Schwartz Comments On NSA/Sun OpenSolaris Collaboration

sean_nestor writes to mention that Sun CEO Jonathan Schwartz took a bit of time recently to comment on last week's announcement that Sun Microsystems would be partnering closely with the NSA for security research surrounding OpenSolaris. Rather than the typical loads of legalese and confidentiality agreements Sun and the NSA are claiming that this move is more about the NSA joining the OpenSolaris community than anything else. I guess only time will tell.

Great! I liked Solaris.

It takes me forever to pull out SELinux when I deploy a new Linux server and now I have to worry about what the hell OpenSolaris is doing instead of running an application or whatever its purpose is supposed to be doing.

Doesn't anyone else see MAJOR privacy and 4th amendment violations when government and business get into bed with each other?!?! I do not want any agency in the US government helping Sun, Microsoft, and or anyone else with "securing" their products. There is only one reason why the NSA is interested in OpenSolaris and it has nothing to do with "securing" it.

Government spooks helped Microsoft build Vista

Helping a Vole out of a hole
By Nick Farrell: Tuesday, 09 January 2007, 2:26 PM

THE USA GOVERNMENT'S cryptologic organisation, the National Security Agency, has admitted that it is behind some of the security changes to Microsoft's operating system Vista.
According to the Washington Post, the agency which was once so secret that it was jokingly referred to as 'No such Agency' has admitted making 'unspecified contributions' to Vista.

Tony Sager, the NSA's chief of vulnerability analysis and operations group, told the Post that it was the agency's intention to help everyone these days.

The NSA used a red and a blue team to pull apart the software. The red team posed as "the determined, technically competent adversary" to disrupt, corrupt or steal information. The Blue team helped Defense Department system administrators with Vista's configuration.

Vole said that it has sought help from the NSA over the last four years. Apparently its skills can be seen in the Windows XP consumer version and the Windows Server 2003 for corporate customers.

The assistance is at the US taxpayers' expense, although the NSA says it all makes perfect sense. Not only is the NSA protecting United States business, its own Defense Department uses VoleWare so it is in the government's interest to make sure it is as secure as possible.

Microsoft is not the only one to tap the spooks. Apple, with its Mac OSX operating system, and Novell with its SUSE Linux also asked the NSA what it thought of their products. The NSA is quite good at finding weapons of mass destruction that are not there.

Re:

I guess the most obvious question: If help was provided with XP and Vista in security, why so many security patches?

Re:

Help with crypto isn't help with system security. ;-) Especially when you are keeping the master-key.

Re:

With Linux don't you have the source? So how can your 4th amendment rights and privacy be violated when you can just remove the stuff? Maybe the businesses are trying to make money and the government has deep pockets so they secure their software so the go

Re:Great! I liked Solaris.

Spoken like a true delusional. Look, this is the NSA. They're pretty smart folks, some of my college classmates are probably there now (not that they'd be able to tell me). If they wanted to insert secret code into an OPEN SOURCE project they wouldn't make an announcement of collaboration, they'd create some fake person (or hire some real person) who starts submitting patches.

I suspect what really is going on is that the NSA doesn't trust closed Microsoft code and wants to make sure there are secure open source operating systems they can use (they may get access to the MS codebase, but I doubt they'd be able to set up their own secure repository and verified build).

Remember, sane people mistrust the NSA. Paranoid people work for the NSA.

Re:

One of the NSA's directives is for helping provide security for the rest of the gov, as a bit of an expert group. Securing OSs for gov use falls in that category.

Your NSA friends can probably tell you they're working for the NSA. They just can't say doin

Re:Great! I liked Solaris.

Spoken like a true Sheep.

Spoken like a conspiracy theory nut. Distrust of the government is a very good thing. Blindingly thinking the government is out to get you is as stupid as blindingly believing it's out to help you. In this case, SELinux is completely open and out there for you to see.

It takes teams of people to understand the ins and outs of large sums of source code

Do you think teams of people haven't gone through the SELinux code with a fine-tooth comb? Security researchers were all over that, when the code was first given to the community in 2000. It wasn't placed in the mainline kernel until 2003. There has been plenty of time for people to find echelon-type code in there. Not to mention it would be pretty stupid to put that type of code in the open, as it would destroy people's confidence in the NSA and allow people who looked at the code to use these hooks for their own benefits, thus potentially using it against the US Government itself, since several departments including the DoD and the NSA itself use it.

I have hacked the kernel and made changes but I do not understand the entire thing, not one person could build an OS like Linux and deploy it without community support.

No, but I guarantee you that if you submitted your kernel changes to the mainline tree, several people above you looked at those changes and vetted it as worthwhile for inclusion. And you can bet every one of those people don't understand the entire kernel, but sure as hell understood the part of the kernel you were messing with. And they understood what your code was doing. Anyone can make changes to the linux code, but it's not an open source repository that everyone submits to, there are specific processes to get things accepted to the main tree.

The government is like a sexually transmitted disease, easy to catch and hard as hell to get rid of.

The solution to sexually transmitted diseases is to be vigilant and careful, not to stop having sex. If all humans become so afraid of sexually transmitted diseases that they quit having children humanity would be gone. Similar fate would befall you in total anarchism. Be wary of your government, and require it to be open. Please don't bitch about the good and open things the government has done, we need to encourage more of that.

Spoken like a true paranoid

1. The NSA wouldn't announce that they are trying to make Linux more secure and then slip in back doors. Heck they submit there patches for all the world to see. If they tried it the finger would point right back at them. And don't you think that everybody

I Liked Computers

Doesn't anyone else see MAJOR privacy and 4th amendment violations when government and business get into bed with each other?!?! I do not want any agency in the US government helping Sun, Microsoft, and or anyone else with "securing" their products.

Not nec

Re:

Well, like I said, I encourage the paranoia. But it must be tested by realism.

I would wait before introducing any OS into a secure critical path until after it has had the maximum review I can afford to wait for. Thre's no reason to believe that the NSA or

SEOpenSolaris

If you read between the lines, and know anything about SELinux (also orginating inside the NSA), you come away with the impression that this is SELinux ported to OpenSolaris. Since the code will be as open as the rest of the OpenSolaris code, it doesn't sound like that big a deal to me ...

Re:

Perhaps you will be sleeping well this weekend. I will not. Now I'm going to be looking for any group anywhere on the Internet that is monitoring the source for SELinux and OpenSolaris for oddities that might just be a backdoor for the NSA.

Have you EVER se

Re:SEOpenSolaris

[disclaimer - I work for Sun, and I KNOW that some of my friends have worked for the NSA, and I KNOW that I have relatives with security clearances. Who knows what's going on that I don't know.] As has been pointed out elsewhere, if the NSA wanted to insert backdoors in software, it is not likely that they would announce it loudly. Ditto for anyone other country's version of the NSA. There is a legitimate national security reason that the NSA would be interested in plugging holes in software that is widely-used within the US -- as bad as worms/spam etc might be, imagine how it would turn out if a nation decided to launch some sort of a cyber attack, concurrent with who knows what other action. That's bad news that we just don't need to hear. As far as the compiler goes, ab-so-lutely, be wary.

Trusted GNU/Solaris?

Whatever happened to the project embedding a Solaris kernel inside a Debian/GNU OS? Would the current version of that OS work properly with this FMAC and the TrustedExtensions to run "Linux" apps on a much more secure OS?

Back doors? in Open Source? YGTB Kidding.

Contrary to some of the more paranoid types around here, I think this is a great announcement. As I was reading regarding prior NSA work with Sun on security implementations, what I am seeing is an opportunity-- like Sun does -- to leverage the requirements of a hyper-security aware entity [ the NSA ] into open source systems [Open Solaris] but once opened sourced, those same techniques can be applied to harden just about any operating system.

On the NSA side, having many eyes analyzing their code has both risks -- if holes are found in their security model or implementations, potentially these could be exploited by the blackhat types and benefits -- more weaknesses discovered faster and holes plugged so that the blackhat types get closed out of NSA type stuff faster than they can do it with closed implementations.

But neither of these scenarios will let NSA somehow increase their "big brother reach" because with many eyes comes near perfect scrutiny that would quickly out any code back-doors, etc. that would be usable by the white hats or the black hats.

On the whole I find this to be a cool/worthwhile endeavor on Sun's part and look forward to it's efforts being leveraged into all of the Open Source stuff that can use it.

This isn't news...

This isn't news. .GOV helped Sun build Trusted Solaris back in the day (they also helped Hewlett-Packard develop Trusted HP/UX). The government isn't doing this stuff to be evil, and I know my saying, "Don't be paranoid," won't make anyone any less paranoid -- but really the government needs certain security features to solve its problems (such as Cross-Domain information sharing), and the commercial industry simply doesn't need that stuff. Or, at least, it doesn't think it needs it. The only way for the government to get the OS features it needs is to work with a company directly to do it, or use an open source alternative.

Originally, .GOV decided to work with companies. Like I said, Trusted Solaris, Trusted HP/UX, and some others that I can't think of, were created. Along came Stephen Smalley and his FLASK security architecture. Linux was the first and easiest place to implement it, and the NSA spearheaded the project. You can imagine that Sun (the only vendor of an OS that supported multi-level data just a few years ago) wasn't all that happy -- .GOV pretty much promised Sun, "If you build and maintain your trusted OS, we'll keep buying licenses and hardware."

Now that isn't so. It seems only fair to help Sun and the Solaris community in the same way that the government has helped RedHat and the Linux community: provide some resources and some know-how to make the OS do what the government wants, so as to not hand RedHat a huge government-assist...the government basically wants competition here. As a taxpayer, I can't say that I'm complaining...

Reid

OpenSolaris

"Open" is the keyword here. It's not like they are going to be submitting binary patches or that we can't review the source code they submit.

I'd also like to point out the SELinux [nsa.gov] project, will you abandon Linux now too?

You should really adjust that tin foil, it's messing with the signals that are already inside your head.

Re:

On systems that do use SELinux, the NSA isn't the one who compiled it in, the distribution did. I fail to see what avoiding SELinux like the plague accomplishes anyway, its just a mandatory access control system. It's also typically disabled at boot time a

Re:

Why trust any contibution?

because you can literally stare at the source code and audit it. this isn't windows or Mac where you've literally put your security in their hands, FOSS is more or less transparent so if you don't like where things are going you

Re:

that's hogwash. you don't use a compiler that you don't have the sources to.

Re:New Meaning of Spyware

The NSA is a huge organization, does a lot of different things, and as a result, it can--like a lot of large companies and agencies--seem a bit schizophrenic.

NSA employees have made significant contributions to Linux already, and there have been the usual arguments over design choices that any such project faces, but there's never been the smallest suggestion of any subterfuge.

OpenSolaris's work is conducted in the light of day, and I doubt the NSA's participation will be any more nefarious there.

Part of the NSA's mandate seems to be to improve the security of everybody's operating systems. That's work that can benefit all of us, is exactly the sort of work that a "national security agency" *should* do, and we should encourage it, while still condemning the projects we disapprove of.

Re:New Meaning of Spyware

I'll be the first to yell out at things like warrantless wiretapping, but believe it or not, even at NSA they use Windows and Linux/Unix on their hardware. It's in their best interest and the interest of their mission (as a consumer of said OSs) to make sure that those OSs are as secure as they can be. And some of the smartest security researchers on the planet work for NSA. So why not?

One of the NSA's growing missions is also to secure the electronic interests of the United States and its citizens. That includes doing anything they can to help secure the infrastructure of US interests. All our banks and national financial stability rely heavily on the security of computer systems. If they can't benefit from this added security, what's the point of securing a defense system if someone can hack into your federal bank system and make you lose billions?

So things like an overall more secure Solaris or Linux (or even Windows Vista) benefits everyone, including the electronic interests of the citizens of the USA, who the NSA also serves. Remember, they ARE a government agency (an occasionally evil one, though most of them do evil things every now and then.)

Re:

From the article, "MAC's exists so that not just anyone, for example, can look at your passport file without permission..." Whaaaa?? Isn't that what just happened to the presidential candidates?

Yes, that's why he picked that particular example.

Re:

I think they're calling them "bungholes" nowadays.