AFAIK, if you control the layer 1 fiber lines, it doesn't matter the OS, the vendor or the application in question. NSA will intercept your data while on transit. Of course, if you can have DLLs packaging everything the way you like, appending the right file extensions and cleaning all the metadata... that's more than welcome.
Why We Can No Longer Trust Microsoft
191–200 of 310 posts
Re: Why We Can No Longer Trust Microsoft
#192Question: when did we start trusting MS that we now can no longer?
Re: Why We Can No Longer Trust Microsoft
#193Earlier quoted context omitted.
As long as you also "boycott the hell" out of: Yahoo Google Facebook PalTalk YouTube Skype AOL Apple Who have also been mentioned as complicit in this whole scandal. Just to be fair :-) By the way, I actually agree with you and have been slowly switching all my home stuff to linux and trying to get away from Google Dependence (although I type this in Chrome on a Win 8 laptop... damn work computer)
What about ubuntu tracking/sending our info to Amazon? Which Linux distro would you recommend, that is easy to use, and not sell out it's users?
Slackware.
Re: Why We Can No Longer Trust Microsoft
#194Earlier quoted context omitted.
Mistrust of commercial solutions does not translate into trust for open-source ones. Have you audited the crypto code of all your packages? Would you even know how?
> Mistrust of commercial solutions does not translate into trust for open-source ones. Well, how well can you trust the commercial ones ? At least with open source, you can look into it more easily and eventually find security holes. It's a step towards trust. There is no trust to gain with commercial solutions, but at least with open source, it's at least possible. The fact that proprietary agrees with a sound marke…
how well can you trust the commercial ones ? At least with open source, you can look into it more easily and eventually find security holes. It's a step towards trust. There is no trust to gain with commercial solutions, but at least with open source, it's at least possible.
Ever heard of reverse engineering? It turns out you'd need even that approach even with open source as soon as you use binaries you haven't compiled yourself. And you'd have to verify the compiler and your disassembler that way too. It's all possible, but requires more than it's currently being done, at least on the level of the stuff openly available.
And even if you manage to verify everything you have to check the computer. Modern computers be it servers or notebooks start to have BIOS-es that can even phone home and allow remote access without your control (having the keys which you can't control!).
Re: Why We Can No Longer Trust Microsoft
#195GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…
There is always going to be an issue of trust at some point: the linux code base is public, but almost none of us compile linux and the packages we need to build a complete OS from source. We end-up getting pre-built packages from repositories that are often distributed all around the word.
How easy/hard would it be to compromise some packages or some repositories if you are determined enough?
You certainly could not compromise a base as large as the number of Windows users, but you could target your efforts on distributions that have key infrastructure roles, like servers, routers, firewalls...
Another vector used to compromise free software is to participate in it. Paid agents can actively participate in open source projects and allow clever exploits that could pass as bugs if uncovered.
Re: Why We Can No Longer Trust Microsoft
#196Earlier quoted context omitted.
Mistrust of commercial solutions does not translate into trust for open-source ones. Have you audited the crypto code of all your packages? Would you even know how?
There are many developers who like audit small pieces, and then share their findings.
Just believing "somebody would see it" is provably not enough.
http://www.schneier.com/blog/archives/2008/05/random_number_...
The bug was introduced in September 2006. Discovery published May 2008. Affected: the most popular Linux distribution, all the keys generated on it in that period. Scary.
Moreover, the bug was not found by reading the source code. The keys generated by all the existing system were analyzed. If I remember, only the keys generated by mentioned Linux distros stood out (and some hardware devices using customized firmware or poor implementations). Windows and OSX weren't there.
Re: Why We Can No Longer Trust Microsoft
#197Earlier quoted context omitted.
It's conjecture, but it's likely. Apple as a company has put a high value on user privacy, which was heavily influenced by Steve. He was also known for maintaining a high degree of personal privacy for such a public figure (for instance, refusing to put plates on his car).
I thought you were joking about the number plates thing, but it's true (and apparently legal) ... http://thenextweb.com/apple/2011/10/27/mystery-solved-why-st... This reminds me of a friend of mine who proxies all his web traffic through something which strips user agents and referrers. It's very easy for me to tell when he visits my website, because the logs show "-" for each of these fields.
> It's very easy for me to tell when he visits my website
Simply drawing attention to the fact that his attempt at anonymity acts a key personal identifier in this instance.
Re: Why We Can No Longer Trust Microsoft
#198Earlier quoted context omitted.
Windows natively has several data collecting operations on any machine with Windows installed. Each time you visting a page, IE sends the URL over to be "checked" by Microsoft. Each update, a summery of all installed packages are collected and sent to Microsoft in order to "improve the experience". WAT collects your hardware specification, including the serial number of your hard drive. Each time you connect your ope…
>Each time you visting a page, IE sends the URL over to be "checked" by Microsoft. Huh? Are you talking about hashes being sent for malware check similar to the ones in Chrome or Firefox? If not its a serious privacy issue. The ones you mentioned about Updates is also true for Chrome updates. [1] >Microsoft can forceable push new executable code as updates, regardless if settings has turn of updates. Any source on th…
(Sorry for the length, but its hard not to create very long question->answer replies in situations like this)
> Microsoft can forceable push new executable code as updates, regardless if settings has turn of updates. - Any source on this?
https://windowssecrets.com/top-story/microsoft-updates-windo... (its old yes, and was disputed as a "bug" by Microsoft. At the same time, no security expects has said that Microsoft did fix it. As such, I default to once burned, twice shy.).
>Each time you visting a page, IE sends the URL over to be "checked" by Microsoft. - Huh? Are you talking about hashes being sent for malware check
SmartScreen Filter and Suggested Sites (http://windows.microsoft.com/en-ca/internet-explorer/ie10-wi...). Both can be turned off, and I don't know what is default. My default assumption is that both is on (or checked in wizard) by default.
>Then we have semi-native application such as massager or skype. Both has messages being "scanned". - Are you talking about URL scanning? So does FB, Gchat etc.
The OP talked about native MS apps as being risk free. Just because FB and Gchat also do bad thing, doesn't make someone else applications less risky to use.
Re: Why We Can No Longer Trust Microsoft
#199Earlier quoted context omitted.
I thought you were joking about the number plates thing, but it's true (and apparently legal) ... http://thenextweb.com/apple/2011/10/27/mystery-solved-why-st... This reminds me of a friend of mine who proxies all his web traffic through something which strips user agents and referrers. It's very easy for me to tell when he visits my website, because the logs show "-" for each of these fields.
How does your friend do that? I'd be really interested in reading on how to setup a proxy like that.
Burp, fiddler maybe, webscarab maybe. Some kind of proxy with any sort of meaningful capabilities.
Re: Why We Can No Longer Trust Microsoft
#200John Dvorak sounds like a tech version of those economic & political loudmouths that spread definitive and absolute truths with very little evidence (Rush Limbaugh, Bill O'Reilly, Ann Coulter). That's because their purpose is not to generate light but to generate heat; to cause controversy instead of inform. It is the journalism equivalent of the Rolling Stones and Madonna: scandal as a marketing tactic. These people…
Not all businesses are big corporations. There are a great number of small companies that can much more easily implement Linux for their employees to use. I think the point to be made here is that moving forward, (a) a lot of people can really do all of their computing on Linux now, and (b) an increasing amount of software is being written for the modern web so MS/IE lock-in is going away.