Julian Assange: "Debian Is Owned By The NSA"

Who is upvoting this BS... This article is just link-bait and FUD... Nowhere in the video (http://www.youtube.com/watch?v=UFFTYRWB0Tk) does Julian Assange say that "Debian Is Owned By The NSA" as the article title implies. All he says is that open-source systems are still vulnerable to attacks by APTs such as nation-states through the introduction of backdoors disguised as bugs...

I really don't believe the OpenSSL issue was deliberate. The commit in question was authored by somebody working at a german university and then reviewed by a member of the OpenSSL project.

Deliberately setting up something like this up would have been very difficult and besides, these people are likely still around and we can ask them what happened.

I really think that this was a) a honest mistake of the author and b) a very good example of why code reviews don't always work, at least for languages like C.

http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817...

That commit is widely publicised by now and the fact that the article linked here is still speculating about this issue being deliberate puts the whole article in a alarmist light which makes me sceptical about the other claims.

Why must we have an "us and them" attitude to distributions, instead of helping to make them better?

Free Software does not guarantee against nefarious third party manipulation. But it does guarantee that you can study the code that is running on your system.

Debian goes to great lengths to make sure that the binaries you get really can be built from the sources claimed (eg. random binary blobs embedded in source trees are not acceptable).

What users do next is up to them, but I think Debian is an example of the best we have. We are really better off gathering around open projects like Debian, than slating it for what it is.

It seems to me that the root cause of this "botching" is of not enough (qualified) eyes and hands working on making the code base better; if the upstream OpenSSL project had a decent, best practice, well commented code base with no build time warnings, no spaghetti code and decent test suite coverage, then no "botching" would have happened.

I think we have the best framework for fixing this problem: Free Software and Free Software distributions. What we should be talking about is how to make things better within this framework. And this just comes down to hard work, which everybody seems to expect somebody else to be doing.

I find it very difficult to accept the critics who are happy to use OpenSSL but also are not committing any resources to making it better. If the NSA really were the only major contributor to a Free Software project, then sure - they'd own it.

Its not true..but the Unix closed source systems such as Solaris, HP-UX,etc certainly have a note of caution as they only can be distributed to those states US agrees with,etc.

JA has been wrong more than he has been right..despite media not covering that aspect.

"these days most of GNU/Linux is written by Red Hat employees directly, who essentially work for the US military (their largest customer)"

Is that true? Really? They write most of the packages? Or they write most of the system and package thousands of other peoples work?

I'm on the fence about this. I really want it not to be true, but on the other hand my track record with wishing away unpleasantness is abysmal.

The way in which the text is written would have raised full tinfoil alert only two years ago, but now?

I don't know. If I was a manager at one of the intelligence agencies, I'd try to get my fingers into as much of the FOSS stuff as possible. Too interesting, too relevant. So I guess the people who _are_ managers there might have had the same idea?

This is so depressing.

EDIT: I did not see there was a video (probably due to noscript) and only read the text excerpt in the article.

it is wonderful that article link to original source, but I wish that by doing so, we would get less articles that make extraordinary claims based on a few vague statements.

question: "Does open source make security better"

answer: "yes, but it is not perfect. Debian had a crypto bug that existed for years. But the way things work now is "bugdoors", which is backdoors designed to look like bugs. So what is the security of the programmers that work on open source, can they plan a backdoor that just look like a typo?"

From that we get "Debian is Owned by the NSA".

Perhaps Debian will get more funding, now when it is officially out :-)

The thing is, corporate operating systems such as Windows and iOS can certainly not be trusted more than open-source code. I'd say even less. So Debian being owned would be really bad.

Debian's 2006 PRNG anyone?! Maybe these are stupid dumb mistakes, but if I were NSA this is exactly how I'd implement backdoors. 2 lines of code cloned here (go to fail), 2 lines of code commented out there (Debian PRNG issue), and just like that you create huge vulnerabilities in the system. Hard to notice, and impossible to blame on anyone. Everytime they seem to be some brilliant "stupid mistakes".

And as others have said, do listen to the FreeBSD developer's talk on NSA' ORCHESTRA operation (subverting open source projects):

https://www.youtube.com/watch?v=fwcl17Q0bpk

While I agree with the author's message, I can't say that any other alternative is more trustworthy.

At least in the case of FOSS, the general public is able to review and catch issues like this. In the case of Apple or Microsoft, there's not much you can do when they say, 'trust us, it's secure'.

Also, what was up with the slight dig at systemd? Can anyone explain why systemd is such a hot topic? I've been using it for almost a year now, and I find it much easier than the alternatives...