Slashdot Mirror
European Commission Recommends OSS to Fight Echelon
CrossRhythm writes: "The European Commission Resolution on Echelon encourages the Commission and Member States "to promote software projects whose source text is made public", to lay down a standard for the level of security of e-mail software packages, placing those packages whose source code has not been made public in the "least reliable" category," and "systematically to encrypt e-mails, so that ultimately encryption becomes the norm"."
If only their webserver were built from Lego:
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC SQL Server Driver][SQL Server]Line 1: Incorrect syntax near ''.
/inventions/invention.asp, line 64
So this would be a good reason for governments to fund the development of open source applications.
Hopefully they'll do..
J.
Tongue-tied and twisted, just an earthbound misfit, I.
I may be wrong, but it sounds like MS' totally bogus "shared source" will move MS from "least reliable" to something better.
The article is pretty long, so perhaps I missed something....
room101 -- how much can you stand before they break you?
(they always break you eventually)
If your goal is encrypted e-mail, what does the source code have to do with anything? As long as it follows published encryption algorithms, that's all that matters. After all, if it doesn't follow the standard, then it's kind of hard to decrypt it.
I think it's a tad more important for the underlying mathematics to be tight, than to be able to view the source code implementation of an inferior algorithm.
Sometimes it's best to just let stupid people be stupid.
will probably kick it's citizens arses for so much as rot13'ing their emails.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
Looks like another government is starting to advocate OSS's security. Good for them. Maybe someday companies and users will start to realize that all these hacker attacks and viruses are cause by MS's insecure software
-all dead homiez
It's interesting to see that Europe is more openminded towards OSS than the US is. If they do things like this.. pass legislation to encourage OSS development. I could see how programmers would see countries in the EU as kind of a haven. Especially if they didn't arrest them on site like a certain country i know of...
- "Never let a computer tell me shit." - DelTron Zero
This is so wrong that I don't even know where to start.
The program can use published algorithms everywhere, but if it RSA encrypts your message in the FBI's public key, and mails it to them (as well as encrypting as it should be and mailing to your friend), then it isn't exactly a secure email program. The only way to know if the program is doing stuff like this is to READ THE SOURCE.
To trust that a security-related program does not have a back door, you need the source. Period.*
*You could try to watch outgoing network connections, but this is a hack as you may not be able to figure out what it is sending since it could be encrypted. Having the source is a much more reliable method of spotting back doors.
AFAIK, Echelon wiretapping is done at the physical layer level; it has nothing to do with trapdoors in the software itself. It would still be done with Linux in every desktop, cell phone and fax machine.
It's just a BloJJ
end-to-end mail encryption schema/idea:
1) sender checks compliancy of target machine. if encryption protocol is installed, message is encrypted.
2) sender encrypts message.
3) single use key is stored on originating server
4) encrypted message is transported to target machine
5) target machine receives message and reads encryption headers
6) target machine requests one time key from sender
7) simple security checks, this can be spoofed I'm sure, but try and validate 8he authenticity of the one-time key request. Flag and send a message to the sender if things seem out of order, or reject request.
9) if request is valid, send key and delete one-time key from server
10) further requests will be denied (so if a message gets intercepted and someone tried to get the key, if/when the actual target tries to unencrypt, they can get a notification that the key has already been used. they have to option to flag a message back to the sender notifying them of a possible breach.
I dunno, this might work, then again I'm not a mail or encryption expert.
Hammer of Truth
This is very good news. The next time I find a government-connected website, (or anything funded or contracted by the government for that matter) which does not work in Mozilla, I'll be emailing them a link to this page.
Ever since I read that the EU was looking into anti-trust/price-fixing violations by the record and movie companies, and now are looking at M$, I think that maybe the EU will save the US from itself..
Jim
Last time I looked adultery was against the law in Austria.
I guess it must be illegal in the US because they just prosecuted a man there for polygamy, which is impossible.
After all, the law says you can't marry while you are already married, therefore you are not married to the supposed second bride. I can see the problem if someone from a muslim country came in with multiple wives (legally married elsewhere), but that was not the case with the USian guy.
So it must have been for adultery (or possibly fraud if various marriage related allowences were falsely claimed).
As is well documented in Mein Kampf (1923) and biographies of the guy.
Although the British can claim the invention of concentration camps, in the Boer war.
After all, most US boys have their bits chopped off. If that's not persuasive power I don't know what is.
The recent ssh vulnerability is a good example of why this is wrong. The encryption methods can be entirely open (hell, they can be secure, even) but the app can still end up being vulnerable because it leaks some piece of information that the programmer didn't realize was sensitive -- like the timing between key presses.
Those of us in the US, on the other hand, have principles in the government (the VP for example) who have attempted to make information security and encryption illegal.
Guess that'll be payback for WWII... and then all the money the U.S. funneled into Europe following the war to get the economy back on track.
;)
It's good to have allies
The proper solution is to encrypt all your IP traffic through IPsec tunnels. Recent work within the IETF has given new ideas about how to start performing automatic IPsec connections with any host you can speak with. This is the type of solution that will help battle echelon like networks.
The next site to slashdot will be ready soon, but subscribers can beat the rush and start slashdotting it early!
The difference being that the U.S. didn't systematically kill off (or attempt to) a race of people... it was just forced relocation. Of course, that has happened for centuries. What happened in Europe w/ Hitler was that he affected a group of people that was so widely distributed it caused panic in other countries.
However, if Hitler *only* enslaved the Jewish people, there would have not been a WWII. It would have been a dictatorship with governmental prejudices... just like many Arabic nations nowadays where they relocate people of certain ethnic origins (e.g. the Yugoslavia, Iraq, Iran, Isreal...).
Also, let's not forget that the Indians we so busy trying to either wipe out or otherwise dominate other tribes that they were there own worst enemies. By the time of the Trial of Tears, etc., the Iroquois Nation had decimated all the other tribes in the Ohio valley to be point that they were totally subservient to British and French traders.
The root cause of Pontiacs Revolt after the French and Indian War was that the British stopped trading with the Indians. They were furious that the British would no longer sell them alcohol or gun powder.
Doing secure email is a solved problem; use PGP or S/MIME. We need more, easy-to-use implementations, not new protocols.
With European governments wise to Echelon and MSFT's complicity with the US requests to make certain back doors...it would not be in the US's best interest to speed adoption of OSS software by breaking MSFT's stranglehold on competition.
While I'm stretching a bit, I don't doubt this is inline with the thinking in Washington (or would that be Virginia?).
-- @rjamestaylor on Ello
what is the guarantee that the code which one has access to is the exact same code which is in the shipped package? slip um a mickey! or tracking functions...
Correct me if I'm wrong...
--Charlie
Encrypting everything via IPsec tunnels will stop echelon specifically, but not all "attacks" such as Carnivore.
Anything that monitors the email server rather than simply sniffing traffic will be able to sidestep the IPsec tunnel (assuming we are still using email and not some p2p tunneling mail protocol). Although it would be nice and much easier to just implement IPsec across the board (and easier still once IPv6 is more widely adopted), to stop system attacks rather than just network atacks requires encrypting each message. Oh well.
"He's more machine now than man, twisted and evil."
Correct me if I'm wrong...
I'm afraid you're wrong. IPsec has it's own method of tunneling that isn't based on GRE.
Now, what you could have noted was the internet-draft I pointed to required storing keys within secure-dns, which hasn't been deployed yet either...
The next site to slashdot will be ready soon, but subscribers can beat the rush and start slashdotting it early!
As anyone following the news might know, France is using Linux in most of its wiring of public schools, and many french firms are adopting OSS for their software needs.
While some posters are correct that the UK is not pro-OSS in many respects, and certainly anti-privacy, Europe is not a monolith. OSS is spreading throughout northern Europe (Scandinavia), Germany, France, Spain, Italy, and so on.
None of this will defeat Echelon, however, so long as the UK sits in the middle of the pipe, feeding any data that comes through Gibralter and England to the US. So, without strong encryption of normal traffic, and a move to IPv6sec, Echelon will continue to survive and prosper.
--- Will in Seattle - What are you doing to fight the War?
Mmmkay, so Open-Source software is better. And Microsoft is a bunch of NSA luvin bastards.
I heard this before.
(I am a very-new-newbie to linux so don't take this the wrong way)
If OSS software developers were so concerned, why is there no industrial-strength ultra crypto distro(is that the term?) of linux with really kewl desktop themes and special ZoneAlarm-type-firewall, Serv-U-FTP looking encrypted FTP & other super-duper features.
I think there was awhile back by the name of Paranoid Linux or something like that.
Why wasn't there a demand for an ultra-secure version of linux. Just because you might not be commiting computer(or other) crimes is not a reason to run an unsecure OS.
http://www.angryburrito.com/ The best, completely unfinished software review site ever.
As I was updating this site [Dutch Ministry of Education, Culture and Science], I couldn't help noticing these questions [in Dutch, for Loek Hermans, minister] asked in parliament this week.
:)
I was surprised to see some politicians here who seem to be aware of the consequences of the draconian Microsoft licensing coming up. So I decided to (try to) post some of them in english below.
Disclaimer: translating is not part of my job, I'm not an politician and I don't represent anybody. I only do www-tech-stuff, thank you.
1-4, summary:
Did the minister calculate the amount of extra millions of money needed if schools, universities, government, etc. need these new [XP-type] Microsoft licenses?
5
Which other consequences does the new operating system [Microsoft] have in combination with the new licensing system, for Kennisnet and connected schools?
(translated: Knowledgenet - an Internet-based network of primary(?) schools for kids, parents, teachers, etc.])
6
Which actions did you take in the past to inform schools about the Microsoft trap?
7
Which actions are undertaken now or in the near future to minimize negative consequences for schools? Are you willing [...] to focus their attention on alternatives like MacOS, Linux and FreeBSD?
8
How are you going to prevent that the government, and users and visitors of websites of the government, become dependant on only the Microsoft operating system?
9
Are you willing to investigate how can be assured that information from the government will remain accessible for all Internet users, despite their chosen operating system, or Internet-browser they use?
Did you notice 'the Microsoft trap' in (6)? Not just a MS trap, or another MS trap, but the one and only.
Although I like the question, I think the choice of words makes it look rather clumsy (for a politician, that is), or very MS-unfriendly. Which I find funny. I guess.
It usually takes months before answers are put online, unfortunately.
...a fact which for the sake of a quiet life most people tend to ignore ~H2G2
What you would really want is IPsec encryption and heavy PGP encryption on all documents going over the wire especially for common services like email, ftp transfers, etc.
Okay so you've cracked my email server now you have access to a bunch of headers and a lot of encrypted garbage. You crack my ftp server and you've got nothing but encrypted files.
... such as Microsoft? We all know about the heaps of voulnerablities in MSFT software, and they're the largest SW company in the world and very well-known.
In any case, you would have to trust the certifier.
With a well-known open-source project, you only need to trust stastics. You only need to trust that there will be one person out of thousands that is experienced enough to find the hole and isn't looking for personal gain for covering it up (like the product vendor or an 'expert' hired by it might).
Not satsified yet? Hire your own expert to test the code.
Make even shorter URLs - 8LN.org
Jantastic makes good points. While the EUs privacy endorsing position may give some a warm fuzzy feeling, please remember that one of their members, the UK, has no qualms whatsoever about placing cameras on every square foot of public property and that those same cameras record every activity of citizens, running their faces through FR software to determine if they should be arrested.
Geez.
LINUX: The Power of Choice
However, if Hitler *only* enslaved the Jewish people, there would have not been a WWII. It would have been a dictatorship with governmental prejudices... just like many Arabic nations nowadays where they relocate people of certain ethnic origins (e.g. the Yugoslavia, Iraq, Iran, Isreal...).
More open minded?!
Say, where exactly do you live?
Last time I checked, Europeans, or at least non-English-and-non-French-speaking-Europeans were actually quite conservative.