Slashdot Mirror
Jacob Appelbaum on How OSS Improves Cryptography
destinyland writes "Jacob Appelbaum, the Tor Project's main advocate, argues that Open Source software is necessary 'to both verify and improve' available cryptography. (Adding 'We also need that to ensure that everyone has a reasonable baseline — which is part of the cypherpunk ethos.') In this new interview, he's critical of a general public silence over government encroachments on privacy, but points to the current impact of the Tor network now as something that 'runs, is open and is supported by a large community spread across all walks of life.' And he ultimately identifies Tor as 'part of an ecosystem of software that helps people regain and reclaim their autonomy,' saying the distributed anonymous network 'helps to enable people to have agency of all kinds; it helps others to help each other and it helps you to help yourself.'"
They make running or using a proxy illegal. They have the power to do that you know. Doing that technologically though, is a whole different beast.
If the source and implementation is closed it could be backdoored from the kernel to the compiler to the random number generator to the crypto algorithm implementation.
Here is a problem though, since Windows is closed source what good is Tor or crypto in that environment? If you have to use crypto for any reason other than to protect your passwords then its probably at risk whether you use open source or not. Just one bug or backdoor allowing a RAT to interface with your computer and gain root/superuser or anything like that and all your keys are compromised. Key generation would have to be done in hardware. Entropy is also an issue you probably wont easily solve. There is a very long way to go before any crypto implementation will be secure and mainstream. Linux has not changed that game because you install one wrong piece of software and you've got a backdoor and it could be disguised as a legit piece of software. Since not every piece of software run on Linux is open source you don't know for a fact.
It also lets me easily see exactly what's being done, so I can more easily find a workaround or an exploit.
They'll just put anyone who uses it under the most intense surveillance, hack their computers, creep into their house when they aren't around, etc. This is effectively better than making it illegal because it gives users a false sense of security. While they use Tor, they are being monitored by the secret services.
Tor does not prevent monitoring or surveillance. Surveillance that can see everything you do at your computer, everything you type, etc. What good is Tor under surveillance? It's useless if you're using it to go against the government.
Even OSS can be vulnerable
there neighbour started doing this 4 only about and as of now took care of the mortgage on there condo and got a top of the range Renault 4. go to,
"There" neighbour bought a "top of the range Renault 4"? Seriously?!
:-)
It makes a change from lying to us that he bought a Ferrari, or some other bullshit... perhaps you're trying to appeal to people who like 1960s and 70s French economy cars...
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
In this new interview, he's critical of a general public silence over government encroachments on privacy
That is an important issue. But what I see is an even greater silence over corporate encroachment on privacy. Left alone, I think corporations could cause even greater damage (in part because of it's huge influence on government). So this is where I focus my efforts. Things like big banks sharing out financial details ... just for profit.
now we need to go OSS in diesel cars
No one is saying that being open source makes your software invulnerable, just that it makes exploitation harder. Being open source is necessary but not sufficient for a software package to be considered secure. In this context open source can simply mean that the source is available to the customers and their auditors only, not the whole world.
Not a sentence!
So OSS means something a little different when I see it.
Why stop at Linux?
What good does it do to run software on Linux when you run on an Intel CPU with proprietary microcode?
You have obviously not *studied* security, although you raise real concerns. A security analysis requires defining a threat model.
The more obscure the threat model (such as Intel injecting a Tor backdoor into the microcode of its CPUs), the less weight it is given.
I thought the OSS was supposed to break cryptography?
Yeah, and Ken Thompson's proposal is very brittle. If I've got two C compilers that aren't rigged in exactly the same way, I can defeat his mechanism almost trivially, and detect it almost as easily. If you get all your software from one source (*cough*Microsoft*cough*), you can't trust it any more than you can trust its source. If it's closed-source (*cough*Visual Studio*cough*), you either try to reverse-engineer it from the binary or trust (or not trust) it as is.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Afaik the core work done on the current Intel microprocessors comes from their Israeli subsidiary. Think what they could have done to 80% of the world's PCs.
This might be conjecture, but the Zionists have the habit to break the rules all the time. We just don't hear it because they play a pivotal role in the west and most of the journalists are corrupt whores who will cave in as soon as "anti-semitism" is mentioned.
Terror by the Jews is politically correct and only when somebody else does it, there are bad vibes.
We better get ourselves some GNUprocessors with the VHDL inspectable for everybody.
A start might be http://en.wikipedia.org/wiki/OpenSPARC
You use as many compilers you can get your hands on and compile the compiler in question on each platform/compiler. Slow and exotic compilers are welcome, too, as you need them only once. Then each of the resulting binaries will compile the compiler again. You perform an md5 fingerprint on all of the secondary executables. They must all be the same, if there is nothing fishy.
If they are not identical, you do a binary diff and nail down the malware. Dead easy and mechanical.
This scenario is about as dangerous as "virus custom-designed to kill the pres-or-dent".
Why stop at Linux?
What good does it do to run software on Linux when you run on an Intel CPU with proprietary microcode?
You have obviously not *studied* security, although you raise real concerns. A security analysis requires defining a threat model.
The more obscure the threat model (such as Intel injecting a Tor backdoor into the microcode of its CPUs), the less weight it is given.
I'm not using an Intel based CPU. That being said I'm aware of that and other potential backdoors which is why I said what I said.
Afaik the core work done on the current Intel microprocessors comes from their Israeli subsidiary. Think what they could have done to 80% of the world's PCs.
This might be conjecture, but the Zionists have the habit to break the rules all the time.
Second that.
If I had mod points I'd donate 'em all to you, gladly.