HUP
9 HN recommenders · recommended in 11 months, 2014–2019
46:06 · 30K views · Feb 12, 2014
Poul-Henning Kamp's FOSDEM 2014 talk is a hypothetical account of how an intelligence agency such as the NSA would sabotage open source software, standards and online discussion. It covers Skype's history, OpenSSL and psyops against standards.
HN returned to it repeatedly, especially after Heartbleed, as an eye-opening argument about subverting open source and standards.
20 comments from Hacker News
There's a talk that was given in Belgium / Brussels at FOSDEM2014 two months ago or so by Poul-Henning Kamp (FreeBSD) regarding the NSA and how he'd do it if he had to create holes in software: this video He's talking specifically about OpenSSL quite a lot (basically saying it's too complex to ever be secure and probably received many "security patches" from NSA employees). The entire talk is an eye opener. He explains how NSA shills are reading reddit / HN and poisoning communities / standards / protocols / etc. How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things. He talks about shills submitting a few correct patches over the months / years, slowly gaining reputation among the community and then misusing that trust to submit (not so) subtle patches introducing security holes on purpose. He mentions a few of the "common mantra" repeated often (including here) by people who have an interest in the status quo. He explains why SSL/TLS is broken and says that the "SEC" part of "DNSSEC" is not going to be that secure ; ) I think that the problem is much worse than most people think and that Poul-Henning Kamp is closer to the truth than the ones constantly repeating "bug happens" as if nothing malicious was ever going on.
Check out phk's fosdem talk[0]. I've linked to the the part where he talks about openSSL, but I'd suggest watching the whole thing. I'm now starting to believe the talk wasn't a joke at all... [0] this video
>I have this notion that surrounding a subject with basket case conspiracy theories would be a good way to get people not to take it seriously :) Indeed, it would. A lot of clever people have discussed the issue of disinfo & FUD, you might wish to: * Watch this talk from FOSDEM '14 by Poul-Henning Kamp [Contextually, one important tidbit to keep in mind while watching it: At the time phk gave the talk, the heartbleed vulnerability in OpenSSL wasn't yet known!]: this video * and, perhaps, read these two blog posts, but tread carefully with those two, as, unlike the above video, the below edges MOST dangerously close to basket case conspiracy theory territory - arguably, it doesn't get there, but I can definitely say that if one slips while looking into the below, one'll immediately end up in basket case territory: [LINK] [LINK] However, having said this & pointed out all of the above, before going down any of the above lanes, keep something else in mind: 1. Take a look at when some of these links got first published online . Multi-decade gap vs. original date of publication. Something unfortunately still the norm for a lot of old(er) scientific/academic literature. 2. Most of Frey's original papers from the 60s are still behind a HARD paywall. Again, unfortunately still the norm for a lot of old(er) scientific/academic literature. 3. The whole classified Radar tech research aspect of it (This whole avenue of research got started out when radar techs in the 60s started complaining
Hmmm… and ElGamal's signing scheme didn't qualify? I don't think that's a reason, or even an excuse: Schnorr actually did claim his patent read on DSA. (That obviously never went anywhere, and the US Government, in a show of force via the NSA, filed their own patent on DSA.) The NSA also really doesn't seem to have had much of a problem negotiating the licensing of patents with industry participants in the past! It is, after all, in an extraordinarily strong bargaining position: an awful lot of public money to throw around (openly, via on-the-book government contracts, and otherwise); the backing of a 'superpower' government and its negotiators; a remarkably good idea of what the position of those its bargaining with is (it is a signals intelligence agency…!); and is even able to classify patents and other nonsense like that. DSA was sceptically received at the time, and there was widespread suspicion about its complexity and critical dependency on random k. (Even just two or three predictable leading bits of k can cause disaster!) Sizes above 1024 bit were not specified for way too long, and I would consider a 1024-bit DSA key most definitely crackable by the computing resources available to the NSA (or perhaps anyone else with a budget and a chip fab on contract after-hours!) today. (Those with DSA PGP signing keys may wish to take note and replace them, I suggest, with 4096-bit RSA keys.) I think perhaps the only reason DSA got any popularity was because of the RSA patent,
Debian's 2006 PRNG anyone?! Maybe these are stupid dumb mistakes, but if I were NSA this is exactly how I'd implement backdoors. 2 lines of code cloned here (go to fail), 2 lines of code commented out there (Debian PRNG issue), and just like that you create huge vulnerabilities in the system. Hard to notice, and impossible to blame on anyone. Everytime they seem to be some brilliant "stupid mistakes". And as others have said, do listen to the FreeBSD developer's talk on NSA' ORCHESTRA operation (subverting open source projects): this video