        Below is the link to the zip. I included the two indexes that have the links. Most designs are local already but the essays folder has only a tiny amount of my essays. So, look at the essays txt file because there's quite a few great ones (including OPSEC) that I haven't transcribed yet. Download it quick because I take it down in a few days. http://www.adrive.com/public/uxCBKn/select%20schneier%20posts.zip http://www.adrive.com/public/uxCBKn/select%20schneier%20post...
        walterbell 11y ago
        Got it, thanks very much for uploading. I discovered some of your security essays a few months ago but couldn't find a way to search by poster name on the Schneier blog.
- jessaustin 11y ago
  If you don't want to trust the Debian maintainers, you don't have to. Trusting them, however, is a valid decision for many people.
rtpg 11y ago
so the trust is in Debian or whoever's running your repos instead of MSFT. I don't see how that really changes the dynamic a lot. The problem with most people's complaints and solutions about certificate authorities is that pretty much every proposed solution, when applied at scale, becomes functionally equivalent to the web of trust system we currently have. At one point you have to trust _somebody_.

If you use Linux, both issues are pretty much sorted. Repositories provide a great way to install trusted software, if you're careful about which repositories you install on your system.

andrewstuart2 11y ago

Well, the issue of "nobody checks the source" is not necessarily solved. Just because anyone can check the source doesn't mean anyone actually does. Additionally, just because a repository has been historically trustworthy never means it can't be corrupted. There are real people behind all levels of these projects, and people are vulnerable to corruption, coercion, etc.

e12e 11y ago
True. But with signed source (if you can trust the verifier... turtles all the way down) and projects for reproducible builds, like[1] -- the job of checking can be distributed, and you can trust several different parties to do part of the work. Now, I still think it makes sense to single out the opaque-ness of CA trust. The Raison-de-etre for the whole CA system is trust, more specifically delegating trust. It provides nothing else. Which is why it's so ridiculous that by default the browsers will trust the Chinese and German governments to vouch for Swiss banks, American companies to vouch for wikileaks -- even if the Swiss banks or Wikileaks don't trust those entities. [1] https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds
nickpsecurity 11y ago
Exactly. I'll add that we keep seeing obvious vulnerabilities in open source code that go back years. Hence my essay on different types of Source Sharing and Review that shows the actual assurance is in the review not source sharing agreement. Hard to assess how much review any given FOSS got and obviously harder for most proprietary. Sometimes impossible for both. https://www.schneier.com/blog/archives/2014/05/friday_squid_bl_424.html#c6051639 https://www.schneier.com/blog/archives/2014/05/friday_squid_...
- walterbell 11y ago
  Tangent: is there an easy way to find/download all the comments you have posted to Schneier's blog? They would be more accessible in a github Jekyll repo, or any source format which could be converted to a single PDF for offline reading.
  - nickpsecurity 11y ago
    Haven't gotten around to doing that since I've been so busy past few years and... the posts added up to a lot of work. Call it my technical debt. ;) Hadn't thought of PDF. Nice idea. Right now I have two things: textfile with links to many key posts there with headings; a zip file with a good chunk of those in local text copies. I've always used text because it's the safest and most portable format (except on modern devices lol). I can give you a pastebin with the links or a link to the zip with containing the subset I've downloaded so far. Whatever you prefer. Eventually I'll have one link to an actual web site haha.
    - walterbell 11y ago
      Zip of local text copies would be great, thanks!
      - nickpsecurity 11y ago
        Below is the link to the zip. I included the two indexes that have the links. Most designs are local already but the essays folder has only a tiny amount of my essays. So, look at the essays txt file because there's quite a few great ones (including OPSEC) that I haven't transcribed yet. Download it quick because I take it down in a few days. http://www.adrive.com/public/uxCBKn/select%20schneier%20posts.zip http://www.adrive.com/public/uxCBKn/select%20schneier%20post...
        walterbell 11y ago
        Got it, thanks very much for uploading. I discovered some of your security essays a few months ago but couldn't find a way to search by poster name on the Schneier blog.
jessaustin 11y ago
If you don't want to trust the Debian maintainers, you don't have to. Trusting them, however, is a valid decision for many people.

rtpg 11y ago

so the trust is in Debian or whoever's running your repos instead of MSFT. I don't see how that really changes the dynamic a lot. The problem with most people's complaints and solutions about certificate authorities is that pretty much every proposed solution, when applied at scale, becomes functionally equivalent to the web of trust system we currently have. At one point you have to trust _somebody_.