Comment by TacticalCoder | Hacker News Reader

Comment by TacticalCoder | Hacker News Reader

Parent Full thread

There's a talk that was given in Belgium / Brussels at FOSDEM2014 two months ago or so by Poul-Henning Kamp (FreeBSD) regarding the NSA and how he'd do it if he had to create holes in software:

http://www.youtube.com/watch?v=fwcl17Q0bpk

He's talking specifically about OpenSSL quite a lot (basically saying it's too complex to ever be secure and probably received many "security patches" from NSA employees).

The entire talk is an eye opener. He explains how NSA shills are reading reddit / HN and poisoning communities / standards / protocols / etc. How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things.

He talks about shills submitting a few correct patches over the months / years, slowly gaining reputation among the community and then misusing that trust to submit (not so) subtle patches introducing security holes on purpose.

He mentions a few of the "common mantra" repeated often (including here) by people who have an interest in the status quo.

He explains why SSL/TLS is broken and says that the "SEC" part of "DNSSEC" is not going to be that secure ; )

I think that the problem is much worse than most people think and that Poul-Henning Kamp is closer to the truth than the ones constantly repeating "bug happens" as if nothing malicious was ever going on.

> How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things.

Developers are quite willing and able to do this all on their own. Feature/scope creep is pretty horrible these days.

I'm watching this right now, it's brilliant! This is exactly the kind of stuff I love to think about, but PHK has done a wonderful job thinking it out to a lot of detail. I suggest everyone drop what you're doing and watch it asap. It's exciting and really holds your interest.

I did watch, thanks, but anyone in a hurry can get just the slides here: http://phk.freebsd.dk/_downloads/FOSDEM_2014.pdf

I particularly appreciated the "QUEEN success example: SSC" (self-signed certificates, starts at slide 23), which also got a good laugh from the audience ...

(if you're just watching the video, this is the text of the second slide in the PDF, not shown at FOSDEM:

""" What is this ?

This is a ficticious NSA briefing I gave as the closing keynote at FOSDEM 2014

The intent was to make people laugh and think, but I challenge anybody to prove it untrue.

Playlist spoiler:

Electric Light ORCHESTRA: Confusion

ABBA: Money, Money, Money

Backman Turner OVERDRIVE: Taking Care Of Business

QUEEN: Bicycle Race

Beastie BOYS: Sabotage

PASADENA Roof Orchestra: Pennies From Heaven """ )

Here's an interesting thought.

The NSA isn't the only entity who could stand to benefit from a privately held exploit to most SSL implementations. The NSA is also not the only group who could actually accomplish this.

Who's to say there aren't groups out there that are doing this already to steal and profit from corporate information, credit cards, etc.?

Reality is NSA has to do very very little to make this happen. Tiny nudges here and there. Profit motive encourages people to move towards complexity. Simple software commodifies too quickly.

Too be fair it is obviously intended to be a talk on what could be happening and not what certainly is.

It is, however, reasonable to assume that "they" are as smart as we are, so "how would I do it" analysis is quite called for.

Yes, but it's not reasonable to assume that our armchair "how I would do it" theorizing is, in fact, how they would do it. We can assume that they have come up with the idea, but maybe they discarded it for reasons that aren't obvious to us.

Sorry to introduce the hyperbole, or not moderate it.

When the government runs a campaign to cause the public to fear and doubt your neighbor that is the beginning of a dark time ahead. This idea that they are one of you, or someone on reddit is just poison.

On an emotional level, more and more Edward Showden is becoming a mystical figure.

> How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things.

Ah, so that's why OpenSSL is not implemented as a RoR web application with REST-API and Cucumber tests in a TDD way so that Johnny Webmonkey can easily contribute. I always assumed it had to do with portability and performance.

Reply on news.ycombinator.com