NSA operation ORCHESTRA: Annual Status Report

What people said

ensmotko · 2014-04 · Strong recommendation

Check out phk's fosdem talk[0]. I've linked to the the part where he talks about openSSL, but I'd suggest watching the whole thing. I'm now starting to believe the talk wasn't a joke at all... [0] [VIDEO]

Read the original HN comment ↗

TacticalCoder · 2014-04 · Strong recommendation

There's a talk that was given in Belgium / Brussels at FOSDEM2014 two months ago or so by Poul-Henning Kamp (FreeBSD) regarding the NSA and how he'd do it if he had to create holes in software: [VIDEO] He's talking specifically about OpenSSL quite a lot (basically saying it's too complex to ever be secure and probably received many "security patches" from NSA employees). The entire talk is an eye opener. He explains how NSA shills are reading reddit / HN and poisoning communities / standards / protocols / etc. How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things. He talks about shills submitting a few correct patches over the months / years, slowly gaining reputation among the community and then misusing that trust to submit (not so) subtle patches introducing security holes on purpose. He mentions a few of the "common mantra" repeated often (including here) by people who have an interest in the status quo. He explains why SSL/TLS is broken and says that the "SEC" part of "DNSSEC" is not going to be that secure ; ) I think that the problem is much worse than most people think and that Poul-Henning Kamp is closer to the truth than the ones constantly repeating "bug happens" as if nothing malicious was ever going on.

Read the original HN comment ↗

askmike · 2019-10 · Recommendation

I think open-source software is great as well, but assuming these kind of bugs are found because you can inspect the code is very wishful thinking that doesn't always hold up. This specific example required a Google department to find it. Who would have found it if Google got restrained by the NSA?. Other notable examples include openSSL. On top of that, here is a great talk about how easy it would be to infiltrate open source projects: [VIDEO]

Read the original HN comment ↗