Schwartz Comments On NSA/Sun OpenSolaris Collaboration 92
sean_nestor writes to mention that Sun CEO Jonathan Schwartz took a bit of time recently to comment on last week's announcement that Sun Microsystems would be partnering closely with the NSA for security research surrounding OpenSolaris. Rather than the typical loads of legalese and confidentiality agreements Sun and the NSA are claiming that this move is more about the NSA joining the OpenSolaris community than anything else. I guess only time will tell.
OpenSolaris (Score:5, Insightful)
I'd also like to point out the SELinux [nsa.gov] project, will you abandon Linux now too?
You should really adjust that tin foil, it's messing with the signals that are already inside your head.
Re: (Score:1)
Tinfoil accessorizes more nicely than bullshit.
Re: (Score:3, Informative)
SElinux is also a part of the mainstream kernel, so perhaps you don't trust those people either? Perhaps you should review the source line by line, because how do you know that unchecking SELinux in the config REALLY removed it from the final binary?
Re: (Score:3, Insightful)
Re: (Score:2)
What good does that do if the gcc binary has been modified to insert nasty code when it compiles. All of the source code could be clean, including the source code of gcc. Then anything that gets compiled has backdoors inserted.
Re: (Score:3, Insightful)
Re: (Score:2)
There is this famous trick of having a virus/trojan in the compiler so that when it compiles (another) compiler it will insert the virus into the new compiler too.
See Ken Thompson, Reflection trusting trust.
Re: (Score:1)
forgetting history (Score:2)
The grand parent was making a reference to a historical case where a compiler binary was created that would create a back door in compiled software. Editing the compiler sources in this case would normally help, except that the compiler was designed to detect that it was recompiling itself and reinsert the code that had been removed from the sources.
http://blogs.ittoolbox.com/emergingtech/edge/archives/ken-thompson-and-the-selfr [ittoolbox.com]
Re: (Score:2)
That was the solution last time.
Of course, now with the NSA involved, one could claim that all possible compilers had been jiggered to recognize each other. So to be secure one would need to go back to an early version and compile the chain forwards. Or write your own mini-C compiler in, say, Python, extending it sufficiently to compile an early version of GNU C...and then compile forwards from there. Though I suppose that if you've d
Re: (Score:2)
IDK how large the source for the average Linux distribution is, but I bet we're talking about dozens, if not hundreds of megabytes of code. You're never going to be able to audit all of it on your own, the only way to do an audit is to assemble a group of people and divide the work. But what if an insidious programmer added seemingly innocuous bits of code to dozens of files, so no single auditor is likely to see the entire backdoor c
Re: (Score:2)
To put it into geek-speak, "We could tell you, but then we'd have to reiserize you."
Re:New Meaning of Spyware (Score:5, Insightful)
NSA employees have made significant contributions to Linux already, and there have been the usual arguments over design choices that any such project faces, but there's never been the smallest suggestion of any subterfuge.
OpenSolaris's work is conducted in the light of day, and I doubt the NSA's participation will be any more nefarious there.
Part of the NSA's mandate seems to be to improve the security of everybody's operating systems. That's work that can benefit all of us, is exactly the sort of work that a "national security agency" *should* do, and we should encourage it, while still condemning the projects we disapprove of.
Re:New Meaning of Spyware (Score:5, Insightful)
One of the NSA's growing missions is also to secure the electronic interests of the United States and its citizens. That includes doing anything they can to help secure the infrastructure of US interests. All our banks and national financial stability rely heavily on the security of computer systems. If they can't benefit from this added security, what's the point of securing a defense system if someone can hack into your federal bank system and make you lose billions?
So things like an overall more secure Solaris or Linux (or even Windows Vista) benefits everyone, including the electronic interests of the citizens of the USA, who the NSA also serves. Remember, they ARE a government agency (an occasionally evil one, though most of them do evil things every now and then.)
Re: (Score:2)
MAC's (Score:1)
Re: (Score:2)
Yes, that's why he picked that particular example.
Great! I liked Solaris. (Score:4, Insightful)
Doesn't anyone else see MAJOR privacy and 4th amendment violations when government and business get into bed with each other?!?! I do not want any agency in the US government helping Sun, Microsoft, and or anyone else with "securing" their products. There is only one reason why the NSA is interested in OpenSolaris and it has nothing to do with "securing" it.
Government spooks helped Microsoft build Vista (Score:5, Interesting)
Helping a Vole out of a hole
By Nick Farrell: Tuesday, 09 January 2007, 2:26 PM
THE USA GOVERNMENT'S cryptologic organisation, the National Security Agency, has admitted that it is behind some of the security changes to Microsoft's operating system Vista.
According to the Washington Post, the agency which was once so secret that it was jokingly referred to as 'No such Agency' has admitted making 'unspecified contributions' to Vista.
Tony Sager, the NSA's chief of vulnerability analysis and operations group, told the Post that it was the agency's intention to help everyone these days.
The NSA used a red and a blue team to pull apart the software. The red team posed as "the determined, technically competent adversary" to disrupt, corrupt or steal information. The Blue team helped Defense Department system administrators with Vista's configuration.
Vole said that it has sought help from the NSA over the last four years. Apparently its skills can be seen in the Windows XP consumer version and the Windows Server 2003 for corporate customers.
The assistance is at the US taxpayers' expense, although the NSA says it all makes perfect sense. Not only is the NSA protecting United States business, its own Defense Department uses VoleWare so it is in the government's interest to make sure it is as secure as possible.
Microsoft is not the only one to tap the spooks. Apple, with its Mac OSX operating system, and Novell with its SUSE Linux also asked the NSA what it thought of their products. The NSA is quite good at finding weapons of mass destruction that are not there.
Re: (Score:3, Interesting)
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
Re:Great! I liked Solaris. (Score:5, Insightful)
I suspect what really is going on is that the NSA doesn't trust closed Microsoft code and wants to make sure there are secure open source operating systems they can use (they may get access to the MS codebase, but I doubt they'd be able to set up their own secure repository and verified build).
Remember, sane people mistrust the NSA. Paranoid people work for the NSA.
Re: (Score:3, Informative)
Your NSA friends can probably tell you they're working for the NSA. They just can't say doing what.
Re: (Score:2)
Smart, and RAND Corporation kind of evil. You can't use evil people, keep an eye on them and end up getting good returns. It's a delusion. If you let evil people be involved in your enterprises, they will fuck them up, and you as well. Most people need to learn this the hard way.
Re: (Score:2)
Re: (Score:2)
Re:Great! I liked Solaris. (Score:5, Insightful)
Spoken like a conspiracy theory nut. Distrust of the government is a very good thing. Blindingly thinking the government is out to get you is as stupid as blindingly believing it's out to help you. In this case, SELinux is completely open and out there for you to see.
Do you think teams of people haven't gone through the SELinux code with a fine-tooth comb? Security researchers were all over that, when the code was first given to the community in 2000. It wasn't placed in the mainline kernel until 2003. There has been plenty of time for people to find echelon-type code in there. Not to mention it would be pretty stupid to put that type of code in the open, as it would destroy people's confidence in the NSA and allow people who looked at the code to use these hooks for their own benefits, thus potentially using it against the US Government itself, since several departments including the DoD and the NSA itself use it.
No, but I guarantee you that if you submitted your kernel changes to the mainline tree, several people above you looked at those changes and vetted it as worthwhile for inclusion. And you can bet every one of those people don't understand the entire kernel, but sure as hell understood the part of the kernel you were messing with. And they understood what your code was doing. Anyone can make changes to the linux code, but it's not an open source repository that everyone submits to, there are specific processes to get things accepted to the main tree.
The solution to sexually transmitted diseases is to be vigilant and careful, not to stop having sex. If all humans become so afraid of sexually transmitted diseases that they quit having children humanity would be gone. Similar fate would befall you in total anarchism. Be wary of your government, and require it to be open. Please don't bitch about the good and open things the government has done, we need to encourage more of that.
Re: (Score:1)
Piss on everyone else. Moderated my comments and get on with your life. Just because you dislike what I say does not mean I care.
Re: (Score:1)
Re: (Score:1)
Total anarchism does not mean lack of order, it means lack of hierarchy. Anarchism is not the same as chaos. You can have laws in an anarchy, you just don't give anyone a monopoly on creating or enforcing them. It's not necessarily a free-for-all. It's not Mad Max Beyond Thunderdome. Certainly those worlds are included in the set of all possible anarchistic societies, but they are not the only worlds, they are not innevitable, and few serious anarchist
Re: (Score:2)
Re: Solution to STDs (Score:1)
Spoken like a true paranoid (Score:3, Insightful)
2. If the NSA wanted to pull something like that they would simply create a person and start adding code that ISN"T under their name!
Hate to tell you but this Internet t
I Liked Computers (Score:2)
Not necessarily. Without government and business "in bed with each other" - even ignoring the basic impossibility of avoiding that in the real world, unless the government has its entire separate economy, industrial base, telecom system... which sounds much scari
Re: (Score:1)
That is the reason I stopped going to Infragard meetings. Those just oozed mistrust. Oh, the FBI will be more than happy to listen to everything you have to say, but tell never return t
Re: (Score:3, Insightful)
I would wait before introducing any OS into a secure critical path until after it has had the maximum review I can afford to wait for. Thre's no reason to believe that the NSA or other spooks haven't had their sticky fingers all over the insides of any popular OS, especially a closed one in so many sensitive operations like Solaris has been for so many years. Microsoft goes without saying, but there's no reason that say NetBSD con
Re: (Score:1)
Sidenote: why doesn't slashdot allow underlines? I wanted them instead of bold!
Re: (Score:1, Interesting)
Re: (Score:2)
But not when SELinux is disabled, right? When running in permissive mode, it logs all would-be denials, but does not enforce them. When disabled, SELinux doesn't do anything at all.
Re: (Score:1)
Re: (Score:2)
The resources that they spend on static analysis and cryptanalysis should be put to work making the nation more secure. By locking up information, they are making everyone l
Re: (Score:1)
Re: (Score:2)
The 4th amendment:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
Please tell me how NSA code contributions to a project involve any form of "searches and seizures", much less "unreasonable" ones. Or alternatively, show me how
Re: (Score:2)
Why not use a distro that doesn't use it by default? Or do all distros use it by default? Serious question.
SEOpenSolaris (Score:4, Interesting)
Re: (Score:2, Insightful)
"The ability to understand the secret communications of our foreign adversaries while protecting our own communications..." http://www.nsa.gov/about/about00003.cfm [nsa.gov]
contemptible?
From what I can see from Executive Order 12333 http://www.archives.gov/federal-register/codification/executive-order/12333.html [archives.gov] the NSA is charged with Foreign Intelligence gathering and Information Assurance. The second one is at discussion here. I'm sure they, like every other Govt department, use off-the-shelf software whe
Re: (Score:2, Insightful)
Have you EVER seen a leopard change its spots?
Re:SEOpenSolaris (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Let's not forget the CPU itself. It's interesting that Sun has put a couple of their chips under a community source license. I'd guess that it would be very difficult to verify whether a chip was fabricated based on a certain set of microcode, unaltered.
I don't know one way or another whether the NSA has other motivations. I do believe that if they wanted to insert a back door in open source products they would be forced to go to great lengths to do so g
Re: (Score:2)
Re: (Score:2)
For a few reasons, but here is the main one:
A company could be "bullied" by the government to make certain changes to their code, such as adding a back door. An individual could be bullied as well. But with open source code you can't do that because there is no single owner to bully and there could be people all over the globe willing to run the project from their country, safe from some other g
Re: (Score:2)
SELinux has been out for around eight years, six years in the official Linux kernel. You'd think that they would have found any back-doors by now, if there would really be any.
It's called Trusted Extensions (Score:2)
backdoor (Score:1)
Re: (Score:2)
Trusted GNU/Solaris? (Score:2)
Back doors? in Open Source? YGTB Kidding. (Score:5, Insightful)
On the NSA side, having many eyes analyzing their code has both risks -- if holes are found in their security model or implementations, potentially these could be exploited by the blackhat types and benefits -- more weaknesses discovered faster and holes plugged so that the blackhat types get closed out of NSA type stuff faster than they can do it with closed implementations.
But neither of these scenarios will let NSA somehow increase their "big brother reach" because with many eyes comes near perfect scrutiny that would quickly out any code back-doors, etc. that would be usable by the white hats or the black hats.
On the whole I find this to be a cool/worthwhile endeavor on Sun's part and look forward to it's efforts being leveraged into all of the Open Source stuff that can use it.
Re: (Score:2)
I imagine the Chinese will be looking upon this effort with some interest.
Re: (Score:1)
Re: (Score:2)
the better for linux (Score:2)
All this collaboration will do is create 5% really good gems, and 95% throw away code--and it will take 4yrs to see any result knowing how fast both organization move.
I like openSolaris, but I unless Nexenta gets it butt in gear, Linux will win hands down on the usability front.
Re: (Score:2)
I think that you may have missed SELinux, which the NSA contributed in the year 2000 (accepted into the mainline kernel in 2002).
Open Door for Spooks (Score:2)
This is important in the Federal Government space (Score:2)
Tired Meme ... (Score:1)
tattle-tale (Score:2)
Not the obvious (Score:1)
This isn't news... (Score:3, Informative)
Originally,
Now that isn't so. It seems only fair to help Sun and the Solaris community in the same way that the government has helped RedHat and the Linux community: provide some resources and some know-how to make the OS do what the government wants, so as to not hand RedHat a huge government-assist...the government basically wants competition here. As a taxpayer, I can't say that I'm complaining...
Reid
Gimme a break. (Score:1)