4 ms·
Well, the issue of "nobody checks the source" is not necessarily solved. Just because anyone can check the source doesn't mean anyone actually does. Additionall
by andrewstuart2 11y ago
Well, the issue of "nobody checks the source" is not necessarily solved. Just because anyone can check the source doesn't mean anyone actually does. Additionally, just because a repository has been historically trustworthy never means it can't be corrupted.
There are real people behind all levels of these projects, and people are vulnerable to corruption, coercion, etc.
- e12e 11y agoTrue. But with signed source (if you can trust the verifier... turtles all the way down) and projects for reproducible builds, like[1] -- the job of checking can be distributed, and you can trust several different parties to do part of the work. Now, I still think it makes sense to single out the opaque-ness of CA trust. The Raison-de-etre for the whole CA system is trust, more specifically delegating trust. It provides nothing else. Which is why it's so ridiculous that by default the browsers will trust the Chinese and German governments to vouch for Swiss banks, American companies to vouch for wikileaks -- even if the Swiss banks or Wikileaks don't trust those entities. [1] https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds
- nickpsecurity 11y agoExactly. I'll add that we keep seeing obvious vulnerabilities in open source code that go back years. Hence my essay on different types of Source Sharing and Review that shows the actual assurance is in the review not source sharing agreement. Hard to assess how much review any given FOSS got and obviously harder for most proprietary. Sometimes impossible for both. https://www.schneier.com/blog/archives/2014/05/friday_squid_bl_424.html#c6051639 https://www.schneier.com/blog/archives/2014/05/friday_squid_...
- walterbell 11y agoTangent: is there an easy way to find/download all the comments you have posted to Schneier's blog? They would be more accessible in a github Jekyll repo, or any source format which could be converted to a single PDF for offline reading.
- nickpsecurity 11y agoHaven't gotten around to doing that since I've been so busy past few years and... the posts added up to a lot of work. Call it my technical debt. ;) Hadn't thought of PDF. Nice idea. Right now I have two things: textfile with links to many key posts there with headings; a zip file with a good chunk of those in local text copies. I've always used text because it's the safest and most portable format (except on modern devices lol). I can give you a pastebin with the links or a link to the zip with containing the subset I've downloaded so far. Whatever you prefer. Eventually I'll have one link to an actual web site haha.
- walterbell 11y agoZip of local text copies would be great, thanks!
- nickpsecurity 11y agoBelow is the link to the zip. I included the two indexes that have the links. Most designs are local already but the essays folder has only a tiny amount of my essays. So, look at the essays txt file because there's quite a few great ones (including OPSEC) that I haven't transcribed yet. Download it quick because I take it down in a few days. http://www.adrive.com/public/uxCBKn/select%20schneier%20posts.zip http://www.adrive.com/public/uxCBKn/select%20schneier%20post...
- walterbell 11y agoGot it, thanks very much for uploading. I discovered some of your security essays a few months ago but couldn't find a way to search by poster name on the Schneier blog.
- nickpsecurity 11y agoIve posted too much for that to even help lol. But ill share some Google Fu to help you in future: site:schneier.com "nick p" First limits to domain. Using quotes limits to results containing that phrase. A -name removes results containing the name. Can use multiple quoted and minus terms. Main two tricks I use to get good results.
- jessaustin 11y agoIf you don't want to trust the Debian maintainers, you don't have to. Trusting them, however, is a valid decision for many people.