Slashdot Mirror
Should Kaspersky Lab Show Its Source Code To The US Government? (gizmodo.com)
Today the CEO of Kaspersky Lab said he's willing to show the company's source code to the U.S. government, testify before Congress, and even move part of his research work to the U.S. to dispel suspicious about his company. The Associated Press reports:
Kaspersky, a mathematical engineer who attended a KGB-sponsored school and once worked for Russia's Ministry of Defense, has long been eyed suspiciously by his competitors, particularly as his anti-virus products became popular in the U.S. market. Some speculate that Kaspersky, an engaging speaker and a fixture of the conference circuit, kept his Soviet-era intelligence connections. Others say it's unlikely that his company could operate independently in Russia, where the economy is dominated by state-owned companies and the power of spy agencies has expanded dramatically under President Vladimir Putin. No firm evidence has ever been produced to back up the claims...
Like many cybersecurity outfits in the U.S. and elsewhere, some Kaspersky employees are former spies. Kaspersky acknowledged having ex-Russian intelligence workers on his staff, mainly "in our sales department for their relationship with the government sector." But he added that his company's internal network was too segregated for a single rogue employee to abuse it. "It's almost not possible," he said. "Because to do that, you have to have not just one person in the company, but a group of people that have access to different parts of our technological processes. It's too complicated." And he insisted his company would never knowingly cooperate with any country's offensive cyber operations.
A key Democrat on the Senate Armed Services Committee has told ABC that "a consensus in Congress and among administration officials that Kaspersky Lab cannot be trusted to protect critical infrastructure." Meanwhile, Slashdot reader Kiralan shares this article from Gizmodo noting Kaspersky Lab "has worked with both Moscow and the FBI in the past, often serving as a go-between to help the two governments cooperate." But setting the precedent of gaining trust through source code access is dangerous, as is capitulating to those demands. Russia has been making the same requests of private companies recently. Major technology companies like Cisco, IBM, Hewlett Packard Enterprise, McAfee, and SAP have agreed to give the Russian government access to "code for security products such as firewalls, anti-virus applications and software containing encryption," according to Reuters. Security firm Symantec pointedly refused to cooperate with Russian demands last week. "It poses a risk to the integrity of our products that we are not willing to accept," a Symantec spokesperson said in a statement.
Like many cybersecurity outfits in the U.S. and elsewhere, some Kaspersky employees are former spies. Kaspersky acknowledged having ex-Russian intelligence workers on his staff, mainly "in our sales department for their relationship with the government sector." But he added that his company's internal network was too segregated for a single rogue employee to abuse it. "It's almost not possible," he said. "Because to do that, you have to have not just one person in the company, but a group of people that have access to different parts of our technological processes. It's too complicated." And he insisted his company would never knowingly cooperate with any country's offensive cyber operations.
A key Democrat on the Senate Armed Services Committee has told ABC that "a consensus in Congress and among administration officials that Kaspersky Lab cannot be trusted to protect critical infrastructure." Meanwhile, Slashdot reader Kiralan shares this article from Gizmodo noting Kaspersky Lab "has worked with both Moscow and the FBI in the past, often serving as a go-between to help the two governments cooperate." But setting the precedent of gaining trust through source code access is dangerous, as is capitulating to those demands. Russia has been making the same requests of private companies recently. Major technology companies like Cisco, IBM, Hewlett Packard Enterprise, McAfee, and SAP have agreed to give the Russian government access to "code for security products such as firewalls, anti-virus applications and software containing encryption," according to Reuters. Security firm Symantec pointedly refused to cooperate with Russian demands last week. "It poses a risk to the integrity of our products that we are not willing to accept," a Symantec spokesperson said in a statement.
Beyond the paranoia, shouldn't American strive to buy American if there is an available competing product? I'm not "flag waving", but it does seem like at least one way to contribute to the American economy in some way.
If you want news from today, you have to come back tomorrow.
Well, come on now, you really must answer, "Yes" if you are for open source and the ability of the user(s) to review the code. After all, isn't the U.S. Government right now saying that they don't trust the code? Or, they've got concerns, at least?
No moderation option "-1 Moron", so posting it instead.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Why should anyone trust closed source security software in the first place?
Even if Kaspersky shows the source today and intends to be completely upright in their dealings, they are still susceptible to govt interference. The govt could nully them into doing it's bidding, or could plant it's own people on the team.
Just as I understand China not wanting to take MS at it's word, we should probably not rely on these guys.
A thousand pounds of wood moving at 300 feet per minute. Don't get in the way.
The real value of anti-virus software is not the source code, it's the data--the signatures it looks for to spot malware. I'm fine with them keeping their database proprietary. But why not make the source code freely available...unless they have something to hide!
Let's say they release some source code. Who could prove that the executable that customers use, was compiled from that source code, without modification?
a) Don't trust Symantec, they've got stuff to hide in their source code whether it's NSA-stuff or sloppy code.
b) You can probably trust Kaspersky for most things except NSA-stuff.
I've personally never trusted Symantec and I always thought Kaspersky was good enough for the home, I never considered them to be a serious contender in the enterprise-market. I have serious reservations about most US-based closed source (security) software and closed system hardware manufacturers. The NSA persuaded a relatively small (10k employees) employer of mine to install taps with full cooperation of Cisco and IBM, so any of these larger companies must have ties if not outright taps in the software.
What we really need is for these companies to open-source their stuff.
Custom electronics and digital signage for your business: www.evcircuits.com
The government is free to write its own anti-virus software.
Seven puppies were harmed during the making of this post.
How many US companies would want to show their source code to the Russian government? The Russia government has a far more trustworthy record in this area. Most malware now is based on code from the NSA. I think Kaspersky should not trust the US government and by doing so they become less trustworthy. If they rolled over on this how can we trust them not to allow changes to their code?
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
They are (to the extent it is applicable to anything that's Russian) a private company, at least on the US market, and they can hide or disclose whatever parts of the code they want, unless there's a subpoena or a search warrant. But by the same token, of course no agency in their right mind, much less a government agency, can possibly contemplate using anything developed by a KGB man.
I can assure you, the best way to get rid of dragons is to have one of your own.
"Russian anti-virus CEO offers up code for US govt scrutiny"
http://hosted.ap.org/dynamic/s...
"... ready to have his company's source code examined by U.S. government officials"
Domestic spying is now "Benign Information Gathering"
Catches a lot, low footprint, Czechoslovakia is just awesome.
TFA: "A key Democrat on the Senate Armed Services Committee has told ABC that "a consensus in Congress and among administration officials that Kaspersky Lab cannot be trusted to protect critical infrastructure.""
The same could be said by any foreign government or individual about Microsoft or Apple operating systems.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
I e-mailed all my gay clown porn to vlad247@aol.com. He wrote me back a nice thank you letter. I now run Kaspersky on all my devices without fear!
Links or STFU.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
Seriously, let them decide "fuck the USA, we still have the rest of the world". Downside? Sales in the US fall. Upside? As the great lady sings "Are EE Ess Pee Ee See Tee".
Give em the source. Downside? NSA says "damn, never thought of that.". Or "damn, they just found $NSA_Hack_Tool". Upside? Nothing I can think of, outside of sales in the US.
"sure, here's mode code right here. I promise it's the real thing"
Regardless of the other arguments, who really thinks he will provide the real code?
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
No, I want Trump shot into the sun, but at worst, Russia used journalism against America, which is GOOD for the people, albeit bad for the government.
This is my signature. There are many like it, but this one is mine.
It's unlikely that his company could operate independently in Russia, where the economy is dominated by state-owned companies and the power of spy agencies has expanded dramatically under President
The funny part is that you can take this sentence, replace Russia by US, and state-owned by privately-owned, and it is still true.
Because Putin's anti-virus would be the one most likely to not have NSA backdoors, which is what an American citizen should be concerned about.
This is my signature. There are many like it, but this one is mine.
Who believes the US government doesn't have a full copy of the source already?
For once, the answer to the headline is "yes."
Yes, Kaspersky should show its source code to the US Government. They should show their source code to all of their users. All software should come with its source code. If you weren't convinced of that before, you should have been by the audit of Toyota's source code.
http://www.safetyresearch.net/...
it's the kind of positive make-work project that does good things for the local economy. The guys I know in the defense industry make 2-3x the going rate for the equivalent work (unless they're high-end math guys, Wallstreet gobbles those guys up for HFT).
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
It's important that the US government, the primary creator of forced backdoors and exploits, can make sure code doesn't have... oh.
Now, if you'll excuse me, I've got to go and patch everything in my home due the the huge cache of zero day exploits the NSA were hoarding, rather than reporting, until they got leaked.
Who to trust? American Software? Ask the NSA, they will recommend it.
If the russians want to spy, they at least want to spy on the government not on the people.
Today the CEO of Kaspersky Lab said he's willing to show the company's source code to the U.S. government, testify before Congress, and even move part of his research work to the U.S. to dispel suspicious about his company. The Associated Press reports:
From real life to gaming VR I've never heard of anyone being able to dispel suspicious.
A 'singular oddity' is an event that cannot be explained and only happens when you are alone.
"Kaspersky Lab cannot be trusted to protect critical infrastructure"
Whereas the US government is totally trustworthy. /sarc
Enjoy life! This is not a dress rehearsal.
Some speculate that Kaspersky, [...] kept his Soviet-era intelligence connections.
No shit. Of course he did, you have to be a total idiot not to have connections to the intelligence sphere of the country you are operating in if you own a company in the security industry.
The question should not be if he has connections. That's a given. You think McAfee has no such connections? The question is if they affect the product he is selling in a technically meaningful way. That he keeps such connections for the purpose of sales is clear.
But hey, digging deeper than a sensationalist quote has fallen out of fashion, hasn't it?
Assorted stuff I do sometimes: Lemuria.org
Russia is a kleptocracy, and it's absurd to think they could not put the screw on Kaspersky. While they are based in or have assets in Russia, I certainly wouldn't use them. End of story.
If Kaspersky resisted, it'd be bullets and polonium tea all around. Simple as that.
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
I suppose traitor would be the closer answer. I'm opposed to my government because I give a shit about my country. I think we should release anything bad on Putin, Russian hackers should release anything bad on us, and rinse and repeat for every other country in the world. Then, we get plenty of sunshine, and the cockroaches scatter.
This is my signature. There are many like it, but this one is mine.
Yeah, but he's a different kind of liar, which was slightly less disgusting to a portion of the population. Particularly, he told the truth on some issues, such as TPP. Had the Dems nominated Sanders, a lot of that appeal would have been gone.
This is my signature. There are many like it, but this one is mine.
he will tweet a 3am patch for the backdoors
Oh, then that's what Covfefe was !
That's why "The president and a small group of people know exactly what he meant [by covfefe]" !
It was a super secret code word to fix a vulnerability in Microsoft Windows before the Petya ransomware spreads ?
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Indeed. But Trump followers often resemble Trump, so that is not much of a surprise.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The Russian apparatchiks in the White House?
Or the freedom fighters in Deep State?
-- Tigger warning: This post may contain tiggers! --
What would be the point? they can upload security updates at any time to upload nefarious programs/functions. I get almost 6 Mb a day security updates from Norton how do i know they are not acting hand in hand what their government ? Or they are acting with someone else?
Jack of all trades,master of none
Kaspersky Lab should show it's source code to *everyone*, not just the U.S. government. It's absurd to even contemplate relying on a security product for which the source code is not publicly available. This case should highlight how incredibly absurd it is that proprietary software still exists in our society.
But even in your metaphor, proximity matters. If I have two shields, one strong against the Scylla and weak against the Charybdis, one strong against the Charybdis and weak against the Scylla, and I'm sailing pasting the Scylla, I would be a fool to not choose the shield strong against the Scylla, even though it is weak against the Charybdis, because the Charybdis is too far away to be a real concern.
Ultimately, I'd advise against using Windows altogether, but that's an entirely different conversation.
This is my signature. There are many like it, but this one is mine.
Don't look at the NSA, look at the Russians!
Requiem for the American Dream
It was good for US corporations, but bad for US workers.
This is my signature. There are many like it, but this one is mine.