There is always going to be an issue of trust at some point: the linux code base is public, but almost none of us compile linux and the packages we need to build a complete OS from source. We end-up getting pre-built packages from repositories that are often distributed all around the word. How easy/hard would it be to compromise some packages or some repositories if you are determined enough? You certainly could not…
This made me think of Ken Thompson's Turing Award Lecture: http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomps...
This. Even if you are 100% sure about the code, there is more than one way to subvert it.
I don't know enough about the details of the build dependencies for any of these projects to give exact steps. To get a known-clean build (that is, a build guaranteed to match the source) of GCC 4.8.1, plug the GCC 4.8.1 into the procedure I gave above: In case it wasn't clear, k is used for indexing, and I use "function application" f(x) to mean compilation of x by compiler f. "Take one compiler source (GCC 4.8.1),…
You're not giving a useful procedure for me. Let's say that only Gcc can compile itself and its own libraries (e.g version n-1 can compile version n). How can I make trusted GCC 4.8.1 if other compilers won't compile the sources of GCC? Do you agree that I have to implement all the features of GCC used in the sources of GCC in one or more other compilers? If not, don't I have to have a trusted GCC from the start? And…
I am not sure if gcc was able to compile itself always, but if it was, you can argue that there existed a smallest kernel of gcc sometime ago that did not depend on any of the "features" of gcc that makes it impossible for other compilers to compile gcc. Now, if there existed such a thing before, it probably exists now, because the incremental "features" that make it impossible for other compilers to compile gcc, would make it impossible for gcc too. My bet would be that there exists a logical separation somewhere, and there is still a small kernel in it, that you can bootstrap with other compilers, from which point you can do what your parent says.
> It's asymmetric warfare. But the side without the money is disorganized and open and trusting. The Snowden leak happened (as did Manning), so the Government is not as organized as optics would suggest. They are drowning in the data deluge just like everybody else.
Sure, but 4,999,998 other people with secret level security clearances are not being whistleblowers and leakers. Hard to imagine a better success rate for any organization composed of fallible human beings.
When you consider how clearance actually works, you're not dealing with apples and apples.
Sure, but 4,999,998 other people with secret level security clearances are not being whistleblowers and leakers. Hard to imagine a better success rate for any organization composed of fallible human beings.
When you consider how clearance actually works, you're not dealing with apples and apples.
It is a fact that I don't know much about this stuff. Just what I gather from mostly public sources.
It would be grossly unprofessional of the three-letter agencies if they should have failed to run counter-intelligence operations upon the open source communities. Futhermore, given their resources to hire hackers and long history of infiltrating loosely affiliated organizations, it is hard to image that they have struggled to place moles deep within many critical projects. Open source communities have no membership…
When people ask me why I switched to Gentoo, I'm going to borrow liberally from this post as justification. I know the code my system was built on now. It's trivial to do an audit of that code, as well. I didn't have that security with RHEL/Fedora or Ubuntu/Debian If you didn't build your OS, you'd better trust the person/people that did.
glad to know another one of us graze over here, too.
GNU/Linux, and Free software and hardware in general, look to be the BIG winners out of the NSA brouhaha, because all non-US governments, businesses, organizations, and individuals around the planet who need to safeguard their private or confidential information now have reason to mistrust proprietary (unauditable) software and hardware. Free, open software and hardware are less likely to have secret 'back doors' ins…
It would be grossly unprofessional of the three-letter agencies if they should have failed to run counter-intelligence operations upon the open source communities. Futhermore, given their resources to hire hackers and long history of infiltrating loosely affiliated organizations, it is hard to image that they have struggled to place moles deep within many critical projects. Open source communities have no membership…
You might find some of what you're looking for on the wikipedia page I linked to. But courts are only very rarely the place where accusations against heads of states are examined, especially when it comes to superpowers.
I read it carefully. Name "Putin" is not mentioned anywhere in the Investigation section. Please stick to the facts.
If the accused can prevent a proper investigation I will make my mind up based on the clues that exist.
Disassemblers produce assembly code, not the HLL code, so they are many orders of magnitude easier to write from the scratch than modern compilers. They typically expect human involvement as soon as there's non-trivial assembly-level engineered self-modifying code. Hopefully there's no much of such code in the results of the compilers we use. Also if you check the whole discussion you'll see I already discussed Ken's…
Ok, I appreciate this information (and I'm trying to follow the discussion but I didn't see you talking of Ken's work). But I'm still curious; even though you can write the disassembler by hand, how can you be sure that you're compiling it with a non-compromised compiler? Or do you mean write it in e.g. ELF format directly (and that's assuming the OS isn't involved in filtering offending code, though it seems extraor…
write a disassembler in machine code, of course :)
Let's boycott the hell out of Microsoft. They gleefully sold out their users to the NSA.
As long as you also "boycott the hell" out of: Yahoo Google Facebook PalTalk YouTube Skype AOL Apple Who have also been mentioned as complicit in this whole scandal. Just to be fair :-) By the way, I actually agree with you and have been slowly switching all my home stuff to linux and trying to get away from Google Dependence (although I type this in Chrome on a Win 8 laptop... damn work computer)
I am already switching away from Google services and software because of this (and because they decided to drop XMPP from Hangouts)