Language Selection

English French German Italian Portuguese Spanish

Software flaws don't negate "many eyes" in open source

Filed under

The allegations from Greg Perry regarding backdoors allegedly placed within OpenBSD about a decade ago seem to be shifting more and more into the realm of fantasy as each day goes by.

To date, Perry has not responded to my inquiry regarding his Dec. 11 e-mail to OpenBSD founder Theo de Raadt, nor to my knowledge has he responded publicly anywhere else. Meanwhile, the two (or three, depending on how you count it) people named in Perry's message to de Raadt as parties to this supposed backdoor activity, Scott Lowe and Jason Wright, have denied their involvement--the latter within the same [openbsd-tech] thread that started all this.

Since no one has heard any more from Perry, I will decline to speculate why he made these accusations, except to note that sometimes silence can speak volumes, and this may indeed be one of those instances.

While the accusations fly, de Raadt has indicated at least to one media outlet that an audit of this part of the OpenBSD code has found some bugs.

"We've been auditing since the mail came in! We have already found two bugs in our cryptographic code. We are assessing the impact. We are also assessing the 'archeological' [sic] aspects of this," de Raadt told iTWire.

It is not clear whether these bugs would allow the insertion of a backdoor or sideways entry-point into an OpenBSD system, nor if, based on de Raadt's statements to iTWire's Sam Varghese, these are the only bugs in this part of OpenBSD.

My colleague Glyn Moody tapped on any possible existence of such bugs in OpenBSD--planted or not--as a fundamental problem with one of the core tenets of free and open source software (FLOSS) development:

rest here

More in Tux Machines

New Test Release Of Android-x86 Now Available

For those with some spare x86 tablet/mobile hardware around, a new test build of Android-x86 is out in the wild. Since October there's been the Android-x86 5.1-RC1 build of Lollipop and since then is also a x86 branch based on Android 6.0-Marshmallow. A Phoronix reader pointed out that uploaded today to the project's SourceForge page is an Android-x86 20151128 release. Read more

Top 5 reasons I'm thankful for Android

Yes, that's perfect. One of the things I've been so thankful for is that, unlike the competition (wink wink, nudge nudge) each iteration of Android offers up a bevy of improvements. There has yet to be an Android release that failed to please. Lollipop was better than KitKat, which was better than Jellybean, which was better than Ice Cream Sammich — you get the idea. This is one of the very reasons I've been so excited about getting Marshmallow, as well as why I've been so frustrated about not getting it. Read more

Wine 1.8-RC2