Language Selection

English French German Italian Portuguese Spanish

Software flaws don't negate "many eyes" in open source

Filed under
OSS
Security

The allegations from Greg Perry regarding backdoors allegedly placed within OpenBSD about a decade ago seem to be shifting more and more into the realm of fantasy as each day goes by.

To date, Perry has not responded to my inquiry regarding his Dec. 11 e-mail to OpenBSD founder Theo de Raadt, nor to my knowledge has he responded publicly anywhere else. Meanwhile, the two (or three, depending on how you count it) people named in Perry's message to de Raadt as parties to this supposed backdoor activity, Scott Lowe and Jason Wright, have denied their involvement--the latter within the same [openbsd-tech] thread that started all this.

Since no one has heard any more from Perry, I will decline to speculate why he made these accusations, except to note that sometimes silence can speak volumes, and this may indeed be one of those instances.

While the accusations fly, de Raadt has indicated at least to one media outlet that an audit of this part of the OpenBSD code has found some bugs.

"We've been auditing since the mail came in! We have already found two bugs in our cryptographic code. We are assessing the impact. We are also assessing the 'archeological' [sic] aspects of this," de Raadt told iTWire.

It is not clear whether these bugs would allow the insertion of a backdoor or sideways entry-point into an OpenBSD system, nor if, based on de Raadt's statements to iTWire's Sam Varghese, these are the only bugs in this part of OpenBSD.

My colleague Glyn Moody tapped on any possible existence of such bugs in OpenBSD--planted or not--as a fundamental problem with one of the core tenets of free and open source software (FLOSS) development:

rest here




More in Tux Machines

digiKam Software Collection 4.3.0 released...

After a long bugs triage, we have worked hard also to close your reported issues.. A long list of the issues closed in digiKam 4.3.0 is available through the KDE Bugtracking System. Read more

Seneca College realizes value of open source

Red Hat has done a lot of work with CDOT, lately specializing in Fedora for ARM processors. Pidora, the Fedora Linux Remix specifically targeted to the Rasberry Pi, was primarily developed at CDOT. Another company that we have been working with lately is Blindside Networks. They do a lot of work with CDOT on the BigBlueButton project, which is a web conferencing tool for online education. NexJ is a Toronto-based software development firm that has worked with CDOT on various aspects of open health tools on the server side and integration of medical devices with smart phones. We have recently started working on the edX platform, where developers around the globe are working to create a next-generation online learning platform. Read more

Today in Techrights

Initial impressions of PCLinuxOS 2014.08

I spend more time looking at the family trees of Linux distributions than I do looking at my own family tree. I find it interesting to see how distributions grow from their parent distribution, either acting as an extra layer of features which regularly re-bases itself or as a separate fork. New distributions usually tend to remain similar in most ways to their parent distro, using the same package manager and maintaining similar philosophies. When I look at the family trees of Linux distributions one project stands out more than others: PCLinuxOS. Read more