171–180 of 192 posts
Earlier quoted context omitted.
>>That doesn't have to entail turning the world over to Russian and Chinese hackers. Boogey man FUD, I'm not worried about any hackers from [Insert_forgein_country_elites_want_you_to_hate]. The USgov, NSA and corrupt law enforcement are the only terrorists I'm worried about.
Pretty interesting statement. Why? Nations have track records of not killing/spying on each others?
Earlier quoted context omitted.
One of the claimed advantages of open source is to produce higher quality, more secure software. "As a result, the open source model builds higher-quality, more secure, more easily integrated software. And it does it at a vastly accelerated pace, often at a lower cost." - http://www.redhat.com/about/whoisredhat/opensource.html for example. As an ideology, comparing this OpenSSL happening to the stated goals of strong…
This might seem like a nitpick, but I think you're confusing two distinct camps here: let's call them "Open Source" and "Free Software". Open Source advocates -- such as Eric S. Raymond -- believe that it is superior on technical grounds, the "many eyes make all bugs shallow" theory. They tend to disregard ideology and instead believe OS is the rational decision of those who want technically better software. In my op…
They tend to disregard ideology and instead believe OS is the rational decision of those who want technically better software.
If ESR is writing software in the way he thinks results in better software ... how come I know who he is? Because he's not doing that, he's doing more than that.
I don't know if he prefers working in the mornings or evenings. I don't know how he backs up his work. I don't know whether he prefers a laptop screen or an external display or who he trusts to contribute to it - presumably he made rational decisions there for the benefit of his software, and didn't feel the need to tell the world all about it.
Yet when it comes to open source, he does more than "choose the best option for his software and use it", he also: spreads the word, advocates for it, tries to convince others. Wikipedia says "Raymond was for a number of years frequently quoted as an unofficial spokesman for the open source movement."
By contrast, there is no comparable "closed source movement" which organizes conferences and runs websites and talks to journalists and advocates in favour of closed-source development because it makes software better. There's no popular closed-source unofficial spokesperson I can point to whom you recognise.
I argue that people pushing "open source produces better code" are making that an ideology of its own, separate from anything to do with Stallman and 'free as in speech'.
And it's that ideology of 'Open Source leads to technically better software' which Heartbleed is showing up as weak and oversold. You agree that it's "not always true". My point is that Open Source proponents make it seem like should be "always true", like there's a very strong case for it. And I say that Heartbleed shows there isn't.
'Everyone' knows about bounds checking in C. Everyone knows about not trusting input from a remote machine without verifying it. Everyone knows about being extra tip-toe careful around cryptography software because it's high importance and brittle. What did OpenSSL do about it? Nothing.
Almost as if Open Source made no difference at all, and what matters about developing trustworthy software is people, welcoming communities, a thousand cultural decisions setting and holding patterns of procedures to systematically catch common errors in C, common errors in network code, common errors in security, common errors in memory managment, add regression tests, encourage documentation, add compliance tests, etc. etc.
Open source does not automatically lead to better software.
And many people strongly imply that it does, automagically, lead to better software.
(The fact that OpenSSL still became popular and widely used despite being a mess is if anything a win for 'free as in speech' - anyone can do any due diligence they want on the OpenSSL code, make their decision to use it for any project, fork and patch and modify it as they go. On that front it's a massive win for that ideology).
Earlier quoted context omitted.
One of the claimed advantages of open source is to produce higher quality, more secure software. "As a result, the open source model builds higher-quality, more secure, more easily integrated software. And it does it at a vastly accelerated pace, often at a lower cost." - http://www.redhat.com/about/whoisredhat/opensource.html for example. As an ideology, comparing this OpenSSL happening to the stated goals of strong…
This might seem like a nitpick, but I think you're confusing two distinct camps here: let's call them "Open Source" and "Free Software". Open Source advocates -- such as Eric S. Raymond -- believe that it is superior on technical grounds, the "many eyes make all bugs shallow" theory. They tend to disregard ideology and instead believe OS is the rational decision of those who want technically better software. In my op…
I never meant to imply paid researchers should not work on it. What I meant is:
The whole world can see every line of code in Linux. This is one of the reasons Linux is more secure than other operating systems and why open-source software overall is a safer than closed software. The transparency of the code ensures it’s secure. - Linux Foundation executive director Jim Zemlin
http://venturebeat.com/2013/11/26/linux-chief-open-source-is...
What happened in the case of Heartbleed? The security flaw was found by paying someone to work on the security.
I meant to mock this: The transparency of the code ensures it’s secure., mocking it by noting that nobody cared to look for or fix that bug because OpenSSL was important, because it was widely used, because it was interesting, because it was open source, because it was a puzzle, just for something to do one rainy day. Only when someone was paid to do it did it get done. Therefore the "open source is more secure" claim is a nonsense.
It's more secure because someone was paid to work on it. The claim that "open source did it" is snake oil.
Earlier quoted context omitted.
What about the relative ease and speed with which the bug was fixed? Fuzz testing could certainly find the bug in closed source software, but patching it is a different story, especially if the person or group that controls the source code is slow, uncooperative, or extinct.
However, the software being open source aided those who may have rushed out to take advantage of still-vulnerable systems. It's a mixed bag both ways, lets not put blinders on for ideological reasons.
Earlier quoted context omitted.
Even n00bs understand that if their email gets jacked, that can be used to reset all their other passwords and jack those accounts.
I'm not so sure, I know plenty of people who don't realize that until it's pointed out to them. Even then, many don't even care ("I don't have anything important anyways...").
"Why would anybody do that?" For the lulz ("random acts of malice"), sadly.
Earlier quoted context omitted.
So we should just blindly trust an agency that has repeatedly been shown to have abused that very trust for self-serving and hypocritical ends?
All governments are hypocritical. We have nukes, but you can't have them; we can spy on you, but don't spy on us; etc. It's the nature of self-interest.
Earlier quoted context omitted.
The worst problem with the NSA knowing about Heartbleed is the total lack of accountability. If I were any US-based company CEO whose customers got hacked by Heartbleed exploits, I'd drag their corpses to the court if necessary. Sidenote: People have asked "Why are you doing JS-based cryptography on passwords if you have HTTPS?" - here we have the ideal answer. Encrypting the passwords using public-key crypto in addi…
It wasn't traffic that was revealed, it was server memory . Which could just have easily contained the decrypted passwords as the encrypted ones.
This looks like another case where the actions of the NSA are the opposite of what's in the best interest of US Citizens.
Are there any cases where the actions of the NSA are in any way beneficial to US citizens? Can they show that they have ever done anything positive at all? Have they saved a single life? Stopped a single threat? Or are they too busy jerking it to sexting pics and playing WoW (seriously? Come on, guys) to actually do anything useful with the BILLIONS of dollars of money that they get to play with?
Anyway lets skip the banal "intelligence agencies failures are public and the successes are private" and get to actual examples:
DES SBoxes
SELinux
NSA Academic Centers of Excellence
VENONA
Earlier quoted context omitted.
I don't see how that protects the people whose data was stolen. "Here's the license plate number and home address of the guy who just ran over your grandma. Sorry for your loss."
It limits the corporate risks: they know exactly which passwords to change, accounts to lock, and other data loss to ameliorate. And if the time window of exploitation is kept small, the exact same magnitude of data loss could have happened in a rapid-disclosure and patch scenario. (Two years ago, were practices for rapid response better or worse than now? Would the time window of public-knowledge-but-incomplete-prot…
This whole things just sucks.
Earlier quoted context omitted.
The NSA has done a lot of beneficial things, such as helping design more secure crypto primitives (e.g. strengthening DES against differential cryptanalysis, fixing SHA-0 to produce SHA-1) and helping build secure software (e.g. SE Linux). I assume what you really mean is whether their dragnet surveillance in particular is ever beneficial to US citizens, and that certainly seems to be a "no".
Why should we assume that SELinux is secure? I would suspect that if there was NSA involvement then it is necessarily less secure because they would want to be able to access it at will.