Insecurity Threat

On September 28, 1999, an Internet Caucus Panel Discussion was held to discuss the issues surounding the Clipper chip and export restrictions on encryption in general. Congressman Curt Weldon raised a couple of interesting questions over the briefing he had with John Hamre of the US NSA.

But the point is that when John Hamre briefed me, and gave me the three key points of this change, there are a lot of unanswered questions. He assured me that in discussions that he had had with people like Bill Gates and Gerstner from IBM that there would be, kind of a, I don't know whether it's a, unstated ability to get access to systems if we needed it. Now, I want to know if that is part of the policy, or is that just something that we are being assured of, that needs to be spoke. Because, if there is some kind of a tacit understanding, I would like to know what it is.

Backdoors to systems can be inserted and vulnerabilities can be deliberately left open. Because it is easy enough to compare binary code and disassemble the difference, the same binary code has to used globally, or the backdoor will be quickly discovered. That means the backdoors used to get access to foreign powers computers by the NSA is will also be inside the computers in your country as well, left open for anyone to exploit.

This kind of security policy is an oxymoron. The only way to secure your countries information infrastructure is to have a policy to remove any such vulnerabilities and backdoors as soon as possible after discovery, Closing the Window of Exposure.

Unless you can have access to all the source code and have the right to recompile and compare the binaries, you cannot verify that the software you are using is free of backdoors.

If you do not have the resources to examin every line of source code, then you best bet is to use source code that is fully open to peer inspection.

In my opinion, an open source license, opens up the code to true peers in the industry, people who work with the source code to build solutions. When flaws are discovered, it is these peers who closely examin the patches and the source code that is vulnerable.

Otherwise who do you trust, the vendor? Remember Ed Curry!
In October 26, 1998, Ed Curry a former Microsoft contractor, presented documents to the Defense Department that he said proved that Microsoft Corp. conducted a campaign to mislead the government about the security certification status of Microsoft Windows NT.
You don't need to modify source code to insert a backdoor, "infection" can take place anywhere along the build to delivery chain.

In June 2002, Microsoft shipped a copy of Korean-language version of Visual Studio .NET infected with a copy of the Nimda worm.

There is a saying that goes back to the end of the cold war,: "Trust, but verify". In the same way you must have access to the source code and the ability to rebuild the toolchain from scratch to compare the resulting binaries.

If we proceed with plans to allow Linux to run these defense systems without demanding proof that it contains no subversive or dangerous code waiting to emerge after we bring it inside, then we invite the fate of Troy.

This part irks me.

There is no need to demand proof, all the proof you could ever want is already being offered up for free, voluntarily. It's called source code. It is the reason this is called Open Source software.

The only thing the military or any other organization for that matter, needs to do to ensure that they are getting what they think they are is build their distro from source, whether that means going to a source distro like Gentoo or just downloading the SRPM packages of RedHat or Mandrake, or Suse or whatever distro they happen to favor, and building from those. If one small group of trusted IT guys download, inspect and build a trusted build there is no way that anything like that could happen.

C'mon it's called open source for a reason. Use the source, that's what it's there for.