Richard Stallman Speaks About Back Doors After NSA Documents Leak

An anonymous reader writes "Companies such as Microsoft, Facebook, Apple, and Google are scrambling to restore trust amid fresh litigation over the PRISM surveillance program. Richard Stallman, the founder of the Free Software Foundation and a newly-inducted member of the 2013 Internet Hall of Fame, speaks about not only abandoning the cloud, which he warned about 5 years ago, but also escaping software with back doors. 'I don't think the US government should use operating systems made in China,' he says in this new interview, 'for the same reason that most governments shouldn't use operating systems made in the US and in fact we just got proof since Microsoft is now known to be telling the NSA about bugs in Windows before it fixes them.'"

Comments

Abandoning the cloud ?

[vikingpower]

Stallman is right, in sofar that any sensible engineer should never have had his works, artefacts, algorithms and data "in" the cloud. Period.

Re:Abandoning the cloud ?

[ls671]

Duh ;-)

Re:Abandoning the cloud ?

[Tom]

Disclaimer: I am an IT Security professional.

It all depends on your thread scenario. Most of the smaller side-projects I work on are of no interest to any entity able to intercept the data transfers, so I don't mind storing stuff in, say, Evernote or Dropbox where it is more convenient to do so.

The stuff that the survival of my small company depends on, running my own servers is worth the effort. For my holiday pictures, iCloud is perfectly acceptable.

Re:Abandoning the cloud ?

[Traiano]

Are you kidding? The cloud is just a rebranding of networked systems. If you fear the cloud you might as well disconnect your networks.

Re:Abandoning the cloud ?

[vikingpower]

I do not "fear" the cloud. I do hate, however, the hype, with stratospheric hate.

Re:Abandoning the cloud ?

[martin-boundary]

No it's not. A classical networked system belongs to a single company, and there's a clear separation between the inside (which is mostly trusted) and the outside (which is not trusted). A cloud system blurs the distinction, so you never know if the stuff you're accessing is actually being used by untrusted people who are going to steal your secrets, blackmail you, etc.

Re:Abandoning the cloud ?

[Anonymous Coward]

Yes, please, disconnect your networks! Not everything needs to be connected to the internets!

The cloud is still fine for your cat videos that you want to share with the world.

Re:Abandoning the cloud ?

[ls671]

Well, I do not "hate" the hype, I just find it funny. Along the same way as the GP has said, and one poster above disclaiming he was an " IT Security professional":

If you are planning doomsday scenarios, then don't have you computers connected to anything. I have been running my systems for 20 years without any intrusion that I am aware of. This doesn't mean I am not owned. So yes, you could put some stuff on the cloud. From an "IT Security professional" point of view: you categorize the levels of security you are comfortable with and act accordingly.

Nothing is 100% secure unless it is completely disconnected from any network, nobody has the passwd to login and the power is off.

Re:Abandoning the cloud ?

[ls671]

It just makes it a tad harder to categorize your levels of security. Since brains to do that properly are rather seldom, it may end up up costing you more money to put stuff on the cloud if you want to do it properly.

Re:Abandoning the cloud ?

[Lumpy]

Anyone that has a secure network does just that.

It's not fear, it's trust. and no, I do not TRUST the cloud with things that if they are lost I lose money. Only a complete fool would trust another company with their critical data and a TOS that says ,"we are not liable"

Re:Abandoning the cloud ?

[Anonymous Coward]

A classical networked system belongs to a single company, and there's a clear separation between the inside (which is mostly trusted) and the outside (which is not trusted).

Is there? Even apart from The Cloud, few companies have their own datacenters. Once anybody else has physical access to your servers (even if you own them), the separation starts to blur.

Avoiding The Cloud is possible, but I cannot see companies returning to in-house datacenters.

Re:Abandoning the cloud ?

[Yvanhoe]

Linus is thinking otherwise : "Only wimps use tape backup: _real_ men just upload their important stuff on ftp, and let the rest of the world mirror it"

Actually, the cloud is perfect for any open development.

Re:Abandoning the cloud ?

[drinkypoo]

it may end up up costing you more money to put stuff on the cloud if you want to do it properly.

If your data is sensitive, there is absolutely no way to process it in the cloud properly. The data has to be decrypted to a usable form before it can be processed. Cloud storage? OK, but why would you do that without actually doing your processing in the cloud, too? There's other solutions for backups which would cost less and leave you less confused about where your data is located.

Re:Abandoning the cloud ?

[RabidReindeer]

Disclaimer: I am an IT Security professional.

It all depends on your thread scenario. Most of the smaller side-projects I work on are of no interest to any entity able to intercept the data transfers, so I don't mind storing stuff in, say, Evernote or Dropbox where it is more convenient to do so.

The stuff that the survival of my small company depends on, running my own servers is worth the effort. For my holiday pictures, iCloud is perfectly acceptable.

I might go along with that except for the fact that the US Government is heavily involved with metadata. Metadata is still data and there are things that can be done with that data or they wouldn't be be collecting it. You may not like some of the things they do with that data.

And, for your sake, I hope that your holidays were all spent in good solid loyal patriotic places in the USA so that there's nothing treasonous that they can infer from the pictures once they use the metadata to get a FISA warrant to look at the actual data.

In an era when almost everyone either deals with offshore companies or has immigrant friends or neighbours, the assurance that "only foreign communications are examined" doesn't give much comfort.

Re:Abandoning the cloud ?

[RabidReindeer]

Are you kidding? The cloud is just a rebranding of networked systems. If you fear the cloud you might as well disconnect your networks.

No it isn't. Cloud servers - excepting the in-house clouds - are owned and operated by third parties. Who can be silently descended on by grim suit-wearing individuals with badges and pried open without your permission. Or your knowledge, since many of these programs make it a criminal offense to even mention the prying.

You don't even have to be the primary target, since you are sharing the resources with who knows what other questionable characters. More than one innocent business has been bitten because it turned out the next rack over leased space to Arab charities or hosted some sort of downloading service.

Re:Abandoning the cloud ?

[RobertNotBob]

Tom,

With all due deference to a slashdotter with a 3 digit UID, I'd like to point out the danger of your last statement.

Primarily, the risk is that your smaller, side-projects may indeed pan out to be your primary revenue stream in the business environment of the future. But the consolidation affect is at least as dangerous. The conclusions that can be drawn by a talented analysts from the sum total of your small, seemingly insignificant data leaks can be staggeringly powerful. And if you think that your company is not worth the time of a talented analyst, then you may not have been paying attention to the cultural make-up of our current competitors in the world today. -- They take the time to analyze everything they can.

Now, I don't want to go off on a rant... but I did want to throw that out.

...

That said... Sure. Holiday pics fit nicely into a cloud.

Re:Abandoning the cloud ?

[ls671]

Nothing is black nor white, just in between to various degrees. I do not use the cloud for now but I ain't saying it shouldn't make sense in any scenarios. Some level of security do not require encryption at all, especially when it is already categorized as "public" ;-)

Re:Abandoning the cloud ?

[Arkham]

Disclaimer: I am an IT Security professional.

It all depends on your thread scenario. Most of the smaller side-projects I work on are of no interest to any entity able to intercept the data transfers, so I don't mind storing stuff in, say, Evernote or Dropbox where it is more convenient to do so.

The stuff that the survival of my small company depends on, running my own servers is worth the effort. For my holiday pictures, iCloud is perfectly acceptable.

I don't have any data under my personal control that I care if the government intercepts. My email is boring as hell. The most interesting thing in my email is when Blizzard locks my Battle.net account because I tried to log in from work and they think my IP changed. My Dropbox is full of junk I want to transfer between computers and nightly binaries that I want to share with our Ukrainian QA team. Really exciting stuff. Hack away, people, hack away. I care not. The pieces of data that I wouldn't want stolen (SSN, bank accounts) aren't in my personal control anyway.

As to the quote about operating systems mad in China... what OS is that exactly? Neither Apple nor Microsoft develop their OS's in China. If any OS has Chinese developers, it's Linux. Red herring.

Re:Abandoning the cloud ?

[SirGarlon]

In an era when almost everyone either deals with offshore companies or has immigrant friends or neighbours, the assurance that "only foreign communications are examined" doesn't give much comfort.

In an era where the NSA lied about the existence of the program, lied about the level of oversight, lied about the effectiveness of the program, and lied about what data was collected, ANY assurance from the executive branch doesn't give much comfort.

Re:Abandoning the cloud ?

[drinkypoo]

If your data is sensitive, there is absolutely no way to process it in the cloud properly.

Some level of security do not require encryption at all

Why don't you do the world a favor, and read comments before replying to them? It would lead you to leave less irrelevant, offtopic comments.

Re:Abandoning the cloud ?

[serviscope_minor]

there is absolutely no way to process it in the cloud properly

Sure there is. It's called homomorphic encryption.

Re:Abandoning the cloud ?

[ls671]

Also, think in a counter-intelligence scenario, where you would use the cloud as a honey-pot or a facade.

Re:Abandoning the cloud ?

[OldCodger]

But where were you when you posted your holiday snaps? That's the real 'meta'data they are collecting.

Re:Abandoning the cloud ?

[drinkypoo]

Sure there is. It's called homomorphic encryption.

I'm aware of its existence, but the field is too new to trust, and too complex for most programmers to utilize.

Re:Abandoning the cloud ?

[IDtheTarget]

Disclaimer: I am an IT Security professional.

It all depends on your thread scenario. Most of the smaller side-projects I work on are of no interest to any entity able to intercept the data transfers, so I don't mind storing stuff in, say, Evernote or Dropbox where it is more convenient to do so.

The stuff that the survival of my small company depends on, running my own servers is worth the effort. For my holiday pictures, iCloud is perfectly acceptable.

I am also a security professional, and I mirrored your attitude until just a few weeks ago. Silly me, I figured that nobody cared to which political party I belonged, nor what religious group, nor that I am military and actually believe in the constitution. Unfortunately, it turns out that in our government, you may indeed be targeted based upon any of the above.

And now, there are indications (I can't find the article), that you will be targeted if you attempt to maintain your privacy from the government on these things by using encryption, etc. (And I'll probably go up on several watch-lists due to this post. *sigh*.)

To be honest, I'm not really sure what to do. You're damned if you do, and damned if you don't.

Re:Abandoning the cloud ?

[rjstanford]

The pieces of data that I wouldn't want stolen (SSN, bank accounts) aren't in my personal control anyway.

Interesting examples. Your SSN is not and was never intended to be private and confidential - entities using it as both an identifier and a password were misguided to say the least. As for your bank account information, your checking routing and account numbers at least are also effectively public in that you share them with everyone you've ever handed a paper check to.

Re:Abandoning the cloud ?

[ls671]

ok sir practice what you preach, from my own posts:

"It just makes it a tad harder to categorize your levels of security."

and, a little above what you replied to:

"you categorize the levels of security you are comfortable with and act accordingly."

You started your reply with "If your data is sensitive" which is a proof that you didn't read my comment properly.

Furthermore, encrypting/decrypting the data is only a little part on how you set rules for each level of security. Don't let encryption fool you ;-)

Re:Abandoning the cloud ?

[Anonymous Coward]

I'm quite sure, technically speaking, the nicest thing you could do in that scenario for the agencies involved is to avoid the internet for mundane things. You reduce the total amount of data known and concentrate your data footprint to only those things that are most salient and demand communication with another human being. Unless you are going completely communication free then you are probably "safe"... that is unless cutting yourself off from communication puts you on some sort of right wing watch list and your physical property gets bugged as a result.

Re:Abandoning the cloud ?

[Jawnn]

Stallman is right, in sofar that any sensible engineer should never have had his works, artefacts (sic), algorithms and data solely "in" the cloud. Period.

TFTFY... Period.

Re:Abandoning the cloud ?

[SuricouRaven]

If you include embedded devices, quite a lot of it uses OS from China. Anything from Huawei for a start - that alone has some people in Congress and the military concerned.

Re:Abandoning the cloud ?

[Jawnn]

No it's not. A classical networked system belongs to a single company, and there's a clear separation between the inside (which is mostly trusted) and the outside (which is not trusted). A cloud system blurs the distinction, so you never know if the stuff you're accessing is actually being used by untrusted people who are going to steal your secrets, blackmail you, etc.

Actually, it's not blurry at all, if you take the time to think about what you are doing, ...or are encumbered by compliance issues that require you to care. If it's something that might be in any way sensitive, it can't be safely stored "in the cloud", without taking certain precautions, e.g. solid encryption. Likewise, if it's loss would be felt, storing a thing solely in the cloud is arguably foolish.

Re:Abandoning the cloud ?

[Anonymous Coward]

To be honest, I'm not really sure what to do. You're damned if you do, and damned if you don't.

I feel the same way. One unequivocally good thing to do, though, is to attempt to spread universal adaption of encryption, which the revelation of the scandal gives an opportunity for.

Re:Abandoning the cloud ?

[SilentStaid]

Until someone picks up the old, powered down and presumably discarded box with tons of sensitive data on it, and puts it in the recycle bin where it is trash picked by someone looking for spare parts...

Fire. Kill it with fire.

Re:Abandoning the cloud ?

[ls671]

Nah, you put the machine in a safe and the safe is actively guarded. I heard rumors of some people doing just that with their CA.

https://en.wikipedia.org/wiki/Certificate_authority

Re:Abandoning the cloud ?

[Anonymous Coward]

Tom,

With all due deference to a slashdotter with a 3 digit UID, I'd like to point out the danger of your last statement.

Primarily, the risk is that your smaller, side-projects may indeed pan out to be your primary revenue stream in the business environment of the future. But the consolidation affect is at least as dangerous. The conclusions that can be drawn by a talented analysts from the sum total of your small, seemingly insignificant data leaks can be staggeringly powerful. And if you think that your company is not worth the time of a talented analyst, then you may not have been paying attention to the cultural make-up of our current competitors in the world today. -- They take the time to analyze everything they can.

Now, I don't want to go off on a rant... but I did want to throw that out.

...

That said... Sure. Holiday pics fit nicely into a cloud.

When the Government uses that same reasoning to decide what to classify, you all scream that they are over-classifying and trying to hide things that might merely make them look bad.

Re:Abandoning the cloud ?

[kilfarsnar]

Well, I do not "hate" the hype, I just find it funny.

I hate the hype because it brings around Associate Principals who think they're "tech savvy" constantly asking me if we can do this or that in the "cloud".

Re:Abandoning the cloud ?

[Anonymous Coward]

Just to add my 2 cents. While a service I used to operate is hardly a cloud, it by definition stored user data (images), and something that was routine was to check for warez dumps on the site by looking for images and non-images over 2MB a piece.

This was before some of this DMCA safe harbor stuff came up. Since then it's basically wait until either the site is compromised (eg malware) or the owner wants the site removed. The only copyright owners who really give a shit to contact us are part of the mouse family, and for what was basically overreach.

Re:Abandoning the cloud ?

[cold fjord]

To be honest, I'm not really sure what to do. You're damned if you do, and damned if you don't.

You'll be on fairly safe grounds if you write your legislators.

The admitted and demonstrated oppression of political and religious groups by the IRS must end. It is a clear and present danger to democracy with no redeeming aspect, nor even a fig leaf to hide behind.

Re:Abandoning the cloud ?

[ls671]

I know the challenge, believe me. It has been like that with many "hypes" before that one. Same old, same old. Well do your best at explaining it to them but keep in mind there are chances they will discard you opinion. In that case, just learn to live with it and continue working with the team as best as you can.

Re:Abandoning the cloud ?

[MTEK]

Red herring Linux? hmm, very sneaky of those guys!

Re:Abandoning the cloud ?

[awyeah]

Out of curiosity, have you found a self-hosted application similar to Evernote? For Dropbox, there's Owncloud, but I haven't found anything like Evernote.

Re:Abandoning the cloud ?

[UltraZelda64]

You could always power it back on with a wake-on-LAN request. :)
Just forget all the other crap and unplug the tower completely, put it in a safe, and hide it somewhere in a closet or something...

Re:Abandoning the cloud ?

[judoguy]

Use the cloud properly. Use it to build the image that you want to portray to the police state America is turning into.

Store the stable family photos, not the gun collection. Store the happy day at the beach, not the vacation to Malaysia.

Don't actually use it for serious personal stuff.

Re:Abandoning the cloud ?

[TheRaven64]

With the exception of a very few fairly simple algorithms, anything that you can do in the cloud using homomorphic encryption, you can also do on your laptop without it...

Re:Abandoning the cloud ?

[ls671]

Exactly:

http://slashdot.org/comments.pl?sid=3913639&cid=44131679

Re:Abandoning the cloud ?

[mlts]

Even if one has an insecure, but reliable service, that can come in handy, factoring in a threat model:

1: Before sending files to a cloud provider with an archival service, I use an archiving program, split the files up into segments (100-200 megs), then encrypt the segments with GPG and a decent passphrase. Not 100%, but it would force someone who manages to get access to have to try to compromise my endpoint or me (not hard, but it is a lot tougher than just passively guzzling out goodies.

2: TrueCrypt is a good enhancer for Dropbox. On Linux/Android, one can use EncFS as another way to securely store files.

Of course, sometimes one doesn't need cloud access to everything. I've found that in a lot of cases, I don't need to store all my archived data on Amazon Glacier. Instead, for most of it, a humble Blu-Ray burner and a utility like DVDisaster to add ECC to an ISO image is good enough for archiving data, especially if one does at least two copies of items, more for critical stuff. Encryption is easily provided, either file based using GPG or even raw OpenSSL, filesystem based using LUKS/TrueCrypt/FileVault, directory based like CFS, EncFS, or PhonebookFS, or archive based (winRAR, 7Zip, newer ZIP format, etc.)

Of course, this doesn't mean that one can forget about it once burned ott. Data should be archived onto two formats if possible, as one doesn't know if a batch of BD media might get a case of bit rot, or the hard disks one is using in a RAID array all get the same firmware bug and fail at the same time.

Re:Abandoning the cloud ?

[Anonymous Coward]

What's the big deal? NSA is all about breaking codes. It sees code, it thinks 'hmm, can I break this code, or can storing the information associated with it help me later?' ... from your comments, you are not a security professional of the level these guys play on.

Re:Abandoning the cloud ?

[RabidReindeer]

Hmmm. The geotags for this set of beach pictures show that they weren't too far from this daycare center run by a couple whose mother-in-law is from Lebanon.

TERRORISTS!

Re:Abandoning the cloud ?

[Anonymous Coward]

How about the bluest of blue; IBM? IBM has been on a 10 year itch to reduce American and hire Chinese designers and developers.

Re:Abandoning the cloud ?

[jedidiah]

The cloud is networked systems that someone ELSE owns and controls. These other people can choose to betray you at any moment. They could simply discontinue service without notice.

They can also just suck.

It seems like a week doesn't go by that someone's Yahoo account isn't being abused for spam and trojans.

Re:Abandoning the cloud ?

[SJHiIlman]

That's because the government has massive amounts of power compared to normal people, and history has taught us that power inevitably corrupts. These agencies must not be trusted; it is naive to do otherwise.

Oh, and there's the fact that the government has used the same logic time and time again...

Re:Abandoning the cloud ?

[Mozai]

> For my holiday pictures, iCloud is perfectly acceptable.

You are going to be surprised when those holiday pictures stored in the cloud bite you on the ass later.

Awish Aslam, a second-year political science student at the University of Western Ontario, told CBC News she and a friend were trying to attend a Sunday rally with Harper when they were asked to leave by an RCMP officer. ... Aslam said they were led to the lobby where the officer told them they were no longer welcome because they had ties to the Liberal party. Aslam said the only explanation was her Facebook profile photo showing her posing for a picture with Ignatieff at a recent Liberal rally in London.

CBC News

Re:Abandoning the cloud ?

[SJHiIlman]

The big deal is that they shouldn't be collecting the information to begin with.

Re:Abandoning the cloud ?

[tlhIngan]

I might go along with that except for the fact that the US Government is heavily involved with metadata. Metadata is still data and there are things that can be done with that data or they wouldn't be be collecting it. You may not like some of the things they do with that data.

And, for your sake, I hope that your holidays were all spent in good solid loyal patriotic places in the USA so that there's nothing treasonous that they can infer from the pictures once they use the metadata to get a FISA warrant to look at the actual data.

You realize that once the photos are up publicly (i.e, put online, because you can't have privacy on the Internet no matter what anyone says), the government can get that metadata just like everyone else.

Most people don't scrub their photos of EXIF information, after all, and many places can easily be recognized.

If you're worried about the government gathering data on you from purely public information that's accessible over the Internet, the best solution is to stop posting it on the Internet to begin with!

It is no harder for the government to get information on your trip to Cube from your photos whether you posted it to iCloud, Dropbox, Evernote, Amazon, Azure, or your personal web site or your "personal cloud".

Re:Abandoning the cloud ?

[Anonymous Coward]

To be honest, I'm not really sure what to do. You're damned if you do, and damned if you don't.

Not good at this thinking stuff, eh? The solution is simple: Become one of those who do the damning.

Re:Abandoning the cloud ?

[Anonymous Coward]

Your SSN is not and was never intended to be private and confidential - entities using it as both an identifier and a password were misguided to say the least.

People continually bring this up but I don't see how it changes the reality of the situation. It needs to be private and confidential in today's world because almost everyone will use it as the ultimate evidence of identity without really checking deeper, regardless of whether they should or should not do so.

Re:Abandoning the cloud ?

[Anonymous Coward]

I don't have any data under my personal control that I care if the government intercepts.

Yes you do. You're just ignorant of the fact.

Why do you trust your government so much? Do you really think our government is capable of avoiding the kind of abuse afforded by total secrecy?

Re:Abandoning the cloud ?

[Bert64]

There is a difference between a public and a private cloud... If your data is sensitive in a government sense, then it falls into a few broad security classifications so you simply ensure your data is on a private cloud where all the data is of the same classification and all the users have sufficient clearance levels to see that level of data.
You then get some level of savings, as you can share physical infrastructure costs with other government departments while having access to more processing power at the times you need it, eg the tax office will need extra resources just before the deadline for filing taxes etc.

No point every department running their own servers most of which will be idle most of the time except during one specific peak time when they cant handle the load, maintaining their own admin staff, data centers etc.

Re:Abandoning the cloud ?

[Bert64]

And many companies and large government departments outsource their IT to third parties anyway, even if the physical hardware is kept in house they are typically managed by someone else.

Re:Abandoning the cloud ?

[Shempster]

“Governments constantly choose between telling lies and fighting wars, with the end result always being the same. One will always lead to the other.”

- Thomas Jefferson

Spying on criminal elements of society is one thing, spying on everyone, and assembling metadata into some huge searchable database with a profit motive is another.

I assume all pivacy online is now gone for good. This does not mean it's ok. ie: Privacy in Ubuntu 12.10: Amazon Ads and Data Leaks

Re:Abandoning the cloud ?

[Anonymous Coward]

That's part of the problem he's talking about. The cloud is just too convenient to ignore. But its also being exploited by governments and other entities. All are corruptible in some way or another. Oh but no Xi formerly Blackwater, we all know they're employees are all just so brave and righteous and incorruptible on everything that exists.

Re:Abandoning the cloud ?

[Creepy]

I was going to say they have a good presence in the embedded space, but you beat me to it. For example, I have a Taiwanese motherboard with a power on embedded Linux quick boot (or I can boot normally into Windows or other OSes, including Linux - I can't have a browser up in 3 seconds though, and that's where the embedded Linux shines).

Re:Abandoning the cloud ?

[pluther]

Hmmm. The geotags for this set of beach pictures show that they weren't too far from this daycare center run by a couple whose mother-in-law is from Lebanon.

TERRORISTS!

Not to mention that if the couple both have the same mother-in-law then someone's broken a law somewhere...

Re:Abandoning the cloud ?

[danaris]

And, for your sake, I hope that your holidays were all spent in good solid loyal patriotic places in the USA so that there's nothing treasonous that they can infer from the pictures once they use the metadata to get a FISA warrant to look at the actual data.

Given that the GP has frequently noted in other posts that he is from Germany, and that he was involved in the (now decade-old) deCSS trial, I rather think that vacationing in the USA is one of the last things he wants to do...

For one thing, only if he did spend his holidays on this side of the pond would FISA warrants even be relevant.

Dan Aris

Re:Abandoning the cloud ?

[Anonymous Coward]

And hope that the faces of everyone you vacationed with have been blocked out. I'd hate to be the guy caught eating a sandwich in a cafe behind Julian Assange / Snowden / Manning / public-enemy (read: decent human being) du jour.

Re:Abandoning the cloud ?

[Anonymous Coward]

Yeah, well paranoia comes with the territory...

So, how is it that you call (ed) yourself a 'security professional' and, up until a few weeks ago, you had no indication that the US government routinely gathered information from telcos, monitored overseas communications or made widespread use of PIN registries?

Were you providing security to some un-networked outpost in the Yukon that hasn't had a visitor in the past 4 decades?

Just to get you caught up
1. PIN Registries (who called who and when) have been the primary investigative tool for law enforcement looking into criminal conspiracies since the first electronic switches made it possible to gather them. There is a relatively (compared to getting a judge to authorize a wiretap) low bar to entry and if you can show that there is a relationship between the target and another known criminal, it leads directly to a legal wiretap
2. ECHELON, look it up. three-letter-agencies have been recruiting foreign language students across the country for decades and they were the primary developers of voice-to-text software for a reason.
3. Patriot Act (room 641A), lotsa recent news on this one in the past decade. You should have been paying attention

So, just to sum it up, you are either A) not such a great security professional, B) grossly misrepresenting your knowledge, C) intentionally playing astonished just to whip up a frenzy

Re:Abandoning the cloud ?

[stretch0611]

Sure. Holiday pics fit nicely into a cloud.

Actually even pictures can be a security risk depending on who sees them. If they are recent holiday pics in the snow, while your house is in a location with no snow, it may tell people you are not home and they may decide to rob you.

If there are no tell tale signs of your location in the picture, are you sure you cleaned the metadata? Even a mythbuster can be caught leaving gps information in their pictures.

Even discounting the "Please Rob Me" mentality for a minute... What if you play hooky from work? Is the timestamp on the picture of you at the bar the same day you claimed you were sick? Or was it the night before and you are constantly sick with hangovers? Did you change the timestamp? Are you sure there isn't a daily calendar, clock, or watch in the picture showing the time and date? Even if you do not have any drinking problems and even if you are away on your vacation, some companies cross the boundary into your personal life and may fire you for almost any reason, just ask this teacher from GA. Don't believe this is just aimed at drinking, it may be any illegal activity or even some legal activities that others don't care for. (It could be religious affliations, political rallies, or many other lifestyle choices.)

I can go to an extreme and say you need to watch out for even the most innocent things... How many people are stupid enough to use pet names as passwords than post that pet's picture everywhere. Pictures of cars with your license plate number, calendars with birthdays... A picture of your mom (and captioned as me & mom), who is your facebook friend... And she took back her maiden name after the divorce... oops, there goes my financial identity.

The short answer is nothing in the cloud is safe. Even something innocent can hurt you. Honestly even your posts (and mine) on slashdot can come back to haunt you in the future. You may think I'm a bit paranoid, but how many people still think that after the Snowden NSA leaks?

Now, here we are on slashdot, many of us are tech geeks, and some of us even know better. Even some of us that know better can do stupid things. If we do these stupid things, how bad is the average facebook user?

Re: Abandoning the cloud ?

[Anonymous Coward]

In an era of such profound public ignorance of needs for opsec & surprise at lack of transparency where - plainly - transparency is needed least....

"You can't handle the truth"
--some old dude

Re: Abandoning the cloud ?

[JeffChappell]

Especially during a drone strike

Re:Abandoning the cloud ?

[Anonymous Coward]

And it's purely theoretical.

Re:Abandoning the cloud ?

[iamwahoo2]

I would like to point out that the assertion that the NSA collects metadata is a strawman. A fictitious scenario that was constructed by relabeling plain data as "metadata", because it is perceived to be not as awful as pilfering through personally identifiable information. In fact, phone numbers, Identifying numbers, account numbers, names, times, and dates are all just data. An example of metadata would be something describing the format of a displayed phone number, but the number itself is just pure data. I only bring it up it up because I see even people here on slashdot, who are normally smarter on these issues than the mainstream, are starting to take these falsehoods at face value.

Re:Abandoning the cloud ?

[Anonymous Coward]

...land of the free?

Re:Abandoning the cloud ?

[Anonymous Coward]

I would like to point out that the assertion that the NSA collects metadata is a strawman. A fictitious scenario that was constructed by relabeling plain data as "metadata", because it is perceived to be not as awful as pilfering through personally identifiable information. In fact, phone numbers, Identifying numbers, account numbers, names, times, and dates are all just data. An example of metadata would be something describing the format of a displayed phone number, but the number itself is just pure data. I only bring it up it up because I see even people here on slashdot, who are normally smarter on these issues than the mainstream, are starting to take these falsehoods at face value.

For the purpose of discussing eavesdropping, the data is communication, the metadata is information describing the communication. What is the point of your arguing the definition of "data" anyway, it doesn't make something automatically protected by the 4th amendment.

Phone number call records are not protected any more than the contents of a phone book.

Alice has private communication with Bob. Bob forwards the communication to Charlie.
Alice can't claim 4th amendment protection against search.

A letter sent in the mail without a sealed envelope, is not protected by the 4th amendment from searches.
What is an unencrypted email to your ISP, mail provider, and the recipient's ISP and mail provider? Besides indexed to hell for market research and ad targeting, it's public.

Stallman, and the EFF have been trying to educate you all about the limits of the 4th amendment, and you go on giving Google, Facebook, Apple, Yahoo, Microsoft etc. your information anyway, so why is anyone concerned _now_?

To me, this all sounds like a bunch of confused people who stepped into a phone booth and didn't close the door, or mailed a letter in an unsealed envelope. They argue their freedom has somehow been infringed, or privacy, or both, I can't tell, and it's just kind of pathetic to watch really.

Re:Abandoning the cloud ?

[Anonymous Coward]

Silly me, I figured that nobody cared to which political party I belonged, nor what religious group, nor that I am military and actually believe in the constitution. Unfortunately, it turns out that in our government, you may indeed be targeted based upon any of the above.

What do you mean TARGETED? People are "targeted" every single day for their political party, religious group, military status - by campaigns, advertising, VA loans, so on.

People are even targeted by what shoes they're wearing. What are we even talking about? Is anyone DOING anything to you? Where does your insecurity come from? Here, I just put your /. ID on MY watch list, what are you going to do about it, cry that you're being watched???

You are scared of the U.S. government because..... because... because..... what.

Re:Abandoning the cloud ?

[RabidReindeer]

Phone number call records are not protected any more than the contents of a phone book.

False. YOU try and get those records. They are the private property of the telephone service provider. A similar situation existed in many states where people's automobile and driver license records were being tapped by marketers. The public, when informed, was generally outraged. There is, in fact, an information-sharing law in effect to prohibit the telephone service providers (or any other business) from sharing information except as permitted. You may recall the annual privacy notices.

ANY business records can be demanded upon presentation of a proper warrant, but the furor over the Snowden affair comes from the revelation that the net was being cast too far and too wide.

A letter sent in the mail without a sealed envelope, is not protected by the 4th amendment from searches.

A postcard or other open correspondence may be subject to casual reading, but I am very sceptical that a deliberate program of reading such correspondence is legal, whether by private persons or the government. And I can pretty well guarantee there would be a howl if people learned that the NSA was digitally scanning people's holiday postcards as a matter of routine.

What is an unencrypted email to your ISP, mail provider, and the recipient's ISP and mail provider? Besides indexed to hell for market research and ad targeting, it's public.

Once again, YOU cannot see anyone's email at any time. It is NOT public. Persons may be able to scan email in transit or on servers that they have authorized access to, but unauthorized access is flat-out illegal. We've already had debates over agencies like GMail being able to pick over people's correspondence and the last chapter has yet to be written on that subject. The only reason the ruckus hasn't been louder is that Google is considered more trustworthy than the US Government.

Stallman, and the EFF have been trying to educate you all about the limits of the 4th amendment, and you go on giving Google, Facebook, Apple, Yahoo, Microsoft etc. your information anyway, so why is anyone concerned _now_?

Don't presume to speak for me. I was arguing against Skype's lack of privacy and accountability years ago. I don't post the full details of my life to every social media site on the planet. As a matter of fact, there are limits to even what I'll do with a public library, since, unlike most people, I haven't forgotten the ham-handed tactics the Feds have subjected them to.

Why is anyone concerned now? Practically everyone is concerned now. We used to joke about stuff like this, but more and more we are receiving objective proof that not only are our lives under a microscope, but the degree of inspection and the resources being brought to bear are almost inconceivable. One of the reasons that "innocent people have nothing to hide" gets a pass from people who have no idea that they don't get to determine who is "innocent" has been the assumption that innocent people aren't having data collected on them that can later be used to prove their lack of "innocence". We now know better. We can reasonably infer that both direct and indirect information may be cross-correlated in unexpected ways to draw conclusions and initiate actions that would make Kafka scream in horror. And we now have actual data demonstrating just how all-encompassing the process is. And our only protection is that the people in charge of it all are saying "Trust us. We're only doing what we need to do to keep you safe". We're from the Government, and we're here to help you.

To me, this all sounds like a bunch of confused people who stepped into a phone booth and didn't close the door, or mailed a letter in an unsealed envelope. They argue their freedom has somehow been infringed, or privacy, or both, I can't tell, and it's just kind

Re:Abandoning the cloud ?

[ohmiccurmudgeon]

Stallman is being silly again. The cloud is like a giant parking lot for data. If you leave your data unlocked, of course someone will steal it. Encrypt everything, including the unimportant, so you don't need to remember what's encrypted and what's not. Route your data through anonymizing servers, even your Amazon transactions.

Everyone needs to use encryption, not just the political activists and child pornographers. You have bank statements and health records to protect. No one needs to know what you buy but you. If the world knows what you buy and need, like your collection of garden gnomes, the price of garden gnomes will go up.

Just because you encrypt everything does't mean you can't share. Encryption keys can be split and shared. Some people are working on anonymous group keys so you can subscribe to the online New York Times without getting spam from 3rd parties. I know one fellow who encrypts his Facebook postings with his private key. When I want to read what he has to say I decrypt with his public key. He can use a shared key if he wants to communicate with a particular group of friends.

As for the threat of quantum computers -- its true that quantum computers can factor billions of times faster than conventional computers, but all that means that the average time to break my key has gone from billions of times the age of the universe to merely the age of the universe. I'm not worried yet. I note the U.S. military recommends 1024 bit keys for secret data and 2048 bits for top secret.

Stallman got one part right. You can't trust commercial operating systems. You need to be able to see what you're running to trust it. We don't have a secure cloud because commercial interests aren't concerned with your privacy. They want to track you so they can sell to you. They have not realized that if they are tracking us, they are being tracked. We don't have a secure internet because big companies don't want it. You need to do it yourself.

Encryption is the infrastructure for this century. Use it and insist that others use it.

Re:Abandoning the cloud ?

[martin-boundary]

Sorry, but that's bullshit. Anyone who's done two years of math study can tell you homomorphic encryption is an oxymoron.

Yes 1) you can encrypt numbers, and 2) you can perform some mathematical operations directly in the encrypted domain, BUT (and I cannot emphasise this enough) you cannot perform all 4 mathematical operations (+,-,*,/) without making the encryption TRIVIAL. That's because any ring homomorphism allows you to discover the encryption codes for zero and one, and you can then generate all the encryption codes for all the other integers very simply.

Re:Abandoning the cloud ?

[horusheretic]

Metadata is difficult to define as well. Perhaps they don't store a full phone conversation - but is the source and destination metadata? It's very hard when the definition of metadata is 'A set of data that describes and gives information about other data'. So, perhaps I might say, who I call is not metadata, it is final data, but they might say, 'no it's not, we didn't store your entire convo'. With the term 'meta', it is impossible to know what they are storing. I'm also kind of too apathetic to do anything about it. This is mostly because I don't believe that the flow of information that they are receiving can result in anything meaningful, because the firehose is too large, and will only get larger as more devices are added to the stream. Using that for any type of real analysis is a total pipe dream. At the same time I don't want to defend it, and discuss it often in personal conversations with other people, trying to get them to care. That's why I say almost too apathetic.

Re: Abandoning the cloud ?

[Anonymous Coward]

Not sure if you're joking or just testing us to see if we're reading closely, but what you call a "PIN Registry" is actually a "pen register". How about YOU look it up.

Sadly, that complete lack of understanding -- as opposed to a simple typo -- discredits your entire post. Now you look the fool.

Re:Abandoning the cloud ?

[PuZZleDucK]

More of this... If we are free enough to do so we should _all_ be using TOR a couple of times a week for no good reason at all.

Re: Abandoning the cloud ?

[Anonymous Coward]

That's not a "disclaimer", it's just smug credential dropping. Also, you should probably know that IT people are a laughing stock among real engineers.

Re:Abandoning the cloud ?

[Tom]

Your example has nothing whatsoever to with holiday pictures. Why are you making it?

Re:Abandoning the cloud ?

[Tom]

A wiki does much of what Evernote does, and with a proper UI could probably be almost as comfortable to use.

I do use wikis for a couple of scenarios where few, if any, people besides me access it.

Re:Abandoning the cloud ?

[Tom]

I figured that nobody cared to which political party I belonged, nor what religious group, nor that I am military and actually believe in the constitution. Unfortunately, it turns out that in our government, you may indeed be targeted based upon any of the above.

If your job depends on your political views remaining private then yeah, you should not put them out there on the Internet. But I don't see that as a counter-argument, because it is very much a part of the threat scenario.

I - like pretty much every human being - have a few private details I don't want the world to know. Not because they are illegal or immoral or evil, but simply because they are private and I'd rather not discuss them with strangers. I don't put them on the Internet. Not into public forums, but also not into personal (never call them "private", that's a lie) messages on Facebook or G+ or whatever.

On the other hand, if you want to target me for, say, being an atheist, then by all means go ahead. John Gilmore was not allowed to fly once because he refused to show his ID. He didn't go on the Internet to rant about it, he followed it up with lawyers and challenged the airline rules that required IDs.

The only way to prevent your rights being taken from you is that someone has to fight for them. Sometimes, that someone is you. Most of us are busy with having a life, so we can't do the fighting all the time. But we all should be getting more used to doing it at least every now and then.

If everyone on /. had fought for at least one right at least once in his life, and by "fight" I mean at the price of considerable inconvenience or risk, the world would be a much better place.

Re:Abandoning the cloud ?

[Tom]

Threat scenario.

I don't post to Facebook where I am going before I go on holiday.
After I'm back, I don't mind the world knowing where I was.

Why? Because my threat scenario is burglars, not the NSA following my steps. If the NSA wants to know where I am, they have better sources than evaluating my holiday pictures. Passenger data from the airlines, for example. You're living in a fantasy world if you think the NSA, CIA, FBI, etc. can't get access to those whenever they want them.

Re:Abandoning the cloud ?

[Tom]

Again, it depends on what I am afraid of.

The world is full of dangers. If I were to go to even a reasonable effort to combat all of them, I would be doing nothing else with my life.

In risk management, you quickly learn that some risks can be eliminated, some can be mitigated, some can be insured against, and some you are best of simply accepting.

Most of the time I'm working on something like a dozen small projects at a time. Keeping overhead to a minimum is the only way to make that manageable. That is why using whatever the best, available tool is matters a great deal more than taking precautions against the twice-unlikely scenario of a) this project becoming important so quickly that I don't have time to migrate it and b) some competitor hacking Evernote or Dropbox.

Re:Abandoning the cloud ?

[Tom]

And, for your sake, I hope that your holidays were all spent in good solid loyal patriotic places in the USA

For the record: I'm not a US citizen. Also, the USA can go fuck itself for all I care. I hope I've saved someone the work of classifying me the hard way. :-)

Metadata is still data and there are things that can be done with that data or they wouldn't be be collecting it.

Everyone who has the least interest in security or espionage or diplomacy knows the story about the russians and their early mobile phones. :-)

Metadata is crazy informative if you know how to read it, and the NSA has decades of experience with that. But, again, if they want to know my political views, all they need to do is ask.

I'm all there with the outrage, and I am very, very angry with my own government that they don't dare giving the USA a serious diplomatic beating for PRISM et al. At the same time, I'm not afraid and I'm not paranoid. The public tends to swing between ignoring crap like that and going all bonkers. I tend to be somewhere in the middle all the time.

Re:Abandoning the cloud ?

[azmaveth]

The data is the contents of the transmission. The metadata is the data describing the transmission. So yes, the phone number, date/time, etc, are metadata of the actual communication.

Re:Abandoning the cloud ?

[RobertNotBob]

... If I were to go to even a reasonable effort to combat all of them, I would be doing nothing else with my life.

In risk management,

Well, I am ALSO an IT Security professional, and I can certainly confirm your statement quoted above as that is indeed just about all I do while I am at work. Luckily, I am not the kind of person who takes work home with them, though.

I am a professional who gets paid to be obsessive over security. - I acknowledge that it is easy to confuse that with PARANOID; but trust me, there are distinct differences. And one of those differences is that I can see your point. If you are able to ACCEPT a risk, then it may be the simple way to go.

As for myself, the paperwork to list a risk as "accepted" is usually more of a headache than any possible mitigation. But if you can get away with it, Good on ya'. - I was just unsure from your first post here that you were ACCEPTING the risk and not IGNORING it...

projects I work on are of no interest to any entity able to intercept the data

And I thought I'd speak up.

On that topic, however... It sure is nice to come across somebody who can use Risk Management intelligently. - It seems that these days, most folks can't even manage to use it correctly in a sentence...

Re:Abandoning the cloud ?

[Tom]

I am a professional who gets paid to be obsessive over security.

There definitely is a huge difference between work and private life. In work, you can specialise a lot more. One person being obsessive about security is what a company needs to reach a good balance, because most other people care less about security than they should.

In your private life, you need to find that balance within yourself, and it rarely is with being obsessive.

As for myself, the paperwork to list a risk as "accepted" is usually more of a headache than any possible mitigation.

Hehehe. But brother, you know how we work. If some manager doesn't want to spend money to do something about a risk, we are the most cooperative person in the entire universe, we will assure him quickly that that is absolutely no problem, sir, none at all. Just sign here on the risk acceptance form that you are aware of the risk and have made a management decision to accept it and assume responsibility.

Oh, you suddenly found a bit of budget to do that other thing I mentioned? Who'd have thought... :-D

It seems that these days, most folks can't even manage to use it correctly in a sentence...

The primary reason I started my own company was so that I don't have to work with idiots anymore. I feel your pain.

As usual. Stallman was right all along.

[Anonymous Coward]

His record for being correct is rather unusual.

Re:As usual. Stallman was right all along.

[Anonymous Coward]

No, his record for being correct is not unusual.

It's pathetic.

And by that I mean that it is pathetic that you need to be a pessimist and paranoiac to even get halfway to predicting government and industry trends.

We need to work towards a world where Stallman is wrong more often.

Re:As usual. Stallman was right all along.

[Anonymous Coward]

What I respect about Stallman is his persistence. He just keeps hammering home the same message, over and over again, decade after decade. As opposed to politicians or talking-heads, he doesn't budge nor compromise. And then, ten or twenty years later, people realise he was right all along. And what does he do? He keeps hammering on the same message still, because people still didn't act, even when they know exactly what they ought to do. I think that is what makes him unusual.

Re:As usual. Stallman was right all along.

[ls671]

What you are suggesting is a global waking up. Be careful, posting as anon ain't that safe ;-)

Re:As usual. Stallman was right all along.

[RabidReindeer]

What I respect about Stallman is his persistence. He just keeps hammering home the same message, over and over again, decade after decade. As opposed to politicians or talking-heads, he doesn't budge nor compromise. And then, ten or twenty years later, people realise he was right all along. And what does he do? He keeps hammering on the same message still, because people still didn't act, even when they know exactly what they ought to do. I think that is what makes him unusual.

I wouldn't go that far. Plenty of people still willing to argue in favor of trickle-down economics, etc. etc. etc.

Being uncompromising isn't as big a virtue as it's made out to be. We recently suffered through a president whose closes approach to "flip-flopping" was to say that "IF mistakes were made, they were my fault". We have a useless Congress because certain minority groups won't compromise in anything whatsoever.

Then again, Stallman isn't trying to control things, he's trying to be the "voice in the wilderness". It's far more virtuous to be constant when you are serving as a reference point than it is to be constant when you are in the thick of managing things. The doers, however, need reference points - even wrong ones. And Stallman may be unrealistic at times, but his core beliefs have proven to be sound.

Re:As usual. Stallman was right all along.

[dpilot]

The thing being missed in the current privacy fuss is that right now everyone is only worrying about the US government. That leaves out two other classes of players...

1 - I know that the US government is far from perfect, but compared to some other governments out there they're downright benign. That's not to excuse their behavior in any way, that's just to point out that there are bigger threats to be aware of.

2 - Don't forget corporations, particularly multinational corporations. At some theoretical level, the US government has the best interests of US citizens as its motivation. (I'll agree that it may be "theoretical" and one may have to say "SOME US citizens', but there is still that element there.) Corporations have their own profit and revenue as their primary motivation, the good of their customers is secondary, important as a continuing source of profit and revenue. As for non-customers, their importance is as a future source of profit and revenue. Nothing there about peoples' best interests if they don't align with the companies'.

While the boogeyman of the US government is certainly present, one should not forget that they are probably not the worst boogeyman, there are probably much worse out there. In other words, it's worse than you think.

On backdoors, don't forget this one:
  http://scienceblogs.com/goodmath/2007/04/15/strange-loops-dennis-ritchie-a/

Re:As usual. Stallman was right all along.

[Anonymous Coward]

The problem is that he's not effective. If he were effective then he wouldn't have to keep harping on the same thing decade after decade. What it means is that he hasn't learned from his mistakes and improved his methodologies. I generally agree with Stallman on most things but I don't see him as a very effective leader in the free software movement. He's mostly just effective at preaching to the choir.

Re:As usual. Stallman was right all along.

[denis-The-menace]

If you live in North America and you post here, the NSA already knows who you are.

I'm sure /. being part of a big company now makes it a virtual certainty that we have BigBro reading our shit for kernels of embarrassment for the the elite.

Re:As usual. Stallman was right all along.

[ls671]

Whoosh....

Re:As usual. Stallman was right all along.

[spitzak]

I absolutely agree. Why is everybody in a panic about Microsoft and Google sending information to the NSA, while not worrying about the fact that Microsoft and Google have this information in the first place? Even if you think corporations are entirely benign and only government is evil, if they did not have this information they could not give it to the NSA, while the current situation means that the evil government can force them to claim they are not giving it while still giving it.

The solution is end-to-end encryption of all the information, with sufficient open source so that testing devices can be put into the lines and detect that closed devices are not leaking information they should not.

Re:As usual. Stallman was right all along.

[7-Vodka]

Your post displays a naiveté so stunning that I would think you have never been around people.

For you to even say aloud that your stasi government is less of a threat than xyz really shows how ignorant you are of the fact that information is power and a monitored human is not a Free human.
Not to mention how you have no fucking concept that your economic Freedom is worse than a peasant in the 1300's.

A percentage of the harvest went to the lord of the manor (the land's lord, or landlord) the amount varied, but it was between 10% - 25% - an additional 10% went to the local church as a tithe. Compare that 20-35% tax rate to the combined 50-80% tax rate many in the developed world pay (the ones that don't suck on the government's tits).

How you doin' Eloi? is the food good? are you happy and eating well? Hey what do you care if we take some people away every now and again, it's not you!
Just keep grazing on your grass like a fat happy cow all the way to the slaughter, telling other people around you how it's not so bad after all, it could be worse.

Re:As usual. Stallman was right all along.

[briancox2]

Multi-national companies don't have the power to imprison me, make things I'm doing illegal in order to harass me or silence my speech by unequal protection of the law as in the IRS abuses scandal. They also only know of me what I complicently allow them to know. I am not required to file a disclosure of all my financial data to any company.

The bottom line is that government when corrupt is far more dangerous than when a business is corrupt.

And, of course, China and Russia have little impact on my Civil Liberties.

Re:As usual. Stallman was right all along.

[dpilot]

You've never slung poop or caught vomit, have you?

The basics involved with raising children to a lot to put things in perspective. The US is far from a Stasi state. It may be far from perfect, and at times (and this may be one of them) it may be headed in the wrong direction. But to call it a Stasi state is to fail to realize just how bad the Stasi state really was.

I tend to be somewhat subversive, particularly where it pertains to computing and information management, nor is my identity purposefully hidden. But I'm not afraid of jackbooted thugs breaking down my door and taking me (and/or my computing equipment) away.

If I were to list my 1984-ish fears, it would have more to do with jackbooted thugs from the MafiAA breaking down my door or shooting lawyers at me, not because of illegal copying, which I don't, but because of a guilt-by-association with free software. It would have more to do with bureaucratic bungling accidentally getting me on the no-fly list with no clear way to fix the problem. It would have more to do with my ISP putting annoying TOS on my internet connection. Personally I feel more oppression from commercial entities than from the government.

By the way, if you think the Free Market will solve commercial oppression, you're naive. If you think that government regulation is the only thing that impairs the function of the Free Market, you're naivete' is itself stunning.

Re:As usual. Stallman was right all along.

[jedidiah]

> For you to even say aloud that your stasi government is less of a threat than xyz really shows

No, it just shows a little perspective. Some people have actually experienced genuine oppression firsthand (or know those that have) and are less inclined to go around like Chicken Little.

Re:As usual. Stallman was right all along.

[jedidiah]

> Multi-national companies don't have the power to imprison me, make things I'm doing illegal in order to harass me or silence my speech by unequal protection of the law as in the IRS abuses scandal.

Sure they do. They can use their vast resources to influence national governments, distort laws, and influence local prosecutors.

Some companies are larger than some nations and have the resources and influence to match.

This is not unprecedented. One of the things that the US was rebelling against was one such company.

Re:As usual. Stallman was right all along.

[SJHiIlman]

Sure they do. They can use their vast resources to influence national governments, distort laws, and influence local prosecutors.

They can, but isn't that ultimately a problem with the government?

Re:As usual. Stallman was right all along.

[operagost]

It must be the nutrition he gets from eating his foot skin.

Re:As usual. Stallman was right all along.

[Anonymous Coward]

Stallman is correct in what he preaches, but he brings nothing new to the table (arguments are old and well-known, even to the point of being obvious) and - what's even less cool - he is very extremist about his views. For Stallman, there exist no edge cases, no special cases, no exceptions. He paints it all black and white. But the world is *never* that simple, and it's often bad to break it down to such a simple level.
I'm not a big fan of him because of these reasons.

I think the most reasonable way is to use everything with caution. The internet is a surveillance state - and it's not just the various governments or secret services spying on you (that's a given, even before PRISM), it's the advertisement industry or companies that also deal within that business, such as social networks, or Google, because they want all your data so they can tailor ads specifically for you (which gives them more money because you're more likely to click on it). Or they want to sell your data. Whatever they're saying, don't trust them. The technology for storing and using/selling all your data is there, and no sweet words like "we won't sell anything" are going to make a difference. Money matters more than what you think is right, and so you *must* be prepared that any unencrypted data you submit to a company might eventually become public, or shared with multiple other companies.
And then there's the issue that a company could be hacked, and as we all know, they often pay little attention to security. You should presume the worst scenario: that your data and login information are stored unencrypted on a highly vulnerable machine. Because security costs time (= money), and so if a company can live with the resulting reputation damage after a breach, or if a breach will never make it into the news, the company will probably not care much about security.

And so, if you have anything sensitive to put into the cloud, first make sure that it's a good idea at all. If you think so, then make sure it is encrypted well.
Anything unencrypted on the internet is the equivalent of a postcard and can be read by multiple companies or individuals if they so choose, or it can be stored indefinitely and used/searched later. That also means that it could pose a problem, even when you encrypted something, because years later from now there might be the technology to break the encryption, and then you should make sure that whatever it was that you encrypted and put onto the cloud, that it will be useless by then. For this reason it's most likely a bad idea to put something incriminating onto the cloud, even if it's *currently* not decryptable. It might be soon. And one should assume that your data never gets deleted once it's "out there". It might show as being deleted, and the cloud provider might tell you it is, but you can never be sure. Maybe the company really deleted it, but someone else still has a copy of it (e.g. the secret services).

I think the real criminals probably avoid the internet as much as possible, or they hide it extremely well and use tons of proxies, infected machines, public computers and so on as cover. So that they leave no direct trail. What's left are the non-criminal regular internet users like us, who are spied upon, not by chance but by rule, and not by suspicion but on principle (because they can / have the technology to do so).

I don't think any laws or sweet words from politicians or companies will ever change that. Because the technology is there, and even if there should be laws and much stricter regulations against all the governmental spying, they still probably can continue to do it with relative ease and hide their actions. Or they simply continue to use or abuse what they already have (massive amounts of data from anyone of us). And of course there's room for massive abuse as well. It's never a good idea to give people so much power, and information = power. The secret services are the most powerful institutions nowadays. But can you trust them not abusing that power in whatever wa

Re:As usual. Stallman was right all along.

[Bob9113]

Well played - a nicely crafted post. Thanks!

Re:As usual. Stallman was right all along.

[briancox2]

As SJHillman pointed out. A corrupt corporation has no power without a corrupt government.

Re:As usual. Stallman was right all along.

[riondluz]

"... is his persistance..."

That's cuz he's probably an aspie:)

Re:As usual. Stallman was right all along.

[7-Vodka]

Yeah it's ok that the government killed a million people in illegal wars and is now guarding poppy fields in afghanistan and giving arms to al qaeda in syria. Who cares? It's over there and not here.
It's ok that they spy on us. It's only digital crap and "I" have nothing to hide.
It's ok that they get rid of all the rights and civil liberties that are ours by right. 1st ammendment, 4th and 5th ammendments. Hell even 2nd ammendment and habeas corpus. They're only doing it t certain people right, and it's not me so who cares?

Every single one of those views are held by people who aren't targets of people in power *right now*. What you don't realize is that allowing the government machine to do this to others just means they can do it to you to at any time of their choosing. You are not safe.

Re:As usual. Stallman was right all along.

[Jmc23]

You do know that what you need to get to that world is to actually follow what Stallman says right?

Re:As usual. Stallman was right all along.

[Anonymous Coward]

It must be the nutrition he gets from eating his foot skin.

Every time you bring that up, you make a cute baby puppy puke. We've all heard it before, and it's no better than posting goatse or lemonparty in every instance of some particular Slashdot topic. Please take your disgusting gross-out "humor" elsewhere; some of use like to snack while reading Slashdot.

Re:As usual. Stallman was right all along.

[dpilot]

I'll call naive again, possibly.

This -sounds- like a Libertarian call, and that the market can protect against all ills, if only the government would keep their hands off.

1 - Powerful people and institutions have power, always have, always will. They exercise that power the way they want to, provided that they can get away with it.

2 - Companies only "believe in" the free market as long as it benefits them. Once they become industry incumbents, they will do everything they can get away with to protect their markets - stifle competition, kill innovation, kill air supplies, loyalty contracts, etc. If there ever were a country where the government kept its hands off the market, and that market successfully warded off a attacks like this, and kept doing so for the long run, I've never heard of it.

Power wants power, power eventually becomes corrupt, and that has been the way of human history. Then came interesting stuff like the Magna Charta, the US Constitution, and the like.

Re:As usual. Stallman was right all along.

[kermidge]

"The solution is end-to-end encryption of all the information"

Or maybe, you know, not keeping the information.

Better yet, not gathering the information.

'The information' stuff is bad enough as is, yet worse still is the secrecy of all the very doing of it - the how and the why and the fact that it is happening but we're not even supposed to know about any of it - including a majority of our lawmakers. A government keeping such things secret, and the fact that any of it is secret at all, has no claim on styling itself a democracy or a republic. The social contract has been broken and the trust breached. If there is to be any hope of restoring same, those in power must return much of that power, and renounce forever such abuse of it.

Re:As usual. Stallman was right all along.

[Anonymous Coward]

For you to even say aloud that your stasi government is less of a threat than xyz really shows how ignorant you are of the fact that information is power and a monitored human is not a Free human.
Not to mention how you have no fucking concept that your economic Freedom is worse than a peasant in the 1300's.

A percentage of the harvest went to the lord of the manor (the land's lord, or landlord) the amount varied, but it was between 10% - 25% - an additional 10% went to the local church as a tithe. Compare that 20-35% tax rate to the combined 50-80% tax rate many in the developed world pay (the ones that don't suck on the government's tits).

I will give my left testicle to comprehend how this got moderated to a 4.

ACTIONS speak louder than.... information.
ACCURATE information isn't needed to be BAD. See inquisition, witch hunts, McCarthyism, etc.
Those are not examples of the wheels of justice gone bad on too much information.

Oh, renting land for subsistence farming, that's freeeeeedom baby.
Being that people in the mid to upper tax brackets take home enough pay to live in a large house, own a couple cars, eat out, and take trips on the weekends, I have to disagree with your theory.

Re:As usual. Stallman was right all along.

[Bert64]

The problem with compromise is that when dealing with powerful adversaries you give a little, and they want just a little bit more... This continues, and eventually you've given them everything. You have to stand your ground or you end up with nothing.
Just look at the gradual creep of copyright, or the gradual increase of surveillance... It all starts off small and reasonable sounding, but once you give one small concession in the name of compromise they always start pushing for more.

Re:As usual. Stallman was right all along.

[Anonymous Coward]

Excellent post. Now I think a couple of gentlemen are about knock on your door. We will miss you.

GNU/Linux is made in the USA

[kthreadd]

So which operating system should we use?

Re:GNU/Linux is made in the USA

[Anonymous Coward]

No its not. There are distros based in all parts of the world. Also the difference here is that the source code is freely available for all to see.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

That's different. GNU/Linux is open source, so you can (in theory) verify for yourself that there aren't any back doors. And if there are, you can fix them.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

They call it BSD and Open, because it's always free and open...

For historical reasons OpenBSD is based in Canda...

Re:GNU/Linux is made in the USA

[Anonymous Coward]

Linux was made in Finland.

Yet another Yank taking claim for other's achievements.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

here's one https://tails.boum.org/

Re:GNU/Linux is made in the USA

[kthreadd]

That's true, but not if you're among the 99+ % that installs a binary distribution.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

Is there a GNU/OpenBSD available?

Re:GNU/Linux is made in the USA

[gigaherz]

GNU/Linux is made by a community of developers from about every single developed country in the world, and possibly has had patches done by people who were at the time in less developed places. So there isn't one single government telling the contributors what to do. It either has no backdoors (because it's opensource and supposedly someone has reviewed the patches), or it has backdoors from all over the world.

I may not like GNU much, or Stallman, but that's a fact regardless.

Re:GNU/Linux is made in the USA

[heikkile]

GNU/Linux is open source, so you can (in theory) verify for yourself that there aren't any back doors. And if there are, you can fix them

That's true, but not if you're among the 99+ % that installs a binary distribution.

The point is not that everyone needs to verify the code, but that anyone can do so, and that someone is likely to have done so.

Re:GNU/Linux is made in the USA

[myurr]

But equally there are thousands of really talented programmers who examine the source code very thoroughly, many of whom contribute back. If there were back doors then there is a high chance that they would have been detected. Plus anyone really paranoid about it CAN go and check the source code to make sure for themselves.

With propriety operating systems you do not have that luxury.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

Well most of the (most active) kernel developpers do live in usa (including Linus), also many (if not most) of the GNU developpers live in usa (including Stallman), so you could say GNU/Linux is developped in usa currently.

btw. i'm not from usa.

Re: GNU/Linux is made in the USA

[kthreadd]

But that still just verifies the source. As long as you get a binary from someone you have to trust that other person. Verifying the source does not verify the binary.

Re:GNU/Linux is made in the USA

[aaaaaaargh!]

Bullshit. GNU/Linux is an international effort with contributors from many different countries. It is constantly peer reviewed by all kind of people, e.g. security researchers all over the world, and the source is open so you can check it yourself.

Re: GNU/Linux is made in the USA

[kthreadd]

The kernel work started in Finland, but most of the work and most of the GNU system originated in other countries and most prominently the USA.

Re: GNU/Linux is made in the USA

[kthreadd]

Yes but you can't trust binaries which may include modifications not available in the original source code.

Re: GNU/Linux is made in the USA

[centipedes.in.my.vag]

It does when you compile, compare md5 hash, and verify that they're bit-for-bit identical. Jeez, it's like someone already thought of this.

Re:GNU/Linux is made in the USA

[centipedes.in.my.vag]

No. As BSD is a Unix branch, and the GNU/* only applies to the Linux branch.

Re: GNU/Linux is made in the USA

[centipedes.in.my.vag]

This is incorrect. Again. For the same reasons given to you above, you can compare compiled binaries to the source and verify that they're identical via hashing.

Re: GNU/Linux is made in the USA

[Anonymous Coward]

While this is correct, it requires the exact same compiler settings, and the exact same compiler version.

Re: GNU/Linux is made in the USA

[Anonymous Coward]

But who compiled the compiler?

http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf

Re: GNU/Linux is made in the USA

[ta_gueule]

You can do that with cmp or diff. Why do you mention hashing?

Re: GNU/Linux is made in the USA

[kbg]

But to compile and compare the binaries you have to use at some point a compiled binary from some source, which you can't trust.

Re:GNU/Linux is made in the USA

[YukariHirai]

Not as far as I know, but Debian do actually do GNU/FreeBSD and GNU/NetBSD distros in addition to their usual GNNU/Linux.

Re:GNU/Linux is made in the USA

[YukariHirai]

Incorrect. GNU userland utilities can theoretically be made to work with any Unix-like kernel. It's just that Linux is what it's most commonly paired with.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

Wrong.

GNU is the userland (libc, gcc, bash), while Linux is the kernel.

There is also a GNU kernel, called Hurd. GNU userland + Hurd kernel is called GNU/Hurd, just like GNU userland + Linux kernel is called GNU/Linux.

GNU is pretty cross platform, and it should be possible to combine GNU userland with the OpenBSD kernel, giving you GNU/OpenBSD, but I think he's going to need to do it himself if he wants it. Debian has done so with FreeBSD, calling the result Debian GNU/kFreeBSD - the "k" indicating FreeBSD kernel, rather than all of FreeBSD.

The opposite should also be possible, though I don't know of anyone having done so. BSD userland on Linux, giving you BSD/Linux (now will people understand why that "GNU/" in front of Linux matters?). I don't know how portable BSD userland is, some of it may not be - at least that was the impression I got when I was looking at replacing udev with devd when udev was absorbed by systemd.

Re: GNU/Linux is made in the USA

[centipedes.in.my.vag]

Because I am most familiar with using md5 for this purpose. I am sure that "I'm doing it wrong", and there are more inspired/better ways to do this. I only speka from what I've done.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

Ehm, what are you blathering about? There's a project known as the Hurd, maybe you've not heard of? With the GNU software coupled with the Hurd kernel you get something called the GNU/Hurd. Nothing stops you from compiling GNU software on BSD systems. So what was that about GNU being only Linux?

Re:GNU/Linux is made in the USA

[MichaelSmith]

Should be called Finux.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

And despite it being a smaller group, there are thousands of developers around the world with access to closed source systems like Windows who also verify them. There are thousands more who reverse engineer the binaries themselves constantly looking for vulnerabilities. While I prefer open source, it is a complete myth that closed source OS's aren't also under considerable talented scrutiny.

Re: GNU/Linux is made in the USA

[ta_gueule]

You are doing correctly. It's just that the step of hashing is unnecessary. You can just compile the stuff and compare it, instead of compiling the stuff, hashing both stuffs and compare the hashes.

Re:GNU/Linux is made in the USA

[ls671]

Binary distributions should be a little more risky but there is nothing like a back-door hiding in plain site, there for anyone to see in the source code but not getting detected in most source code audits.

Re:GNU/Linux is made in the USA

[ls671]

true. I use to download and install gnu-tar on aix...

Re:GNU/Linux is made in the USA

[ls671]

Luke, concentrate on the force instead.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

The difference is that the scrutinisers of closed-source software are most often motivated *not* to disclose their findings to the public.

Re:GNU/Linux is made in the USA

[ls671]

Right, the perfect way to gain the opposite results.

Re:GNU/Linux is made in the USA

[L4t3r4lu5]

... [A]nyone can [ verify the code], and ... someone is likely to have done so.

Yes. The NSA guy who wrote the patch, and three of his astroturfing friends.

The "Many Eyes" fallacy is important here. Unless you can verify the authenticity of the code yourself, you need to verify the authenticity of the person verifying the code. Do you know all of the kernel devs personally? How about the X / Mir / $module devs? How many people actually write code for kernelspace? How many modify it for their particular distribution of choice? Do you trust those people?

Re:GNU/Linux is made in the USA

[Anonymous Coward]

You are aware that probably the most important current kernel developer, a certain Linus Torvalds, is a naturalized citizen of the U.S.A.?

Re:GNU/Linux is made in the USA

[cold fjord]

Plus anyone really paranoid about it CAN go and check the source code to make sure for themselves. With propriety operating systems you do not have that luxury.

On a personal level, no. But many governments can, as well as some corporations.

Microsoft to Share Source Code With Governments

Re: GNU/Linux is made in the USA

[Anonymous Coward]

No if you find the exploit they can tell and you mysteriously disappear, don't look for it

Re:GNU/Linux is made in the USA

[Anonymous Coward]

Yes but still a Finnish citizen also AND the idea and foundation grounding for the kernal was written in Finland it would not exist if it wasnt written there, as the real GNU kernel was not even finished yet, and Linux was just there at the right time, kinda like MS-DOS

Re: GNU/Linux is made in the USA

[Ash-Fox]

It does when you compile, compare md5 hash, and verify that they're bit-for-bit identical. Jeez, it's like someone already thought of this.

Sounds pretty hard since that information is not provided with the binary or source.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

You misspelled "kernel".

Re:GNU/Linux is made in the USA

[silentcoder]

Not to mention the original linux kernel was written in Finland.
Many other free software projects are likewise non-American. Hell OpenBSD is developed by a South African living in Canada.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

The opposite should also be possible, though I don't know of anyone having done so.

Android uses the Linux kernel but none of the GNU userland; they forked BSD libc into a project called "Bionic".

The Linux kernel is the only thing in Android licensed under the GPL; everything else is under the Apache license.

Re: GNU/Linux is made in the USA

[ls671]

Please guys, stop that "my father (country) is stronger that yours attitude. ;-)

Re:GNU/Linux is made in the USA

[Anonymous Coward]

Governments are only allowed to view the source code to make sure their backdoors are properly in place - as per the contract.

Re: GNU/Linux is made in the USA

[Rockoon]

Wow, you really are out of the loop.

Slashdot, June 20th 2013 - "Are you sure this is the source code?"

Translation: You clearly dont know what you are actually talking about, but rather you just think that you do because in your world things really are as simple as you think rather than the real world where things are not.

Re: GNU/Linux is made in the USA

[Anonymous Coward]

There are known ways around this, although they start to get complicated.

http://www.acsa-admin.org/2005/abstracts/47.html

Basically, there's a difference between just talking about this on /. and what the professionals do that have really serious security issues. If you're just thinking 'ah, open source means someone will catch any bugs', then NSA is way out of your league.

Re:GNU/Linux is made in the USA

[Rockoon]

Historical CERT advisories. Notice the transition from predominantly windows-platform vulnerabilities to predominantly unix-platform vulnerabilities as one goes back in time, to a period where few windows machines were on the internet.

Being open source didnt prevent souce packages like sendmail from being exploited again and again, repeatedly, throughout its history. BSD witnessed vulnerability after vulnerability also.

Re:GNU/Linux is made in the USA

[RabidReindeer]

... [A]nyone can [ verify the code], and ... someone is likely to have done so.

Yes. The NSA guy who wrote the patch, and three of his astroturfing friends.

The "Many Eyes" fallacy is important here. Unless you can verify the authenticity of the code yourself, you need to verify the authenticity of the person verifying the code. Do you know all of the kernel devs personally? How about the X / Mir / $module devs? How many people actually write code for kernelspace? How many modify it for their particular distribution of choice? Do you trust those people?

Old proverb: "Three people can keep a secret if two of them are dead."

We see that proven time and again by things such as Watergate, WikiLeaks and the Snowden affair among many, many others.

Few people have read every part of the OS source, but quite a few people have read individual parts of various OS components in detail and more have dipped into them superficially, for example when doing in-depth debugging. This makes it extremely difficult for a conspiracy to hold together very long.

And that's not counting the complexity that comes from the heterogeneous mix of apps, processors and peripherals that make up the world-wide set of users. Stuff like that tends to break things that are operating on the sly.

Re:GNU/Linux is made in the USA

[ls671]

Makes sense, if you have one of the rare good source code auditor at your disposal then, it is obviously easier to find holes or at least easier to get a hand on the source code when the sources are open. Remember that we are in the context of finding back-doors hiding in plain site, in the source code. Note that it doesn't necessarily mean the back-door was planted there on purpose.

You couldn't give a better example than sendmail or at least none that I can't think of.

Re:GNU/Linux is made in the USA

[WaffleMonster]

But equally there are thousands of really talented programmers who examine the source code very thoroughly, many of whom contribute back.

Not really, most of each of thousands of projects have at most a few core developers and extraneous people who occasionally submit patches to fix specific itches. There is no "A team" scouring all open source for vulnerabilities from the simple fact such vulnerabilities most certainly do exist as innocent bugs and have not been reported by such teams.

To illustrate this point the linux kernel is developed by armies of smart people yet an automated tool found a laundry list of shit that has been around for years nobody noticed.

http://www.coverity.com/library/pdf/linux_report.pdf

If there were back doors then there is a high chance that they would have been detected.

There is no difference between a backdoor and a vulnerability. The logic that deliberate backdoors would be detectable in source code when we know from experience innocent bugs having the same effect as a backdoor have a proven track record of not being detectable is simply wishful thinking and wrong.

Plus anyone really paranoid about it CAN go and check the source code to make sure for themselves.

I suppose anyone can drain the earths oceans with an eye dropper as well.

Re: GNU/Linux is made in the USA

[Anonymous Coward]

So when I installed GNU Emacs on my Windows NT 3.51 system, it should have been called a GNU/NT box?

Re: GNU/Linux is made in the USA

[Anonymous Coward]

Yes. Yes it should.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

That's GNU/Finux, to you, pal.

Re:GNU/Linux is made in the USA

[Rockoon]

The book Unix-haters Handbook devotes an entire chapter to the notorious sendmail. A link the the book is found at the end of the wikipedia article, in unfortunately PDF format.

Perhaps its time for an Adobe-Haters Handbook.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

While everyone else focuses on your incorrect statement, I will criticize your signature. You don't get Karma for Funny.

Re:GNU/Linux is made in the USA

[centipedes.in.my.vag]

I'm just happy to be corrected / learn something new.

Re: GNU/Linux is made in the USA

[centipedes.in.my.vag]

Thanks for linking. I don't think that stands so strongly against what I've said, but rather supports it. His conclusion is that with minor tweaks to tools we could better achieve matching compiles from source. So, he substantiates what I've said as the goal, and says that we have a few issues - but they can be fixed. Sounds simple enough to me.

Re: GNU/Linux is made in the USA

[Rockoon]

Its simple to match compiler version, static library versions, and the static libraries linker version, and each library modules compiler version and options.....?

Really?

Re:GNU/Linux is made in the USA

[Anonymous Coward]

You are aware that probably the most important current kernel developer, a certain Linus Torvalds, is a naturalized citizen of the U.S.A.?

look, I let in a little secret here. the "american dream" in Finland isn't really a house and a summer cottage, if that's what you've been let to believe. Plenty of people have those. the dream is to be able to afford to move somewhere else for most of the year. Perfectly legitimate to stay Finnish and do that. It's like going pillaging.

Hell, our most famous sportsmen ALL live elsewhere. The pay levels are just that much better - and the taxes lower pretty much almost anywhere.

Re: GNU/Linux is made in the USA

[TeknoHog]

True, we should stop this infantile bickering, because it's obvious to everyone that Finland is better than the USA, so there's nothing to fight about. Besides, my UID is twice a prime, so nyah nyah nyah!

Re:GNU/Linux is made in the USA

[ls671]

I suddenly remembered about xterm witch used to be pretty good at it since it was set uid root by default on most distros on top of the holes back then...

I did not read the PDF, It must be mentioned within it.

Re:GNU/Linux is made in the USA

[jedidiah]

> They call it BSD and Open, because it's always free and open...

Until someone decides to turn it into a commercial product and deny you any rights whatsoever.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

Yea because I've read and understand all the millions of lines of Linux code and all the millions if lines of code in all of the 100's of open source packages that I have installed and all the millions of lines of code in all the other software packages I evaluated be for choosing the ones I wanted to install. I also read and understand all the source code changes that go into a the software that gets updated every day. Then I fixed all those obscure back doors that the cyber warfare experts from every country in the world inserted. While I was at it, I fixed all those security bugs that the open source maintainers didn't know about or hadn't had time to fix. You know that's why open source software is so secure. After all everyone reads the code. Much more than those pesky 100 line EULA's. I mean who would bother reading that shit.

Re:GNU/Linux is made in the USA

[hraponssi]

omg Finlux 111

Re:GNU/Linux is made in the USA

[Anonymous Coward]

Your post is made up of FUD and closed source shill bs.

First, there is no surprise there are uncaught bugs in anything. Bugs do not equal exploits, only some bugs can be exploited and different bugs can only be exploited in certain ways, requiring different access, and achieving different severities from crashing to resource hogging to root access.

Second, whatever Coverity is, it apparently works by analyzing the source code in the first place. If you don't see the irony in using evidence against open source from a source code analyzing program that find bugs in available open source code then please kick your own ass out the door.

Why people try so hard to pretend that open source has no security benefits over closed source is beyond me.

Re:GNU/Linux is made in the USA

[sgtrock]

Heh. Haha. BWAHAHAHAHAHAHAH!

Not really, most of each of thousands of projects have at most a few core developers and extraneous people who occasionally submit patches to fix specific itches. There is no "A team" scouring all open source for vulnerabilities from the simple fact such vulnerabilities most certainly do exist as innocent bugs and have not been reported by such teams.

To illustrate this point the linux kernel is developed by armies of smart people yet an automated tool found a laundry list of shit that has been around for years nobody noticed.

http://www.coverity.com/library/pdf/linux_report.pdf

First, from the very report that you linked to:

The results show that the number of defects detected by the Coverity analysis system has decreased from over 2000 to less than 1000 while, during the same period of time, the source code has quadrupled in size and the power of Coverity's detection capabilities has increased markedly. We conclude using this data that the Linux kernel is a robust, secure system that has matured significantly.

You want a real eye opener? Check out Coverity's current press release:

Code quality for open source software continues to mirror that of proprietary softwareâ"and both continue to surpass the accepted industry standard for good software quality. Defect density (defects per 1,000 lines of software code) is a commonly used measurement for software quality. Coverityâ(TM)s analysis found an average defect density of .69 for open source software projects that leverage the Coverity Scan service, and an average defect density of .68 for proprietary code developed by Coverity enterprise customers. Both have better quality as compared to the accepted industry standard defect density for good quality software of 1.0. This marks the second, consecutive year that both open source code and proprietary code scanned by Coverity have achieved defect density below 1.0.

(snip)

Linux remains a benchmark for quality. Since the original Coverity Scan report in 2008, scanned versions of Linux have consistently achieved a defect density of less than 1.0, and versions scanned in 2011 and 2012 demonstrated a defect density below .7. In 2011, Coverity scanned more than 6.8 million lines of Linux code and found a defect density of .62. In 2012, Coverity scanned more than 7.4 million lines of Linux code and found a defect density of .66. At the time of this report, Coverity scanned 7.6 million lines of code in Linux 3.8 and found a defect density of .59.

(snip)

While static analysis has long been cited for its potential to improve code quality, there have been two significant barriers to its adoption by development organizations: high false positive rates and a lack of actionable guidance to help developers easily fix defects. Coverity has eliminated both of these obstacles. The 2012 Scan Report demonstrated a false positive rate for Coverity static analysis of just 9.7 percent in open source projects. Additionally, the 2012 report noted more than 21,000 defects were fixed in open source codeâ"more than the combined total of defects fixed from 2008-2011.

The real conclusion that you should draw is twofold. First, if you're relying on software that isn't doing static code analysis, you're probably relying upon insecure code.

Second, Every. Single. App. Has. Bugs. The difference is that open source lets anyone do the analysis and fix the bugs. The same can't be said when of any closed source package.

So, which is safer? The OSS app where everything is publicly discussed and bug fixes generally get acted upon fast, or the closed source app where the vendor may be handing the known vulnerabilities off to the NSA or its equivalent in the country of your choice? I know which way I choose. :-)

Re:GNU/Linux is made in the USA

[fritsd]

What's wrong with PDF format? (genuinely curious).

Re: GNU/Linux is made in the USA

[Bert64]

Well if you're talking on a countrywide scale, only one group in each country needs to verify that the code is suitable for use by that country and build binaries from it. The cost of hiring a few developers to go through the code is nothing in the budget of most countries.

Re:GNU/Linux is made in the USA

[Bert64]

Although unix was originally developed with a security model, individual code often wasn't... People who wrote code weren't thinking that buffer overflows or format string bugs could be exploitable, and many things were designed based on being connected to a largely trusted network of academics where there would be very little to gain anyway.
People developed clear text protocols like telnet, operating systems included remotely accessible unpassworded guest accounts by default, and then you have relatively naive protocols like smtp which has resulted in many of the spam problems we see today and could have been avoided with better protocol design.

People learned and improved, and then microsoft came along very late to the party with a lot of code that was designed for an environment where there was simply no security model whatsoever.

Re:GNU/Linux is made in the USA

[Anonymous Coward]

Finland was made in the USA therefore Linux is made in the USA! :-)

Re: GNU/Linux is made in the USA

[david_thornley]

Yeah, and that trick works only as long as you're limited to one compiler. Once you have two, you can compile your compilers with other compilers (both of them, plus compilers you've compiled yourself with various compilers). They don't have to be trustworthy, as long as they don't have the exact same subterfuges. Use different targets, also, if you've got an ARM box you can use or a PPC.

Re:GNU/Linux is made in the USA

[ls671]

What's wrong with PDF format? (genuinely curious).

Nothing more than with anything really. It's all related with categorizing your level of security and acting along. Click on my uid and read if you want to know more on how I feel about this. I do not want to repeat myself.

As a risk reducing measure, you can use alternative pdf viewers depending, again, on the levels of security you are comfortable with.

No surprises

[cold fjord]

Stallman's position isn't a surprise. I expect him to advocate open source software over any proprietary software. He has for thirty plus years. Why would he change now? There is one thing he overlooks when he says:

'I don't think the US government should use operating systems made in China,' ... 'for the same reason that most governments shouldn't use operating systems made in the US

Stallman overlooks the fact that various foreign governments already have access to the Windows source.

Microsoft to Share Source Code With Governments

Microsoft Corp. announced this week it is making the programming code for its Office 2003 software suite available to government agencies around the globe, a move partly aimed at allowing them to inspect the product for flaws and security problems.

Though Microsoft usually guards such software coding tightly, the step is an extension of an initiative the company began in January 2003 giving about 60 governments access to the inner workings of the Windows operating system. This is the first time the software giant has shared the source code for Office, which includes the Word text processing, Excel spreadsheet, and PowerPoint presentation programs.

Microsoft Grants Governments Access to Windows

Re:No surprises

[Anonymous Coward]

If current state-of-the-art software engineering methodologies are not sufficient for producing bug free code, what makes you think a government can spot "bugs" that were planted there as backdoors?

Re:No surprises

[Anonymous Coward]

Your point about source code is interesting enough on the surface, but how many organizations compile Windows from source code?

I'm not convinced that what's in the [quasi-public] source code matters a lot when pretty much everyone runs the distributed binaries. Those are the things that need to be analyzed from a security perspective, along with the rest of the functional system that ends up in place. C'mon, you don't test food for poison by obtaining the recipe.

Re:No surprises

[Anonymous Coward]

And how do these select governments confirm that the Microsoft products that they have installed were indeed compiled using the same source code that they have reviewed? Are they allowed to compile it themselves as well?

Re:No surprises

[chidpen]

Just having the source code doesn't mean it's safe from backdoors or bugs.

Re:No surprises

[Anonymous Coward]

They might as well have access to the Debian source. Nobody is safe anymore!

Re:No surprises

[cold fjord]

It looks like at least Australia can build the source. I doubt they got a special deal. Also, the governments receiving the source code didn't get the "recipe," they got the ingredients - that's what source code is.

Australia to see Windows source code

The agreement will enable Australian government officials to view the source code for Windows 2000, XP, Server 2003 and CE. They can also use the code to build those versions of Windows, see Microsoft security documentation the company doesn't otherwise share, speak with Microsoft developers and perform their own tests on the code.

Re:No surprises

[Anonymous Coward]

Having access to source code is not enough. You need access to ALL the source code and data AND the build tools for converting it to the final binary the computer will run. And the source for the tools too. Then you have to actually BUILD that source code and VERIFY that the binaries match (or use only what you build).

With Linux or BSD this is routine. There are thousands (millions?) of people that build their OS from scratch (Arch and Gentoo are two popular Linux distributions that work like this). With Windows? I seriously doubt it's even possible.

Re:No surprises

[Anonymous Coward]

Yes, at least some of them can build from source.

Re:No surprises

[stephanruby]

So what? Those governments don't have the right to compile the code.

However, government users will not be allowed to make modifications to the code or compile the source code into Windows programs themselves, Simon Conant, a Microsoft security specialist based in Munich, said.

"Governments under the GSP are allowed to view the code in a debugger, but not compile, redistribute, or actually modify the code," Conant, said. A debugger is a tool used to evaluate software code.

If you can't compile the code, there is no guarantee that you'll be auditing the right code base. If you dig down deep enough, the debugger will start taking you to the wrong lines (as it happens with most software projects, even open source ones), but Microsoft will just explain away those discrepancies by saying that they had to remove some of their testing code and some of their logging statements (an explanation which is sensible enough, but that you can't workaround, because you're not allowed to compile the code yourself, nor have you been provided the exact compiling recipe/code snapshot they've used for their official release).

So whatever you do audit of the code base, Microsoft or the NSA can then modify before it gets compiled for your own citizens, and the chain of custody will have been broken thereby completely circumventing your audit in the first place.

Re:No surprises

[cold fjord]

Apparently the Australians are allowed to compile the code. Maybe there is more than one set of terms.

Re:No surprises

[Bing Tsher E]

Linux has such an un-even and scattershot userland that I doubt it's regularly built all the way up from source as a unified system in that many instances. BSD, on the other hand (or, at least NetBSD which I am most familiar with) can be built, the whole kernel and core userland, from a single CVS tag checkout.

Re:No surprises

[Anonymous Coward]

But who compiled CVS for you?

Re:No surprises

[Anonymous Coward]

I didn't realize Microsoft hired outside consultants to come in and look at their source code with state-of-the-art engineering methodologies.

I thought Microsoft just used their own in-house, in-effective and in-secure methods.

Re:No surprises

[Anonymous Coward]

Usually trolls should not be answered but...

1) Stallman has never advocated "open source". Free software is what he's promoting. https://libreplanet.org/wiki/Why_Free_Software_is_better_than_Open_Source

2) Stallman didn't mention windoze or Micro$oft. His advice is very sound.

Re:No surprises

[RabidReindeer]

Stallman overlooks the fact that various foreign governments already have access to the Windows source.

I doubt he does. But the Windows source is not posted on open archives under independent control around the world. If Microsoft licenses Windows source code to China, all they have to do is omit the China backdoors from the code they send to China.

It's not like various foreign governments are posting their copies of the source for each other to compare against.

Re:No surprises

[kthreadd]

You did when you rebuilt your user land.

Re:No surprises

[Anonymous Coward]

He doesn't advocate open source. He advocates free software.

http://www.gnu.org/philosophy/open-source-misses-the-point.html

Re:No surprises

[RabidReindeer]

I'm pretty sure that you can build a Linux using a standards-compliant third-party compiler such as the one sold by Intel. Which would immensely complicate the lives of any people trying to slip backdoors into the toolchain, since then they'd have to also sabotage the Intel compiler. AND make sure that if the Inter compiler was used to create a gcc compiler that it, too got properly sabotaged!

Re:No surprises

[Anonymous Coward]

The latest malware operates exclusively in memory and gains access through faulty applications network code. And it doesn't take a malicious executable to destroy the security of a firewall. All it takes is one mis-configured file-sharing application to make the root directory writable.

Re:No surprises

[Anonymous Coward]

That's all fine and dandy, but usually what you use (even in the open source world) are the prepackaged binaries (because it's MUCH more convenient).
But then you have no proof that they were compiled from the same source that you can inspect elsewhere.
So it's entirely possible to have backdoors in the binary versions of Windows or various Linux distributions, but not in the source code.
And what also complicates things is that even if you have access to the source code, there is literally zero chance that you will detect all backdoors or security issues within the code, because it's so complex.

Re:No surprises

[Anonymous Coward]

the governments receiving the source code didn't get the "recipe," they got the ingredients - that's what source code is.

Source code is both the recipe and the ingredients in one. That's where the cooking simile comes crashing down, which is why it's only used in very low level CS courses or to explain to those who don't have any real understanding of the subject.

Re:No surprises

[stephanruby]

Do you have a citation for that?

Australia, the UK, the US, and Canada are all senior partners in the NSA ECHELON program, so the fact that any of those countries are allowed to compile the code (but other countries are not) wouldn't inspire much confidence in me in either case.

Re:No surprises

[DMUTPeregrine]

The current state of the art can produce bug free (or largely bug free) code, it's just incredibly expensive to do so. It takes a huge amount of extra time to find all the bugs, and security bugs in particular have a tendency to be extremely subtle. A government can pay a large number of people to do nothing but search for security bugs, while a company can't afford that extra expense and many open source developers don't bother. Many eyes make all bugs shallow, but you need the eyes actively looking for bugs, and to have brains that can recognize very subtle errors.

The problem of security is primarily economic: It's too expensive to verify the security of software for most people who create software, so the security isn't verified. It's not too expensive for a government with vast resources to find holes in the security of software, so governments will expend vast resources to find holes in the security of software.

In Stallman We Trust

[Anonymous Coward]

And on the Final day, St IGNUcious declared Gentoo be the system by which all operates. His will be done, on Earth as it is on silicon.

Re:In Stallman We Trust

[Anonymous Coward]

Let us all funroll-loops ...

it's far better...

[TitusGroan8856]

it is far better that RMS talk about backdoors than pick his on stage and pop whatever he pulls out of it into his mouth to chew.

USA has form

[Jimbookis]

I recall reading about a hushed up brouhaha ages ago concerning backdoored USA compiled software run on Australian government systems in the 80's or early 90's. Google seems to disavow all knowledge damnit.

Re:USA has form

[FriendlyLurker]

Maybe you mean this?:

“...the result of having the secret key inside your Windows operating system “is that it is tremendously easier for the NSA to load unauthorized security services on all copies of Microsoft Windows, and once these security services are loaded, they can effectively compromise your entire operating system“. The NSA key is contained inside all versions of Windows from Windows 95 OSR2 onwards”

Re:USA has form

[Anonymous Coward]

Clipper Chip intentions, Encryption stuff, http://en.wikipedia.org/wiki/Crypto_AG. And crooks in Vegas had bugged everything, long before NSA joined the party. If you assume nothing is safe, only by compiling it yourself, gives any degree of assurance.If routers and comm equipment can be made to poll and re-transmit, create defined chatter, that's a problem too.

OpenPGP and BSD crypto libs are too hard for most to get used to, and key exchange is still too difficult to maintain. Thankfully those snoopy interests employ contractors and consultants, and more gen 'Y'ers willing to sink well laid plans.

A cloud is the opposite of compartmentalized security and you don't even have physical security controls over it - so yeah Stallman is going to be right.

Re:USA has form

[Anonymous Coward]

I suppose this backdoor is in OS X as well? :(

So how do you know the binary matches the source?

[Anonymous Coward]

You're not allowed to build your own version of the software from the source. This is why one of the FSF rights is the ability to compile the program for use.

Seems in pointing out what Stallman "forgot", you forgot something yourself.

Yes, but

[Anonymous Coward]

While it is true that Microsoft is agreeing in certain cases to give access to the source code to Windows, it appears actually getting your hands on the code is sometimes harder than expected.

Point in case, Éric Filiol, an ex French intelligence officer from DGSE (the Directorate-General for External Security) recently explained that
“The French State can't obtain certain pieces of technical information on the WIndows kernel. A country that has nuclear fire and is a member of the UN's Security Council can't make Microsoft reveal necessary informations on a système that is absolutely everywhere.”

("L’État français n’arrive pas à obtenir certaines informations techniques précises sur le noyau Windows. Un pays doté de l’arme nucléaire et membre du conseil de sécurité des Nations-Unies ne peut pas contraindre Microsoft de lui donner des informations nécessaire sur un système qui est absolument partout".)
Source:
http://www.numerama.com/magazine/26360-la-france-n-arrive-pas-a-avoir-des-informations-sur-le-noyau-windows.html

So there seems to be a difference between what is announced and what happens.

Re:Yes, but

[cold fjord]

While it is true that Microsoft is agreeing in certain cases to give access to the source code to Windows, it appears actually getting your hands on the code is sometimes harder than expected.

“The French State can't obtain certain pieces of technical information on the WIndows kernel.

Is that referring to getting the source code? I interpreted it to mean getting some additional technical information, or perhaps a clarification, on the functioning of the kernel.

Re:Yes, but

[Anonymous Coward]

Couldn't the French Parliament force them to reveal it?

Re:No surprises - Trust?

[Anonymous Coward]

Access to source compiled binary currently in use.

Do you trust that whatever you compile from the source code they send will result in an equal file to those currently in use? I seriously doubt that most entities bother to check.

Nah it was PROMIS and INSLAW

[Jimbookis]

My bleary memory now recalls it was probably about PROMIS and INSLAW. Read about this: http://en.wikipedia.org/wiki/Danny_Casolaro

Self-referencing C compiler

[Skiron]

To build windows, you have the use the windows compiler, I guess. Well, that's that then:

Self-referencing C Compiler

Maybe the NSA has infiltrated Microsoft . . . ?

[PolygamousRanchKid]

You know, like, sending NSA agents to get cover jobs in Microsoft, and purposely plant in obscure security bugs, that can only be exploited by the NSA . . . ? I know that they are not supposed to do that, but the new description of work for the NSA seems to be something like:

Question: "What does the NSA do?

Answer: "Things that it is not supposed to do."

Re:Maybe the NSA has infiltrated Microsoft . . . ?

[ls671]

anything that works fits the bill.

He's right about one thing.

[some old guy]

RMS's comments about OS back-doors are rather dated, since M$ made Win2K source available to governments many years ago. It gave a whole new meaning to the Windows joke, "That's not a bug, that's a feature!"

He is, however, spot on about "the cloud". No engineer or admin in his right mind would entrust his/her organization's data to a medium riddled with security, privacy, and reliability flaws.

Bean counters are all for the cost savings of "the cloud" until you clearly spell out the risks involved. Accountants and executives hate taking big risks for only a tiny commensurate potential for gain.

Re:He's right about one thing.

[Anonymous Coward]

RMS's comments about OS back-doors are rather dated, since M$ made Win2K source available to governments many years ago.

Not necessarily - simply being able to look at the source code is no guarantee of anything. Unless they're able to build the OS themselves from that source, which I don't believe is an option for Microsoft's kinda-shared source code thing.

Re:He's right about one thing.

[Anonymous Coward]

If you think having the source code for Windows is enough, when it has to be built by using their compiler, I recommend reading Ken Thompson's Turing Award lecture:

http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf

Re:He's right about one thing.

[bill_mcgonigle]

RMS's comments about OS back-doors are rather dated

I pointed out to a friend yesterday that we've known about the NSAKey for fifteen years, and she said, "yeah, but now everybody else does."

It's a good time to start saying, "not 'free' as in 'gratis', but 'free' as in 'not backdoored by the NSA'."

US government should use OSes made in China

[citizenr]

CPUs on the other hand (Loongson) are kosher!

Re:US government should use OSes made in China

[Anonymous Coward]

First off, he's speaking about software. Secondly, MIPS's reduced instruction set makes it possible to actually verify it's design has no "hidden features". Although there are very few people left who can actually do this, there have been examples of CPU getting reversed engineered with a microscope, pen and paper in the past. This days we have image processing, robotic microscopes and most importantly, processing clusters capable of emulating a whole cpu\gpu.
Even the old x86 had Soviet clones so I don't see why a RISC processor should be nearly as difficult.

Re:US government should use OSes made in China

[ls671]

good one!

Re:US government should use OSes made in China

[Anonymous Coward]

Whoooossshhhh!

OP is referring to the fact that Intel CPU's are designed and fabricated in Israel (hence, kosher). Which is comforting because Israel is not known spying, so there's no chance there are any backdoors or surveillance functions implanted in the microcode.

Re:US government should use OSes made in China

[ls671]

because Israel is not known spying,.

I know you know but still: they have some of the best teams around...

Irrelevant

[abigsmurf]

Closed source, open source, it doesn't matter when you can just give them access to a database, an admin account or access to logs.

The fear of backdoors into your OS is out of date in today's society. Why would they need wait for you to be online then risk detection by using a backdoor when they can just make a call to facebook, your ISP or your mobile phone network and probably get far more valuable information?

It's also very naive to think that intelligence organisations don't have a catalogue of undisclosed exploits and security holes that they keep secret in case they need to attack someone, Whether it's Linux, Windows or whatever.

Re:Irrelevant

[Anonymous Coward]

So what data do they want from Facebook if nobody uses it? Did you miss his point about not using cloud services? Granted, cellular carriers have more information than they need about us. That should be fixed too.

Re:Irrelevant

[mcgrew]

Why would they need wait for you to be online then risk detection by using a backdoor when they can just make a call to facebook, your ISP or your mobile phone network and probably get far more valuable information?

Neither Facebook nor your ISP has any information about your network that you didn't volunteer. Unless you're not smart enough to put a hardware firewall between your modem and router (as well as other measures) they're not going to easily get your private data. Data you give your ISP, facebook, or any other cloud entity isn't private.

If you're putting, say, trade secrets in the cloud you're a fool.

Having the source to your firewall's OS and software is far more important than internal OSes, but code in your OS can "phone home" and let the attacker in to your network, so a closed source OS with network access is still dangerous.

That explains the slow fixes

[erroneus]

Some Microsoft bugs take a ridiculous amount of time to get fixed and all the reports seem to fall on deaf ears. We bash Microsoft for this behaviour but doesn't having a reporting relationship with the NSA help it all to make sense? Taking a long time to fix? Well, they may not be done exploiting it yet. Falls on deaf ears? Well maybe it's not a "bug" but a back door that no one was supposed to know about and Microsoft cannot comment on it without NSA approval.

Re:That explains the slow fixes

[cold fjord]

I'm don't think that there is enough time, talent, money, or adequate tools for any one company to keep multiple 40,000,000 line software releases free of meaningful defects that might effect security, without breaking something else, all while they are trying to build their next version.

Skype NSA surveillance from Microsoft

[Anonymous Coward]

I remember Microsoft's denials about intercepting Skype, yet the PRISM leak shows they can fully intercept everything:

http://gizmodo.com/what-is-prism-511875267

There are two worlds here, companies that cooperated with NSA illegal spying and those that didn't. They chose their sides, they chose the side against the constitution. That's not my side, I need to secure my data against NSA and its corporate allies.

Skype leak shows they can intercept voice communications, the files you sent, the text messages, the video of your conversations, the lot, and it's a live intercept, so its a live connection too. I bet they can even turn on the camera and mic remotely on Skype.

Then we find out Stuxnet is confirmed as NSA. So no doubt where all those zero day exploits came from, Microsoft themselves:

http://www.guardian.co.uk/world/2013/jun/28/general-cartwright-investigated-stuxnet-leak

So all the scary hackers out there making Stuxnet? They're the NSA itself.

I don't trust this Windows box in front of me currently, my server is being moved out of the USA, this Windows box is next.

Re:Skype NSA surveillance from Microsoft

[Lumpy]

Want secure skype?

SIP software, point to point VPN. Good luck NSA decoding that encrypted tunnel.

Re:Skype NSA surveillance from Microsoft

[Anonymous Coward]

Want secure skype?

SIP software, point to point VPN. Good luck NSA decoding that encrypted tunnel.

They don't have enough computational power to be decoding everyone's encrypted data streams.

Re:Skype NSA surveillance from Microsoft

[bill_mcgonigle]

SIP software, point to point VPN.

Heh, I set my parents up with Jitsi a few months ago and configured their gateway to openvpn to mine - at the time purely for reliable addressing and networking ports, but it turns out to be pretty secure as well.

Now then, the traffic consists almost entirely of my kids telling their grandmother about a new bike or that girl at school who is sooooooo mean, but that's none of the NSA's damn business either. I don't want some creep analyst in Hawaii watching my daughter any more than I do some creep on a park bench.

Oh, the point - Jitsi is perfectly usable for an AOL grandmother. We actually started on this path when the Microsoft version of Skype became unstable on their Mac (the pre-MS version was pretty decent).

Re:Skype NSA surveillance from Microsoft

[Bert64]

If you dont trust the machine your currently using, then what's the point moving your server? If you log in to your server from an untrusted machine then irrespective of how secure and trustworthy your server is, who's to say a backdoor on the workstation couldn't be used to steal your authentication data and gain access to the server (or even just hijack a live in progress session).

Re:Skype NSA surveillance from Microsoft

[riondluz]

Sir, as always, you are a font of information! What I'd like to know is for all the posting you do here, where on earth do you find the time to get any work done?

Thanks again

Re:Skype NSA surveillance from Microsoft

[Creepy]

they don't need it - they just use NSAKEY in ADVAPI.DLL and let you decode it for them (yeah, I know Microsoft denies NSAKEY Is a backdoor for the NSA, but we've already caught the NSA lying, and I'm sure Microsoft is under a rubber stamp FISA court order to deny it is a backdoor with punishment of being broken up into tiny pieces and barring those pieces from doing business in the US).

Re:Skype NSA surveillance from Microsoft

[bill_mcgonigle]

hey, productive procrastination, man. No, really, I only do Slashdot when I'm waiting for something else to finish but it will be not enough time to do anything else. There are several such slots during a typical workday. I get lots of ideas here, so it's only fair to contribute back too. Having a well-structured friends/foes list (buy the subscription!) and score modifiers setup makes it much more valuable use of time. Lots of tabs and decent typing speed helps too.

Oops, job I was waiting for just beeped - c'ya.

Re:Skype NSA surveillance from Microsoft

[bussdriver]

If you are a target of interest, your network stack or OS is probably open to them - pile whatever you want on top of it, they only need to enter below that point.

Re:Skype NSA surveillance from Microsoft

[Anonymous Coward]

"There are two worlds here, companies that cooperated with NSA illegal spying and those that didn't."

All companies are cooperating. When the fascists come knocking with a FISA warrant, you cooperate or you end up vacationing in Gitmo.

Prism is far worse. What the Prism documents show is the companies who are collaborating.
Beyond just cooperating, the collaborators are actively providing on-site access to their private data streams without warrants.

Oh, and Remember Kids: Don't Be Evil!

His backdoor remark is VERY CURRENT

[Anonymous Coward]

This wasn't about the win2k NSA key, it is about Microsoft passing info about zero day exploits to the NSA instead of fixing them, so the NSA can use them to break into people's computers and spy on them. This came out in the news in just the past few days (not sure if revealed by Snowden or someone else). It would seem to explain why Microsoft is so damn slow about fixing bugs.

Re:His backdoor remark is VERY CURRENT

[Anonymous Coward]

"While", not "instead"

Re:So how do you know the binary matches the sourc

[cold fjord]

I'm afraid you've got it wrong. At least Australia can build from source. I doubt they got a special deal.

Australia to see Windows source code

The ability to build from source would seem to be a key aspect of verifying the code. I'm not sure why you think they wouldn't be able to do it. What they probably can't do is distribute the binaries for free - they still have to pay Microsoft for the distribution of software.

Also, it seems likely that by providing their code to foreign governments, Microsoft is picking up what to them is free services of what are no doubt some of the best software engineers in government looking over their code, and probably sending in the occasional bug report. What's that saying? Many eyes makes for shallow bugs? Or maybe not.

Skype Link Spying Germany

[Anonymous Coward]

Remember this?
http://yro.slashdot.org/story/13/05/14/1516247/microsoft-reads-your-skype-chat-messages?utm_source=commentcnt&utm_medium=feed#comments

A german user noticed that if he passed a link in a skype message, the link was accessed by Skype servers?

Microsoft claimed it was to protect from malware. But now we know they're in the NSA's pocket, and the NSA is data mining all communications and storing them in the big database, the obvious conclusion to come to, is that this is part of NSA's data mining effort.

If you look at 'Boundless Informant' leak, Germany is very heavily spied on by the NSA, and so German Skype chatter is likely a major target for interception. Germany is a big commercial competitors to the USA.

Also notice the fake 'RC Plane bomb plot in Germany' from yesterday... part of the marketing to try to quieten down German anger.

Re:So how do you know the binary matches the sourc

[advocate_one]

I'm afraid you've got it wrong. At least Australia can build from source. I doubt they got a special deal.

Australia to see Windows source code

The ability to build from source would seem to be a key aspect of verifying the code. I'm not sure why you think they wouldn't be able to do it. What they probably can't do is distribute the binaries for free - they still have to pay Microsoft for the distribution of software.

do they have access to the source code for the entire toolchain?

And who knows what they put in your water...

[Anonymous Coward]

And how do you know that mind control isn't perfected by the government?

How do you know that you are actually alive and not just dreaming?

Re:And who knows what they put in your water...

[Anonymous Coward]

I'm sure that's just what the government wants me to think.

Re:And who knows what they put in your water...

[RabidReindeer]

And how do you know that mind control isn't perfected by the government?

How do you know that you are actually alive and not just dreaming?

You aren't. Your cat is the one dreaming you.

Re:And who knows what they put in your water...

[Anonymous Coward]

But I don't have a cat... So does that mean that an imaginary cat is dreaming me?

Re:And who knows what they put in your water...

[fph il quozientatore]

Calm down, Neo.

Of course you can. Write your own compiler.

[Anonymous Coward]

Then you know that the compile has no known backdoors in it and won't put any in your code.

The C standard is available.

No, they HAVE the source code. Not compilation.

[Anonymous Coward]

Just because you can read a book doesn't mean you're allowed to write it out and use that copy you created to read.

The agreement given does not include that. The report is in error, that wasn't made available, though there was the intent to do so *by the Australian government*. Microsoft didn't give them that right.

You could say what the hell you like

[Anonymous Coward]

However, that isn't true.

Are the computers Chinese or Taiwanese because most of the manufacturing by weight is done by them? No? why not?

Re:So how do you know the binary matches the sourc

[AHuxley]

Cold you have to understand Australia.
They love MS, MS giving them code to look over at after generational buy in is just a trinket.
What was Australia going to do if it finds a project related hole? File it with MS and hope its fixed in weeks? Months? Many months?
Australia was just feeling bad over its lack of sufficient software source code and IP to allow its airforce to understand some aircraft systems.
Source code became a political and defence issue with huge political efforts to try and get the US gov to be nice over the issue.
So for the US and MS to be seen to be offering Australia something was cute, but with todays insights, MS at a VOIP, server, cloud, code, consumer or filesystem level seems a tame tool of US gov interests.
http://www.smh.com.au/national/public-service/trade-war-up-in-the-clouds-20120529-1zhpg.html
Comments like this from the US:
‘‘...governments should not prevent service suppliers of other countries, or customers of those suppliers, from electronically transferring information internally or across borders ... or accessing their own information stored in other countries’’...
seem a bit of a LOL given the other line about 'a careful set of constraints to protect individual privacy"

Thread scenario?

[Anonymous Coward]

I don't use threads -- I use multiple asynchronous processes, you insensitive clod!

Re:Thread scenario?

[Anonymous Coward]

It's the Linux way! Threads? Those too fast, must spawn multiple processes and use IPC, which is magnitudes slower. Great for the sync overhead.

If there's one thing...

[Anonymous Coward]

that RMS knows about, it's having his backdoor probed and leaking.

Single Best Case for Open Source

[Anonymous Coward]

This, right here, is the single best case for open source that has ever come along. The fact that neither government nor large corporations can be trusted has never been more clear.

Open source not immune to backdoors

[sjbe]

The point is not that everyone needs to verify the code, but that anyone can do so, and that someone is likely to have done so.

Anyone can do so in theory but not in practice. I'm an engineer but software isn't my specialty. I have absolutely no way to evaluate personally if there is a backdoor in any of the software I'm using. I simply don't have the skillset and for various reasons am not going to develop it either. Even if I was a really plugged in software engineer like Mr. Torvalds, I simply wouldn't have the time to review every single line of code before compiling it all myself. Don't forget to check the compiler and the firmware.

Additionally while you are correct that someone is likely to have done so, the question is who? Is it someone we trust or is it someone we don't or both? I have absolutely no way to know. I simply have to trust. Don't get me wrong, I think open source is fantastic but pretending that the code is somehow immune from backdoors is pretty naive.

Re:Open source not immune to backdoors

[DMUTPeregrine]

That's where OpenBSD's practices come in. Regular audits, changing which developers audit which parts of the code, a focus on security over all other concerns, etc. There doesn't have to be a loss in functionality to get good security, but the increased development resources needed mean that there often is such a loss. Something like Linux is a compromise position, it's more likely to be secure than a closed-source system where only approved parties can audit the code, but less likely to be secure than an OpenBSD style system where huge amounts of time are spent auditing the code.

Re:Open source not immune to backdoors

[Bert64]

The point is not that open source is perfect, the point is that it is better than the alternative and perfection is almost never attainable so we make do with the best available.

The biggest advantage btw, is that open source code is seen by disparate groups of individuals with entirely different agendas. Whereas closed source code is typically only seen by 1 or two groups of people:

1, Those who have a direct contractual agreement with the organisation creating the code and thus have have to toe the company line.
2, Those who have acquired the source through illegal means, who are by very definition criminals and thus are likely to use the code to carry out further criminal activities, or not disclose any information for fear of being caught.

Only two agendas, and neither of them are beneficial to the agenda of the average end user of the code.

dudes, don't you know about.. the NSAKey?

[strstr]

Microsoft has been installing the NSAKey in Windows since Windows 98; a special root key that grants them access to Windows cryptography services, ability to generate their own keys, decrypt things, and maybe install rootkits, bypassing the user. Some people think it's Trojan that even gives them stealth remote control capabilities. Microsoft has always been working with the NSA, and in turn, the NSA has always been getting into whatever they could possibly get their hands into. Welcome to the ultimate rootkit in society, next to Remote Neural Monitoring and Electronic Brain Link.

http://www.washingtonsblog.com/2013/06/microsoft-programmed-in-nsa-backdoor-in-windows-by-1999.html

and nsa.pdf @ http://www.oregonstatehospital.net/

Re:dudes, don't you know about.. the NSAKey?

[strstr]

there are also those famous secret debug modes in AMD and Intel's chips, that grants above operating system level control, and unlocks hidden CPU resources. this has got to be the under workings of a secret NSA toolkit for full hardware and software control. I give you the AMD CPU password, which was exposed and documented in 2010:

http://hardware.slashdot.org/story/10/11/12/047243/hidden-debug-mode-found-in-amd-processors

don't you think this was all put in there for a reason? The NSA gets what they want and they want it all, they want to know everything going on inside everyone's home, in every square inch of America - this was all done by design. no one is doing anything to challenge or stop them. look at how none of these companies bothers to complain before years later something about the program they're running, which they now claim to have been against, is exposed. it's crazy, and we're not even getting to the half of it. most of this was done without warrants or any involvement from any court...

Re:dudes, don't you know about.. the NSAKey?

[strstr]

so some of the capabilities of that password were apparently the ability to override all hardware and software based security protocols; memory isolation, a program could read/write to any space in memory above the operating system. it also had access to 4 additional registers that were not available in normal x86 mode. apparently, this is the perfect place to hide execution of rogue code and programs, and to infiltrate and bypass any hardware or OS protections, such as those placed on limited users or non-admins. the software gets admin access through the processor with this hack.

Re:dudes, don't you know about.. the NSAKey?

[gnasher719]

"Some people think"... What some people think is usually rubbish. There is no evidence for any of the things you claim. And the best argument is that we would have to believe that the mental geniuses at NSA who can take over your computer would be so idiotically stupid to put a key named "NSAkey" on your computer in plain sight.

It may very well be that the NSA has some backdoor into your Windows (or Linux, or MacOS X) computer, but it's not and it never was in this NSAKey file.

Now something completely different: Intel and AMD processors have a built-in operation that calculates the product of two 64 bit numbers and delivers a 128 bit result. An awful lot of code related to encryption uses that instruction to make encryption / decryption reasonably fast. There was a paper demonstrating that if the processor produces the wrong product for exactly one pair of two 64 bit numbers, and the two numbers and the product are known to an attacker, then for example RSA can be attacked successfully, on a wide variety of operating systems. Without modifying any code on that machine.

Re:dudes, don't you know about.. the NSAKey?

[Anonymous Coward]

Cited woodmann.com article is gone.

Re:dudes, don't you know about.. the NSAKey?

[ByteSlicer]

You should wrap yourself in tin foil while you're at it.
Those "secret debug modes" have been well known and documented since they were added.
To put the processor in debug mode, you need ring 0 access, so any program that can do this already has kernel privileges.
The hidden debug mode your link talks about is just a small (but useful) undocumented extension of this existing debug mode.
Could the NSA use this to spy on you? Sure, but with kernel privileges they could do anything.

How to get the public on board?

[Anonymous Coward]

He keeps hammering on the same message still, because people still didn't act, even when they know exactly what they ought to do.

Next time you're out and about, go ask some random person who is Richard Stallman.

Now ask yourself, if they never heard of him, what makes you think they're getting the message?

WE have heard of him and his message, but the general public hasn't. AND his warnings and claims come across as paranoia. I mean, before the NSA leaks, no one would ever believe our government would do such a thing - even here on Slashdot. How many times have folks said that the government is watching us only to have someone "point out" that it's "impossible" - here on Slashdot - supposedly the home of the most knowledgeable people on the Internet.

How can we expect John Q. Public to act when WE don't even believe half of it?

I'm telling you next we will find out that the NSA/FBI has the ability to create instantaneous dossiers on people by just hitting the: Medical Information Bureau, Credit Bureaus, Google (I don't a shit wtf they say in public!), ChoicePoint, state DMVs, IRS, state tax departments, and I bet quite a bit of internal databases, too. All through those backdoors.

FUCK! Anyone of us could code that!

Re:How to get the public on board?

[gaudior]

FUCK! Anyone of us could code that!

Some of us slashdotters DID code this. Very likely. And likely knowing full-well what they were doing.

Re:How to get the public on board?

[hubie]

- here on Slashdot - supposedly the home of the most knowledgeable people on the Internet.

Aaaah! Please don't say things like that while I'm drinking coffee and make it come shooting out of my nose!

Re:How to get the public on board?

[Anonymous Coward]

> Now ask yourself, if they never heard of him, what makes you think they're getting the message?

They might not have heard about RMS, but they've probably heard about Linux. And the reason they've heard about Linux, some twenty years after its release, is only because of the GPL. It was mainly because of the GPL he got the Hall of Fame award the other day.

Without the GPL, Linus would have released his work under some non-business license, public domain, WTFPL, or other non-sense. It would have been steam-rolled over at its first junction of success, never to be heard of again. Or alternatively, sued to bits; just look at where the Unux code-base is today: Still in a court-case - SCO vs. IBM.

Re:How to get the public on board?

[Jmc23]

So, what you're saying is that the fault lies with people like you who know what Stallman has been saying but haven't spread his message?

Do you know the name of the French President?

[Anonymous Coward]

No?

I guess he's a nobody, then.

The Cloud is good for Free Software

[Theovon]

One thing people keep neglecting to mention is that for the stuff we WANT to be public (e.g. source code), the cloud is a GREAT place to put it (but certainly not the only place we should put it).

BTW, "the cloud" is far too nebulous of a term for this discussion.

Re:The Cloud is good for Free Software

[Anonymous Coward]

LOL Cloud - nebulous, I get it.

China

[Anonymous Coward]

I know use all there hardware , all kinds a software made by htem and hten whine when the enemy hacks you...
yup that rank 31 marth avg and 21 reading skill really is starting to show up aint it...

now imagine if there are loads a smart people in the public then real stupid people must be workin for the gubermint

Re:So how do you know the binary matches the sourc

[cold fjord]

I'm sure you'll understand if I remain agnostic on the question, Mr. Huxley.

Turn About

[Anonymous Coward]

Since Microsoft and other companies are telling the NSA about bugs before they fix them, then Microsoft and those other companies will no longer need a grace period when Anonymous or other hackers find vulnerabilities. They should be published right away for all to see.

Re:Turn About

[Anonymous Coward]

Holy crap batman.

Anonymous is already on top of this. They are calling it "Operation noday"

Made in China?

[Fuzzums]

Given recent developments I have no reason to trust made in usa either...

Re:Made in China?

[riondluz]

Doesn't matter; nothing gets made here anymore anyhow.
We just repackage shit made someplace else.

For a decent read, check out "Detroit" by Charlie LeDuff

"May be made in the United States, China or Taiwan"

Re:So how do you know the binary matches the sourc

[Anonymous Coward]

Yes you can.

There is no such thing as a license to use software in any law book. Software is protected by copyright only, so you can't profit from that, but you can modify it all you like.

I love back doors...

[Anonymous Coward]

For example: my girlfriend the other night told me that she is "on the rag".... So... I took a back door!

no one else has stated the obvious here yet?

[Anonymous Coward]

As a Linux user (note the non-use of the GNU prefix), I do not want Richard Stallman entering my back door.

NSA is not a big worry

[Anonymous Coward]

The NSA is not a big worry, they aren't supposed to be using data for civilian law enforcement because the collect it ILLEGALLY. That is one thing the Patriot Act got horribly wrong.. The NSA are not police, and police don't get to spy like the NSA. Because the NSA is chartered and designed to go WHEREVER, WHENEVER they want, they aren't required to ask for warrants because judges aren't placed high enough to know what they can crack. The main problem is that the NSA is a SPY agency.. It's not SUPPOSED to be easy for them... They don't get to ask for secret rooms and software backdoors publicly because they're SECRET... They are supposed to TAKE what they want, and NOT GET CAUGHT.
  They are supposed to be three steps ahead of the rest of us and the bad guys. That they are resorting to public data collection openly is beneath what they were founded to do.

Re:So how do you know the binary matches the sourc

[An ominous Cow art]

do they have access to the source code for the entire toolchain?

For the benefit of those who don't know why this is important, this is a good explanation.

Diverse Double-Compiling as a countermeasure

[SgtChaireBourne]

But who compiled the compiler?
http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf

Actually, that, too, has been thought of and worked out. The trusting-trust attack can be fully countered through Diverse Double-Compiling. It's all over my head but the material is there at several levels of detail for those who would read it.

AFU / Alternative For Innocents

[Anonymous Coward]

Here is a little SSL/TLS based server to protect your text chatting from government snooping and archiving forever:

https://bitbucket.org/hroll/alternative-f-r-unschuldige/src

@Ex-Company Wahabist nut-assets: AFU was made using Schweineschnitzel, so you won't get virgins if you use it !

Source repositories are the "cloud" too

[Anonymous Coward]

What's wrong with keeping your FOSS code in the cloud, like on SourceForge or GitHub? The old "If you have nothing to hide" (paraphrased) argument is usually a fallacy, but it seems to apply well here.

who is your real enemy?

[Anonymous Coward]

i for one laud our friendly neighborhood Chinese hackers.
it keeps windblows/NSA on the tiptoes to introduce ..errr ... fix new vulnerabilities.
in a way, hackers (read:black) contribute to the "many eyes are good(tm)" paradigm.
with the economy going down the drain i wonder how many "researchers" don't feel
aligned to the community anymore, but more to the person with the FAT wallet.
and though crime can make you rich, it will never make you as rich as when
your business it's NOT classified as a crime.
you know what, i could just yell "GO chinese hackers! do your thing!" but i think
it will just unleash some NSA controlled response from compromised windblows
computers at some china university : )

lol, captcha: renegade

Re:So how do you know the binary matches the sourc

[gl4ss]

some militaries use(or have used) customized windows versions at source level.

a fucking mess if you ask me, imagine running a custom branch of NT 4.0 as the backbone of your network.

HOSTS file?

[Thud457]

it seems like there should be a simple and effective way to prevent the NSA from collecting metadada on you with a properly configured HOSTS file. If there were only some smart cookie that could explain it to us.

Re:HOSTS file?

[RabidReindeer]

it seems like there should be a simple and effective way to prevent the NSA from collecting metadada on you with a properly configured HOSTS file. If there were only some smart cookie that could explain it to us.

Well, sure. We'll just upload one to our Verizon cellphone.

What? You thought that the metadata came only from the INTERNET???

Re:HOSTS file?

[allo]

by accessing an ip directly, you can always bypass the hosts-file. Not even speaking of patched libraries, which do not look up hosts in the hosts-file.

Re:HOSTS file?

[Jmc23]

You were one of those kids that would repeat 'bloody mary' into a mirror weren't you?

Re:So how do you know the binary matches the sourc

[Pav]

This is not even an academic question - there was actually a backdoor discovered in some software used by the Australian government provided by a US company. I believe it was in the late '90's, and it was news at the time... and I think it made Slashdot too. I can't seem to find a Google or Slashdot reference to it so I couldn't fault you if you decided to doubt the veracity of my story. I'm still searching though so I'll post if I find it.

Don't be so sure

[sjbe]

I don't have any data under my personal control that I care if the government intercepts.

Really? Are you certain of that? Here's the thing. Information you have can look circumstantially damning for reasons beyond your control. Sometimes people's identity is mistaken or they are in the wrong place at the wrong time. Messages that are entirely innocent can at times be used against you in a court of law. Maybe you have communicated with someone you don't know

Is it likely that the government will come after you? Of course not. Like you say your information probably is completely uninteresting. But it's not inconceivable that it might be more interesting than you think.

My email is boring as hell.

Probably true but it doesn't follow that it could not be used against you under the right circumstances.

What about vPro in all intel haswell mobile chips

[Anonymous Coward]

What about vPro in all intel haswell mobile chips

Hardware backdoor with ram access over the cell network and lan, hardware vlc client, etc. Remotely reenableable. Runs regardless of OS.

User Agreements? anybody read them?

[bussdriver]

They almost always say that your info is not protected from authorities and that they comply with laws or even say directly they will volunteer info if authorities ask (no warrant or whatever required)

Cloud?

[Bert64]

Cloud hosting is extremely useful some things, some of which i'd expect RMS to approve of.
For instance, if you are hosting GPL code then hosting it on a public cloud service makes sense. So what if the NSA can access it, so can everyone else and the license terms explicitly allow that.

Only safety: Made With A 3D Printer, Running FOSS

[Phil Urich]

Getting to the point of usability is going to be hard (unlikely that 3D printers are going to be able to replicate anything within the ballpark of a chip fab anytime soon, for example) but the more of the stack that's independently reproducible and open to public inspection the better.

And who speaks about idiot spaces?

[Anonymous Coward]

Backdoor does not need a space in the middle.

Stallman's & truth?

[unixisc]

Right about what? He is a Left wing conspiracy nut, who makes wild charges about anybody he doesn't like. Check out his website http://stallman.org/ before one mods me down.

For starters, which OS does the US government use that is made in China? Windows? Made in Redmond. Linux? Well, the US government tends to prefer RHEL derivatives, such as Scientific Linux, and even SE Linux features have made it back to the major Linux distros. So made in Raleigh, or Portland or Helsinki. I don't know how much of the government uses Apple, but that too is written in Cupertino, and if one is talking NeXT or Mach, it originated in Redwood Shores or Carnegie Mellon. BSD? OBSD is Canadian based, but thanks to Theo, the US government has blacklisted BSD and doesn't use it in anything. GNU? Okay, how much of it is developed in China?

So which Chinese made OS does the US government use, according to the man who judges a Lemote Yeedong to be the only acceptably free system he can get his hands on? Does he actually think that the US government uses Red Flag Linux? Reading TFA, the interviewer referred to Huawei, which is a company blacklisted by a number of governments, and they don't write OSs - although they may well have written in back doors to that OS. But the solution in that case is what is already happening - blacklist Huawei, and let the US government ban their products from being used.

The flip side of his comments - that other countries shouldn't use OSs made in the US - is laughable. What OSs should they then use? Let's assume for a moment that his accusations against MS are true. Anything else they use would still be largely made in the US, unless any country chose to pick a pretty obscure OS made outside, such as L4, Minix, QNX, Haiku, and so on. If he were to say that governments should only use liberated OSs and not proprietary ones, one can agree w/ him, since there would be no way of embedding backdoors into such systems. But to say that an OS should not be made in China or the US or anywhere else is just his usual deranged self talking.

Going OT...

[marcosdumay]

You should put your head out of the Windows box some day. Processes are not slow, and there is no reason for IPC to be slower than multi-thread data access (altough a few implementations are).

Mr. Potato Head

[Carcass666]

Memories...

Malvin: I can't believe it, Jim. That girl's standing over there listening and you're telling him about our back doors?
Jim Sting: [yelling] Mister Potato Head! Mister Potato Head! Back doors are not secrets!
Malvin: Yeah, but Jim, you're giving away all our best tricks!
Jim Sting: They're not tricks.

Re:So how do you know the binary matches the sourc

[marcosdumay]

Nowhere in the article it's stated that they can compile the source.

I got an offer to read Windows source code once. That condition was there, I wouldn't have the environment needed to actualy compile it. But I work in Brazil, it's possible that Australia got a special deal, there is just no evidence of that.

Gah! Where's the brain bleach?

[zooblethorpe]

there is absolutely no way to process it in the cloud properly

Sure there is. It's called homomorphic encryption.

....Aaand now I'm thinking of some new kids' TV show hero figure, the Mighty Morphin Gay Ranger. He's rainbow-colored, naturally, so he has all the powers of all the other Rangers.

Not really what I wanted to be thinking about, but there you go.

Free software not open source

[jbn-o]

No, Stallman has never "advocate[d] open source software over any proprietary software" as he is not now nor has he ever been a part of the open source movement.

Stallman founded the free software movement over 10 years before the open source movement began. Since the open source movement began he has spent time explaining how the open source philosophy and practical outcomes are distinctly different from his older movement (an older version of this essay is also online). Every talk I've heard him give contains a cogent explanation about these differences.

Perhaps if you understood the differences you'd understand why "various foreign governments already hav[ing] access to the Windows source" doesn't respect a user's software freedom (not even for the governments that are allowed to read said source code as merely having and reading source code is insufficient to be considered "free software" or "open source" despite the confusion with the latter) and therefore does not actually address any of the salient issues he's raising. One of his recent talks, "What Makes Digital Inclusion Good or Bad?" from October 19, 2011 covers this ground and related issues quite well.

richard stallman is a troll

[Anonymous Coward]

richard stallman is the biggest troll on the csail listserv. he's right some of the time, but all other times he trolls endlessly. guy has "antisocial" written in his dna.

why do people take him so seriously? it amazes me. obviously you haven't read the constant stream of spam he generates on the csail listserv...

targeted at non americans ?!

[Anonymous Coward]

The american democracy's secrets feed the idea
that if you're not american the web is a web and
just dont try to agitate your goodwill online because
dumb american contractors monitor you.
I think that Obama takes very seriously his oath
to protect only the american people the best he can.
He has just published a picture of himself in Goree
but it is not executive, it is symbolic.

RED FLAG!!!

[Fuzzums]

"our Ukrainian QA team"

NSA code compiled into linux

[peawormsworth]

Does it bother anyone else that NSA wrote code that is in the kernel of most linux distributions? I dont know what it does, but it has something to do with basic security. I think it is called Selinux. I am not saying it is a backdoor, just that the NSA wrote it and last time I checked the default kernel settings for compiling a Ubuntu kernel, all the NSA modules had checkboxes next to them.

Can someone assure me that this code is "safe"? Or do all linux kernels have code in them that allows the NSA to do as it likes with my security?

You can't trust the compiler

[bussdriver]

So you think compiling clean windows code on Visual C++ makes it safe? Security holes aside, a hacked compiler will produce hacked compilers even if all the source everywhere is clean. A clear chain of trust is required. With the time and effort, a breach can be placed at lower levels in the chain and obfuscated at multiple points ensuring decades of access without requiring to be notified of security holes. (you'd think an org bigger than the CIA would have people capable of finding holes on their own let alone getting them put in.)

A security breach in the 90s in Visual C++ at MS themselves could likely continue to this day - they use their old software to compile their new software.

Where has techright.org gone??

[Anonymous Coward]

Hello Everyone! This is my first time posting to slashdot in all the years I've been reading.

I have to ask a question: why is this article gone now? Why is techrights.org completely unreachable?

I don't mean to panic, but seriously, what is going on?? I'm getting error 503 (server error) when I try to go there.