Slashdot Mirror
Ubuntu Founder Pledges No Back Doors In Linux (eweek.com)
Mark Shuttleworth, founder of Canonical and Ubuntu Foundation, gave an interview to eWeek this week ahead of Ubuntu Online Summit (UOS). In the wide-ranging interview, Shuttleworth teased some features that we could expect in Ubuntu 16.10, and also talked about security and privacy. From the report: One thing that Ubuntu Linux users will also continue to rely on is the strong principled stance that Shuttleworth has on encryption. With the rapid growth of the Linux Foundation's Let's Encrypt free Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate platform this year, Shuttleworth noted that it's a good idea to consider how that might work in an integrated way with Ubuntu. Overall, he said, the move to encryption as a universal expectation is really important. "We don't do encryption to hide things; we do encryption so we can choose what to share," Shuttleworth said. "That's a profound choice we should all be able to make." Shuttleworth emphasized that on the encryption debate, Canonical and Ubuntu are crystal clear. "We will never backdoor Ubuntu; we will never weaken encryption," he said.
That must mean the front door is wide open.
Is this like the WMDs in Iraq??!
Shuttleworth is like any other citizen: a visit from the polite but scary government people will make him see the light.
Since Mark Shuttleworth is not in charge of Linux, I don't see how he can make this pledge.
Considering Ubuntu basically contributes little or nothing to the underpinnings of Linux, it's pretty easy to say they won't throw in a backdoor.
In a related story, I hereby heroically pledge to add no backdoors to... lessee here... iOS. Yes, iOS! GIVE ME A COOKIE!
AntiFA: An abbreviation for Anti First Amendment.
Nothing drives me further from Microsoft and Blackberry than their CEOs being wishy-washy about if your device is secure, even against "lawful interception" or whatever the gentle euphemism for backdoor is these days. But my only qualm here is that Mark Shuttleworth isn't currently the CEO of Canonical, perhaps the company itself should make a strong statement to this effect?
"We don't do encryption to hide things; we do encryption so we can choose what to share"
As a greybeard, Fuck your cloud and the sharing economy it rolled in on. When i choose what to share, I make it explicitly publically available in a format that may, or may not be encrypted. when you recontext my privacy in terms of what im willing to "share" with people it debases the very real need for encryption to circumvent things like warrantless wiretaps, blanket government surveillance, and invasive advertising. stop treating me like a toddler for using cryptography.
"We will never backdoor Ubuntu; we will never weaken encryption"
maybe you will, maybe you wont, but again, the point of linux is that I dont need a 60 million dollar corporation to reassure me about privacy. if you do it --like you screwed developers with contributor agreements and the UI-- ill just switch to a different distro or ill fork yours.
Good people go to bed earlier.
Shuttlecock already frontdoored Ubuntu when they decided to send the user's LOCAL queries to amazon without permission or notification. I never recommend anyone use Ubuntu for any reason after that incident.
the comfort i take from a statement like that from a person like that.
Well has he ran this past the dutch police yet? He could find Ubuntu HQ raided and himself under arrest for providing encryption that might be used by criminals!
http://www.theguardian.com/world/2016/apr/22/dutch-police-ennetcom-shut-down-owner-arrested
Quotes:
>"Although using encrypted communications is legal, many of the network’s users are believed to have been engaged in “serious criminal activity”, said spokesman Wim de Bruin of the national prosecutor’s office."
[And *providing* encrypted communications is legal, in fact no law has been broken, it didn't stop the police seizing the companies servers and closing it down.]
>"The owner of the company, Ennetcom, is suspected of money laundering and illegal weapons possession, prosecutors said."
[Even if he was a mass murderer, it doesn't make Ennetcom's business illegal. They provide PGP enabled Blackberry phones, if Blackberry phones weren't backdoored (as they shouldn't be) then nobody would need to add a PGP layer on top to secure them. How many dutch politicians are using phones that the dutch police have been able to spy on? Why is that?]
Dumbass trolls don't even realize this domain expired long ago.
What are you going to do about the secret courts that you didn't know about making all those legal decisions you cannot tell us about?
You cannot even believe your parking tickets when that system exists.
Full transparency of the legal process is what must be enforced. How is the founder of some distro going to ensure that?
A 'singular oddity' is an event that cannot be explained and only happens when you are alone.
Ever bother looking at that code?
Good luck proving there's no back door in that.
sudo apt-get remove backdoor
sudo apt-get remove backdoor-lib
and
sudo apt-get remove --purge NSA-spy-lib.4
After that you want to reboot and then do a update and upgrade.
Do not look at laser with remaining good eye.
And the difference between your and you're is... Oh wait, you didn't grasp that one.
... but we'll send all your desktop searches to Amazon...
SURELY NOT!!!!!
Whatever happened to the NSA secure linux/unix?
Newsflash: Linux has "sold out". Even slackware is being forced to go down that path, recently allowing pulse audio to infect their system becuase (get this) bluetooth won't work without it. (Are you kidding me?)
If you want pure and clean today, what you want is BSD.
If you don't like PulseAudio, uninstall it. If you have some pathological need to avoid it in your default install, use Gentoo.
Ubuntu Founder Pledges No Intentional Back Doors In Linux; Lots of Unintentional Back Doors.
If you're really concerned about security, you are likely running OpenBSD or a heavily-modified linux kernel by now.
Linus Torvalds was asked during a LinuxWorld keynote two years back if he was told by government agents to put hardware backdoors in linux. he said no, while nodding yes. His father, Nils Torvalds, a member of EU parliament, put it on the record that his son was approached by government agents requesting backdoors.
There is a known issue with the random number generator being _forced_ to do hardware-based (known to be broken on Intel/AMD chipsets) random number generation. under Open/Net/FreeBSD, there's an intermediary (software) random number generator that ensures actual randomness. Linus uncharacteristically led this charge to keep the RDRAND weakened, even resorting to calling others stupid for thinking otherwise. a prominent developer resigned due to it.
There is at least one recent Intel Management Engine talk at last year's Chaos Communication Congress. There was a similar talk the year before about AMD chipsets and their secret undocumented internal firmware. If you enjoy strong encryption, you would be wise to apply the proposed RDRAND patches that Linus rejected.
Now that all the major distributions have adopted systemd, there's now a full RPC backdoor to not only the GPL's linking requirements, but a backdoor to run "Approved" (by whom? we'll get to that) code automatically. Many people have pubatlicly posited that systemd will be the cause of "The Big One" vulnerability that eventually comes out of Linux and ruins its reputation.
Now, for the Ubuntu side: Canonical is incorporated in City of London, which means they are under the jurisdiction of GCHQ. Anyone who has watched/read a talk by Moxie Marlinspike will know that SSL/TLS is easily-spoofable by nation states. They will probably also know how exploitable SSL/TLS is today. All the draconian crap the GCHQ has jurisdiction over can easily be extended to a corporation registered under their governance. If Canonical refuses, they will be forced to, the way Google is forced to comply in the United States under similar framework. End result is that you cannot trust anything beyond your initial install CD, if you can even trust that.
You will likely never look through the custom patches compiled into your binaries, let alone think about Ken Thompson's "Trusting Trust" essay. You will just download your updates, and assume everything is A-OK. You are an end-user, and that's okay. Just don't think Shuttleworth's words are anything but a big fat placebo to keep his stock value afloat.
systemd is open source.
Running Gentoo. Full KDE5 desktop.
Never installed PulseAudio or Network Manager. doing great with WPA_GUI and Jack2/Cadence. Bluetooth doesn't depend on either, and my wiimotes/speakers work great with the bluetooth stack.
Jack allows me to take a WebRTC audio stream, pipe it into FL Studio (Under WINE!) for effects, and then pipe that output into Skype/Audacious/Audacity/VLC/ffmpeg/Carla at the same time, to as many different sound outputs as I want (even on different PC's!), in _realtime_. PulseAudio is a toy.
If you're really concerned about security, you are likely running OpenBSD or a heavily-modified linux kernel by now.
yeah unless you are 10000 years old and have done nothing else since you were born you have no clue what's compiled into your linux. It would take you 10000 years or more to look at all the code. So you haven't done that? Well then you are no more secure than anyone else. loser
As should every F/OSS endeavor; from CLI utility to OS.
Yes, it does. Alsa is dropped: http://git.kernel.org/cgit/bluetooth/bluez.git/commit/?id=4ff9b99292eca193dc0c149722328cb0b1ab0818
... I don't believe a word he says. Yes, Ubuntu is far and away the best OS choice today. And yes, Ubuntu is almost certainly already backdoored. Canonical does lawful business in anti-freedom countries like the United States and China. Therefore Canonical's software must be compromised.
Read Ken Thompson's Turing award address. Unless Canonical is extraordinarily vigilant, it can be done without their knowledge. Ken Thompson outlined the basis of the attack in his Turing award address. There has been a proof of how to counter the threat, but that really just moves the bubble under the carpet.
Isn't it like saying 'I will never be a serial killer'? It's not like lying is worse than doing the act, so what would make a malicious actor even hesitate to make the same claim?
This is nothing about Canonical, just an observation on the pointlessness of such statements in general.
XML is like violence. If it doesn't solve the problem, use more.
open doors?
I can't get my bluetooth to work WITH pulse audio installed.
He should bet his life on it
With likely over 10,000 distinct authors of code, most without any type of mandated review process... Dude, I wouldn't be worried about 007 and Edward Snowden spying on you with Ubuntu. I'd be worried about your neighbor's anti-social looking teen having a trojan somewhere. Use Fedora. The NSA does :P