Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FSF responds to Microsoft's privacy and encryption announcement

fsf.org

Post reply on HN
Print view View original

41–50 of 69 posts

Re: FSF responds to Microsoft's privacy and encryption announcement

#41

Post by rbanffy »

DanBC wrote: post #20
electic wrote: post #19

Earlier quoted context omitted.

Unfortunately, those skilled people at MS have let the NSA in on so many 0-day exploits. God knows how many have not been reported to the public yet. At least with open source, I know there is a community behind it for me or others to verify. Sure it is not 100% fool proof, but it makes it far harder to sneak bad things through.

> Sure it is not 100% fool proof, but it makes it far harder to sneak bad things through. Debian SSL bug lasted 2 years. Open source means little for security.

> Debian SSL bug lasted 2 years. Open source means little for security.

How many examples can you come up with? Was this specific bug being actively exploited when it was discovered?

Re: FSF responds to Microsoft's privacy and encryption announcement

#43

Post by danbruc »

rbanffy wrote: post #38
danbruc wrote: post #21

Open/closed source software and secure/unsecure software are orthogonal concepts. Yes, it may be easier to assess open source software with regard to security and privacy issues, but it is absolutely not necessary. And even with open source software the overwhelming majority of users still has to trust some third party because it is absolutely unrealistic that every user or organization audits their complete software…

> Open/closed source software and secure/unsecure software are orthogonal concepts No, they are not. It's fundamentally impossible to secure proprietary software because you have to trust its provider the software does what it says it does whereas with open-source you can always check for yourself. Any backdoor in open-source software is there to be exposed and corrected. With proprietary software only one party can…

It is not impossible. There is no reason why closed source software can not be secure. Yes, you can not convince yourself in the same way you can with open source software but again secure software and the ability to convince yourself that a software is secure are different things.

Re: FSF responds to Microsoft's privacy and encryption announcement

#44

Post by drcube »

Sanddancer wrote: post #36
Sanddancer wrote: post #32

Earlier quoted context omitted.

More than just the NSA. This shrill hyperbole that permeates the free software world is counterproductive to getting things fixed.

Drcube: How do I know that open source developers aren't contractors out to put backdoors in? At some point you have to trust someone, and I doubt with all the eyes on windows, both within and without, that any extant backdoor would have remained hidden until now. There are quite a few people who do reverse engineer windows without a license, and would be shouting it from the rooftops if they found a backdoor.

> At some point you have to trust someone, and I doubt with all the eyes on windows, both within and without, that any extant backdoor would have remained hidden until now.

Right, but A) I like to choose who I trust. Get a second opinion. Verify a few things myself, if I feel I'm up to the task. I get none of these options with Windows.

B) If you doubt, with all the eyes on Windows, that a backdoor would have persisted, why do you act as if more eyes is not better? Or, perhaps more importantly, a greater variety of eyes?

Microsoft gets to pick who studies their code, and may or may not prevent them from revealing vulnerabilities and bugs anyway. Popular open source projects may get actively hostile researchers studying their code specifically to shout any bugs they find from the rooftops. Or they may get the world's foremost expert in some aspect of their code to study it for fun. And nobody can stop them from revealing anything the find.

If MS giving a few hand-picked organizations their source code under strict terms, who may or may not be allowed to report what they find honestly, is good, why wouldn't fully open software be better?

Nobody is saying that giving governments and a few organizations a look at the Windows source isn't better than having it completely locked down. But it just doesn't go far enough.

Re: FSF responds to Microsoft's privacy and encryption announcement

#45

Post by strlen »

jevinskie wrote: post #2

It seems like the response glosses over what Microsoft is actually doing and instead just attacks them for something unrelated (Widows is closed source). In the FSF eyes, Microsoft can do nothing to improve security until Windows is open sourced.

It is very much related: closed source software isn't audited in the open. Core principle of building secure software is one must assume that their adversary has the source code and is actively building newer and newer attacks based on it (corporate leaks happen all the time). It's not impossible to follow through with this principle when building closed source software, but it is a lot easier to handwave it.

I am not a fan of FSF's tone here, they could be more diplomatic -- but saying "we appreciate your effort, but you fail" would have been more insulting. I think there are many places for closed source software, but core privacy software is not one of those places.

The encryption core (the critical pieces that either input or output plain text -- the places where the attack is more likely to succeed as opposed to the core of the algorithms), as well and the general platform should have the source code available (even if at a fee). That's not quite the FSF vision, but perhaps the powerful vision is needed (one can think of FSF's goals as a captivating utopian story that leads to more incremental improvements).

Re: FSF responds to Microsoft's privacy and encryption announcement

#46

Post by kubiiii »

nivla wrote: post #8

huh? I know this isn't going to be the popular opinion but I have to get this off. As much as I respect FSF, this mentality is one of the things I dislike about them. Statements that imply either you are with us or you are evil, trying to crash at opening events of MS/Apple "saving" people from closed source etc. Not everything has to be open source and not everyone has to choose open source. Microsoft/Apple/Google m…

I think you are right. If microsoft comes out with some sort of license that ensure that they will protect our privacy (or allow us tu sue the hell out of them if they fail to do so) that would be a way to achieve this.

Re: FSF responds to Microsoft's privacy and encryption announcement

#47

Post by danbruc »

riquito wrote: post #24
obituary_latte wrote: post #14

Earlier quoted context omitted.

No, I did not say those things. That aside, if you wanted to, after an audit/review concluded, could you put a backdoor in your software? Since it's closed source, would anyone know about it?

There are these things called signed binaries...

But signing binaries does not prove from which source the binaries have been build, only who did it.

Re: FSF responds to Microsoft's privacy and encryption announcement

#48

Post by DanBC »

rbanffy wrote: post #41
DanBC wrote: post #20

Earlier quoted context omitted.

> Sure it is not 100% fool proof, but it makes it far harder to sneak bad things through. Debian SSL bug lasted 2 years. Open source means little for security.

> Debian SSL bug lasted 2 years. Open source means little for security. How many examples can you come up with? Was this specific bug being actively exploited when it was discovered?

> How many examples can you come up with?

A bug caused by prettying the code, which was secure from upstream, which is in an important, widely used, supposedly secure bit of code isn't a good enough example?

> Was this specific bug being actively exploited when it was discovered?

Many Linuxes used to ship with lots of services running. That lead to many rooted boxes being used to deliver spam. Open Source fixed the problem, but only after many millions of emails had been delivered.

Someone somewhere probably has a nice chart of all the Red Hat boxes in SKorea in the late 1990s early 2000s.

Again, this isn't to suggest that MS or Apple are more secure. For years anyone putting an MS server onto the Internet ran the risk of very quick exploitation.

Re: FSF responds to Microsoft's privacy and encryption announcement

#49

Post by danbruc »

rbanffy wrote: post #40
criley2 wrote: post #11

Earlier quoted context omitted.

So, Microsoft and its Windows product adheres to no industry standards, has no external audit process, has never been verified by a private or Government contract agency through audit or other verification process? I work in a small programming company and we do internal and external audits while maintaining compliancy with federal and state regulators as well as groups like ISO. Sure, our work is closed source, but…

> Sure, our work is closed source, but that doesn't automatically mean it hasn't been externally verified for a number of different things by a number of different organizations... Yes, but we have to take your word for it.

As mentioned below, a software being secure and the ability to convince yourself that a software is secure are two different things.

Re: FSF responds to Microsoft's privacy and encryption announcement

#50

Post by pessimizer »

TylerE wrote: post #39
davexunit wrote: post #15

Earlier quoted context omitted.

>As a developer, I find GPL to be against the "spirit of open source". It's not about open source. It's about free software. https://www.gnu.org/philosophy/open-source-misses-the-point....

Which is, urm, rather the point. Some of us care more about open source than free software.

Not the FSF. Have they ever given the impression that they care at all about open source except as a characteristic of Free software? I'm sure they didn't intend to.
Post reply on HN