Printable View
I said that I wouldn't do that again, Ms. Mittens. I wasn't being sarcastic.
Asfor the term "rational ingorance", I think that you can find that in any microeconomics textbook. The textbook I used was "Economics" (I am so not gonig to comment) by William A. McEachern. Anyone else want to know some of my sources? (Not being sarcastic here.)
You can never be 100% sure. Hell, tomorrow I could turn purple with blue spots. Certainly anything is possible but the probability is so low, that I'd be very surprised.Quote:
Okay, unless you start the entire computer revolution from scratch again, how can you be sure that you don't have a backdoor somewhere? Answer me that, please
That said, I'd like to re-iterate that it's not just Linux that the statement would apply. I'd apply it to OS X, earlier Apple OSes, Novell, AIX, Windows (pick a flava'), Commodore, DOS, etc. Anything could have a backdoor of sometype on it, specifically those with networking.
We do go on a concept of trust and faith. We believe, right or wrongly, that manufacturers and creators of OSes are ethical and there for the good cause (particularly those in the Open Source community).
And then there is reputation. Backdoors on software and operating systems don't fly well with consumers. When XP was released, I remember everyone thinking there was a backdoor in it. It was all rumor and assumption but it caused a panic. FUDing. Personally, I think it's the worse kind of action and unnecessary. It means the industry spends it's time doubting things when we should be dealing with the ones trying to actually break in.
We want to believe that someone is out to get us but reality is otherwise. The risk of a backdoor, while it exists, is small. It's extremely small. So I, as a security admin, will take my chance on the OS so that it does what I want it to do. I know the risk exists but it's a risk I'll take.
[edit]
It strikes me that you seem to be specifically targetting Linux in regards to this backdoor argument (correct me if I'm wrong). I would like to point something out. Not too long ago someone tried to put in a linux kernel backdoor. What's interesting and proves the point about some of the advantages of Open Source (many eyes concept) is that it was caught quickly. I still have faith in the Open Source projects because of many eyes and because of things like "BitMover" (what's being used to manage the Linux Kernel). Does it mean there will never be a backdoor in the Kernel or other software? No. Still a chance. Have they made it harder to do? Yes.
n73ux56e: Like you said... it is possible for a backdoor to be installed..
Take for instance, the JAP annonymous tool. The developers were forced to install a backdoor (by German police/courts) and they were forced to keep quite about it. But, since it was open source... the code was released. Someone looked through/audited the code and found the backdoor pretty quickly after it was installed. However, the backdoor has since been removed...
This is a prime example proving your point.
I still feel that the kernel is going to be more safe than programs/services running on the kernel.
From a security standpoint, you are going to install what you NEED. Don't go through and install all the thousads of packages that are available. You never really know what can be included with it. If you pick the specific packages that you know you need, you'll be safer in the long run. Not just from having a backdoor installed, but from programs that may have vulnerablilites and 0day exploits out there.
http://www.securityfocus.com/news/6779
n73: You are a genius..... You have realized that _nothing_ is secure..... You, actually, can't trust your own mother..... The _only_ thing you can trust is yourself and that which you have built yourself, (and if you are as crappy at woodwork as I am you can't really trust that either....;)) But that's another subject.......
The fact remains that every "fix" to a problem that the government comes up with is so easily circumvented by anyone with an ounce of sense that it becomes ridiculous. There is no system available, anywhere, that can sniff the entire traffic of the internet that passes through the USA's ISP's and phone systems, (remember I can call international from here and connect to an ISP in Nepal from a hotel room anywhere), and then filter out all the "legal and acceptable" encrypted tunnels/systems, (they can't do that if they want _real_ security, they have to decrypt them all), and still have a system that is managable, functional and would provide _actual_ security.
What they do is go for the idiot target. The one that thinks he can pass information across the internet in safely. You can't if they want to watch you. You can if you know a little bit - you are intelligent - and you don't want to be caught. Hell, even a simple system that requires you to say certain things at certain times in clear can "beat" the "security services". If I previously agreed with you that saying "my brother Bill seems happy with his job" really means "The explosives are on hand now, the operation is proceeding" then I send BS after BS email to you for weeks until I say "we thing Betty might be pregnant"... which really means "operation taking place in 4 days"..... How are the "security forces" going to work that out? They can't.... until after the act...... It's the most basic of "codes".... It's called "veiled speech".... you say one thing but mean another..... And I haven't even encrypted it yet...... Those 4 days are "gold" if it was encrypted...... But why would I encrypt it..... It would make it look like I'm hiding something..... I have nothing to hide...... I'm just talking to my cousin in Morocco.....
See the point...... I can hide anything I like from you or anyone else..... Including the FBI etc. If I have intent and knowledge I can beat them every time.... Thus, their stupid laws are _practically_ useless...... They do nothing except catch the stupid.....
Yep..... the stupid are the real threat..... I'm worried about them....... :rolleyes:
I had a post, but i'm done arguing. I'm not gonna go back and forth with someone that thinks Linux is a single entity.
Soda, I don't see what is left to argue. The linux kernel (as MsMittens even pointed out sources) has been infected(?) with a backdoor before that slipped through Linus' checks. It was released, and a backdoor was found, being quickly removed.
Removed or not, it happened. The linux kernel(that's right not a distro) had a backdoor, and it could happen again. Will it be found in time? Yes, just like in Windows :) What does this mean? Linux can have backdoors installed by others coding, swash it by the checks, and have a working backdoor for at least a few hours.
Ms. Mittens:
I am not trying to attack Linux. I guess that Linux is a prime example, though. It was inspired by Unix and it is open source. What you said about open source making it harder to put in place backdoors is true. I can refer to all OS or MakeUp OS if you wish. I did not mean to attack Linux.
-----------------------------------------------------------------------------------
phishphreek80:
You are right there. If you do pick the packages that you need and not use every package out there, you will be safer. The less you have on your computer the more you can be sure if there is or there is not any backdoors installed on your computer. Yet another EXTREME case I will use. Lets say that you have a program that allows you to play Pong like on those Ataris. If that program jsut lets you move a little paddle up and down the screen to bounce a ball back and forth, you won't expect it to be very big, will oyu? If the program, once you install it, takes up 5 GB of space on your hard drive, will you not be the least suspicous of something going on? Now if you install a load of programs like five trillion little games like pong that are much smaller, the average of all the space that all the programs takes up goes down. You can't be sure that there is a backdoor anywhere because you have all those programs and you aren't the least suspicous about anyone of them because they all take up say 1 MB average.
-----------------------------------------------------------------------------------
Tiger Shark:
I don't trust my mom or my dad or anyone. I go through thinking everyday that anyone I know could turn bezerk on me and end up killing everyone on Earth. As Ms. mittens said, though, it is better to 'trust' people than it is to do the alternative. I act within reason that my parents and friends, based on experience, will not do anything crazy like blowing up the world and me along with it.
As for your second point, need I point to the Matrix (oh god, I feel sooooo cheesy). I mean it is possible, though not probable, that a bunch of computers rule the entire world and you are laying down somewhere in a tube believing that you exist in reality. A more 'down to Earth' scenario might be that a group somewhere could be watching you and everything you do online. You might just be a pawn in someone's game. (I wonder if I have the right person with this paragraph. :-S)
Just because you have intent and knowledge doesn't mean that no one else does either. You are just one person, the FBI is a whole group of people. Each of them are trained in a special area and they all work together. You might be able to outsmart them one time out of 1,000 but I don't think you can do much better than that, at least not if they suspect you of something like you suggested. But either way, I didn't even get anything you said in that post. (Not trying to be mean, I just didn't understand how it all fit together. It sounded to me like you were suggesting that you were on the run from the FBI and that you implied that you can outsmart them and that they can never catch you.)
-----------------------------------------------------------------------------------
Soda_Popinsky:
Okay, first off, I don't know what you mean by Sub7 or RDC. Can you please explain that to me? If you don't want to, that's fine.Quote:
Such as Sub7, or hardwired like RDC
People do. Thats the beauty of open source.
Open source compiler.
Open source port scanner. Use a Firewall. RSA encryption hasn't been cracked yet, has it?
You seem to think that the goverment is so much more powerful than it actually is. We use the same tools they do in most cases. They are just as insecure as we are.
Your second and third comments are related. If someone managed to put some code in somewhere in a complier way back a long time ago (I don't know how long ago, but the first complier ever created (if that's possible)) that adds some code to the next complier that it creates, and then that complier adds some code to the next complier it creates. Open source compliers don't work because you must compile them. (Have you found a way to type in some code in Windows Notepad and then run that somehow? If you have, please share it with us.) When you compile that open source code then the compiler you compile with sticks some of the bad code in. You THINK that you have gone through everything and it has nothing in it that is a backdoor but it DOES have a backdoor because the compiler you compiled the compiler with placed some code in the compiler that you are going to use to compile the program with. The only way that you could avoid this from happening is to start the ENTIRE computer revolution thingie from scratch again. If you did that you could be a whole lot more assured that your final product had no backdoors in it. A shorter way of putting this: you can't see the code of a computer program once it is compiled unles you can read 1' and 0'. I doubt that you want to sift through 1+ GB's of 1' and 0'. Even then, if you could see that, you have no wau of knowing whether or not the processor has inserted in some code.
As for your final comment, I don't understand what any of that has to do with this. I think that what you are suggesting is that you protect yourself in the present agaisnt backdoors, but that doesn't mean that you will catch all those backdoors.
Well yeah, anything with code can have a backdoor. MY point was that n73 is wrong by saying we don't know if the goverment is hiding backdoors in Linux. Intentional backdoors are found by the open source community. Im not saying its impossible to write in a backdoor "just because it's linux"
My point exactly.Quote:
It was released, and a backdoor was found, being quickly removed.
This was said:
My response was that the goverment can't pull a fast one on us without being hugely embarrased by the open source community. There is no goverment influence in linux.Quote:
that does assume that the government doesn't force Linux to have any backdoors.
all done :)
Soda
I don't think that Linux is a single entity. The kernel is created by people and then other people dumb their packages on it. I am not as stupid as I sound!Quote:
Originally posted here by Soda_Popinsky
I had a post, but i'm done arguing. I'm not gonna go back and forth with someone that thinks Linux is a single entity.
That was under the context that the government didn't put any laws in place that said that Linux had to have backdoors. I am not saying whether or not that is possible or feasible. I am saying that it is possible to write backdoors into things like Linux (and Windows, MacOS, FreeBSD, and all the other Unix stuff, and every other OS on Earth) without people knowing. It is possible because you can use a compiler to put backdoors in (assuming that all the compilers on Earth have the code that is inserted in when you compile something) or that someone can find some way of connecting two pieces of code that seem to server a legitmate purpose but are actually backdoors. No one sees that those two pieces of code are connected and that they can cause harm.Quote:
Originally posted here by Soda_Popinsky
Well yeah, anything with code can have a backdoor. MY point was that n73 is wrong by saying we don't know if the goverment is hiding backdoors in Linux. Intentional backdoors are found by the open source community. Im not saying its impossible to write in a backdoor "just because it's linux"
My point exactly.
This was said:
My response was that the goverment can't pull a fast one on us without being hugely embarrased by the open source community. There is no goverment influence in linux.
all done :)
Soda
All I am saying is that ANYTHING can happen with ANYTHING (NOT just computers). Sorry for double-posting.