Fred A. Miller wrote:

Government spooks helped Microsoft build Vista

"THE USA GOVERNMENT'S cryptologic organisation, the National Security Agency, has admitted that it is behind some of the security changes to Microsoft's operating system Vista.

Didn't they come up with a secure version of Red Hat a few years ago? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

George Stoianov wrote:

...

operating system, and Novell with its SUSE Linux also asked the NSA what it thought of their products."

...Thanks!!! it is good to know Novell is giving a permission to the NSA to install an _official_ backdoor in my Linux system... That's quite a leap of logic. And difficult to imagine, since the source is available for verification.

Joe -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

HI Joe et al.. On Thursday 11 January 2007 20:43, J Sloan wrote:

George Stoianov wrote:

...

...

operating system, and Novell with its SUSE Linux also asked the NSA what it thought of their products."

...Thanks!!! it is good to know Novell is giving a permission to the NSA to install an _official_ backdoor in my Linux system...

That's quite a leap of logic. And difficult to imagine, since the source is available for verification.

Its quite true that the source is available, but two questions. #1 How can I know that the software that I install is the same as what the source is? #2 How many of us Linux users would recognized a backdoor if he saw one? JIM -- Jim Hatridge Linux User #88484 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Ysgrifennodd James Hatridge:

Its quite true that the source is available, but two questions.

#1 How can I know that the software that I install is the same as what the source is?

#2 How many of us Linux users would recognized a backdoor if he saw one?

JIM

#1. You screw your tin foil hat on very tight, and then you install from the sources. #2. You don't reley on Linux users, you rely on the Linux programmers. They would recognise a back door if they saw one and many if not all of them would scream very loudly if they found one. Unless you believe that there is a conspiracy between the kernel developers and the NSA/MI6 or whatever. Remember lots of these guys aren't Americans. But hey! If you want to believe they're out to get you, don't let me stop you. Peter -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Am Donnerstag, 11. Januar 2007 21:55 schrieb Peter Bradley:

But hey! If you want to believe they're out to get you, don't let me stop you.

Not believing that THEY are after you doesn't mean that they aren't. ;) and given the recent developments here in germany and the EU in general, I'm pretty sure "they" are. bye, MH -- gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

John Andersen wrote:

On Thursday 11 January 2007 10:04, George Stoianov wrote:

...

...

operating system, and Novell with its SUSE Linux also asked the NSA what it thought of their products." ...Thanks!!! it is good to know Novell is giving a permission to the NSA to install an _official_ backdoor in my Linux system... the same way as for Windows. Do not flame me I know it is in the interest of national security and to stop evil people from evil doings with which I whole heartedly agree.

... why suse <shake head> why...

Get real will you!

How would you hide an official back door in an open source project?

It's a secret. If I told you, I'd have to kill you. -- Tony Alfrey tonyalfrey@earthlink.net "I'd Rather Be Sailing" -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

George Stoianov wrote:

...

operating system, and Novell with its SUSE Linux also asked the NSA what it thought of their products."

...Thanks!!! it is good to know Novell is giving a permission to the NSA to install an _official_ backdoor in my Linux system... the same way as for Windows. Do not flame me I know it is in the interest of national security and to stop evil people from evil doings with which I whole heartedly agree.

... why suse <shake head> why... Ummm... NSA produced a secure version of Red Hat a while ago.

http://www.nsa.gov/selinux/ People seem to forget that with open source software, it's hard for anyone to hide a "back door". NSA's efforts with SELinux was to harden it against attack. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

James Hatridge wrote:

HI Joe et al.. On Thursday 11 January 2007 20:43, J Sloan wrote:

...

George Stoianov wrote:

...

...

operating system, and Novell with its SUSE Linux also asked the NSA what it thought of their products."

...Thanks!!! it is good to know Novell is giving a permission to the NSA to install an _official_ backdoor in my Linux system...

That's quite a leap of logic. And difficult to imagine, since the source is available for verification.

Its quite true that the source is available, but two questions.

#1 How can I know that the software that I install is the same as what the source is?

Compile from source.

#2 How many of us Linux users would recognized a backdoor if he saw one?

You don't have to. There are enough who could, who'd then start yelling. Don't forget, one of the rolls of the NSA is to ensure software is secure enough for certain government uses. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

George Stoianov wrote:

...

#1 How can I know that the software that I install is the same as what the source is?

#2 How many of us Linux users would recognized a backdoor if he saw one?

#3 Why the NSA why not some international security body or industry institution?

The NSA is the security body for the U.S. Government. You want Dubya to trust some other country to ensure his "goofs" get covered up? ;-) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

Randall R Schulz wrote:

On Thursday 11 January 2007 18:39, James Knott wrote:

...

George Stoianov wrote:

...

...

#1 How can I know that the software that I install is the same as what the source is?

#2 How many of us Linux users would recognized a backdoor if he saw one?

#3 Why the NSA why not some international security body or industry institution?

The NSA is the security body for the U.S. Government.

"The?" As in "only one?"

And "security body?" They're charge is "signals intelligence," i.e. intelligence derived from intercepting communications, mostly electronic, both over-the-air and via the Internet and telephone networks. Naturally, this leads them to extensive cryptanalysis and cryptographic work.

Well, in this context anyway. There's of course the CIA, FBI and military.

...

You want Dubya to trust some other country to ensure his "goofs" get covered up? ;-)

You don't know what I want w.r.t. the 43rd president of the U.S. (By which I mean I don't want you to know what I want w.r.t. the 43rd president of the U.S...)

Notice that when he talked about mistakes yesterday, he didn't mention hanging chad? ;-) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Thursday 11 January 2007 20:23, Paul Abrahams wrote:

On Thursday 11 January 2007 8:59 pm, James Knott wrote:

...

...

#1 How can I know that the software that I install is the same as what the source is?

Compile from source.

Many years ago Ken Thompson (or maybe it was Dennis Ritchie) gave the ACM Turing Lecture on, essentially, coding tricks. He showed how it was possible to booby-trap a compiler using repeated bootstraps in such a way that the compiler was corrupted, yet its visible source code was clean. Recompiling the compiler would retain the corruption. And such a corrupted compiler could do anything, of course.

Which, of course, leads us directly to those commie Gnu types, since they control gcc _and_ define the GPL! To quote Monty Burns (a true capitalist in its finest tradition): "Damn their oily hides!" (thunder clap)

Paul

RRS -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Thursday 11 January 2007 19:23, Paul Abrahams wrote:

Many years ago Ken Thompson (or maybe it was Dennis Ritchie) gave the ACM Turing Lecture on, essentially, coding tricks.  He showed how it was possible to booby-trap a compiler using repeated bootstraps in such a way that the compiler was corrupted, yet its visible source code was clean.  Recompiling the compiler would retain the corruption.  And such a corrupted compiler could do anything, of course.

Actually what he showed was that the compilers couldn't do anything. They were useless in the real world. If you want to hunt ghosts, go see what's burned in silicon in the chips on the motherboards, nics, and routers. Stop fantasizing about secrets hidden in open source. -- _____________________________________ John Andersen -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

----- Original Message ----- From: "Randall R Schulz"

On Thursday 11 January 2007 18:39, James Knott wrote:

...

You want Dubya to trust some other country to ensure his "goofs" get covered up? ;-)

You don't know what I want w.r.t. the 43rd president of the U.S. (By which I mean I don't want you to know what I want w.r.t. the 43rd president of the U.S...)

I'll chime in on this one. What I want originates in the House of Representatives, is tried in the Senate and begins with the letter "I". For a historical reference, ask tricky Dick about the process. -- David C. Rankin, J.D., P.E. 510 Ochiltree Street Nacogdoches, Texas 75961 (936) 715-9333 (936) 715-9339 fax www.rankinlawfirm.com -- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Friday 12 January 2007 22:26, Mathias Homann wrote:

Am Freitag, 12. Januar 2007 22:17 schrieb david rankin:

...

I'll chime in on this one. What I want originates in the House of Representatives, is tried in the Senate and begins with the letter "I". For a historical reference, ask tricky Dick about the process.

does it have a fruit in it?

That's one of the few things that hasn't been said about the present occupant of the albino mansion. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On 1/11/07, Paul Abrahams wrote:

On Thursday 11 January 2007 8:59 pm, James Knott wrote:

...

...

#1 How can I know that the software that I install is the same as what the source is?

Compile from source.

Many years ago Ken Thompson (or maybe it was Dennis Ritchie) gave the ACM Turing Lecture on, essentially, coding tricks. He showed how it was possible to booby-trap a compiler using repeated bootstraps in such a way that the compiler was corrupted, yet its visible source code was clean. Recompiling the compiler would retain the corruption. And such a corrupted compiler could do anything, of course.

Paul --

IIRC, He didn't show that it was possible, he actually did it and had it in the C compiler for years before announcing that it was in there. Due to the backdoor, Ken Thompson could log into any UNIX machine at the time. A brief google found this: Along with Dennis Ritchie, Ken Thompson received the ACM Turing award in 1983, for "for their development of generic operating systems theory and specifically for the implementation of the UNIX operating system.". In his Turing award lecture, Reflections On Trusting Trust, Ken Thompson described a hack that he placed into early UNIX systems: the C compiler would insert a back door whenever it compiled the login program, allowing Ken Thompson to access any UNIX system. The scheme was so fiendish that if you tried remove the back-door generating code from the source code and recompile the compiler, the compiler would reintroduce the back door generation into the source code! Greg -- Greg Freemyer The Norcross Group Forensics for the 21st Century -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On 1/12/07, John Andersen wrote:

Actually what he showed was that the compilers couldn't do anything. They were useless in the real world.

If you want to hunt ghosts, go see what's burned in silicon in the chips on the motherboards, nics, and routers. Stop fantasizing about secrets hidden in open source.

Agreed. It's probly even simpler than that. Your traffic has to traverse ISP's doesn't it. If the cops have full free riegn over that traffic, what makes you think the NSA or military don't? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Saturday 13 January 2007 03:51, Greg Freemyer wrote:

program, allowing Ken Thompson to access any UNIX system. The scheme was so fiendish that if you tried remove the back-door generating code from the source code and recompile the compiler, the compiler would reintroduce the back door generation into the source code!

Well, the code wasn't in the released source version. The compiler recognised when it was compiling itself, and inserted the code at the proper place. If it had been in the released source, there would have been an uproar about it btw, if you're googling for it, google the archives of this list. I've mentioned this hack a few times, along with a link to the speech. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Saturday 13 January 2007 5:04 am, Anders Johansson wrote:

On Saturday 13 January 2007 03:51, Greg Freemyer wrote:

...

program, allowing Ken Thompson to access any UNIX system. The scheme was so fiendish that if you tried remove the back-door generating code from the source code and recompile the compiler, the compiler would reintroduce the back door generation into the source code!

Well, the code wasn't in the released source version. The compiler recognised when it was compiling itself, and inserted the code at the proper place.

If it had been in the released source, there would have been an uproar about it

btw, if you're googling for it, google the archives of this list. I've mentioned this hack a few times, along with a link to the speech.

The reference to "source code" in the first paragraph almost certainly should have been to "object code" -- just a slip of the keyboard. The slip appears in the Google reference and wasn't introduced by anyone on this list. Paul -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org

On Thursday January 11 2007 7:32 am, James Knott wrote:

Fred A. Miller wrote:

...

Government spooks helped Microsoft build Vista

"THE USA GOVERNMENT'S cryptologic organisation, the National Security Agency, has admitted that it is behind some of the security changes to Microsoft's operating system Vista.

Didn't they come up with a secure version of Red Hat a few years ago?

'Think so. Fred -- MickySoft, the ultimate corporate parasite. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org