Language Selection

English French German Italian Portuguese Spanish

Software flaws don't negate "many eyes" in open source

Filed under
OSS
Security

The allegations from Greg Perry regarding backdoors allegedly placed within OpenBSD about a decade ago seem to be shifting more and more into the realm of fantasy as each day goes by.

To date, Perry has not responded to my inquiry regarding his Dec. 11 e-mail to OpenBSD founder Theo de Raadt, nor to my knowledge has he responded publicly anywhere else. Meanwhile, the two (or three, depending on how you count it) people named in Perry's message to de Raadt as parties to this supposed backdoor activity, Scott Lowe and Jason Wright, have denied their involvement--the latter within the same [openbsd-tech] thread that started all this.

Since no one has heard any more from Perry, I will decline to speculate why he made these accusations, except to note that sometimes silence can speak volumes, and this may indeed be one of those instances.

While the accusations fly, de Raadt has indicated at least to one media outlet that an audit of this part of the OpenBSD code has found some bugs.

"We've been auditing since the mail came in! We have already found two bugs in our cryptographic code. We are assessing the impact. We are also assessing the 'archeological' [sic] aspects of this," de Raadt told iTWire.

It is not clear whether these bugs would allow the insertion of a backdoor or sideways entry-point into an OpenBSD system, nor if, based on de Raadt's statements to iTWire's Sam Varghese, these are the only bugs in this part of OpenBSD.

My colleague Glyn Moody tapped on any possible existence of such bugs in OpenBSD--planted or not--as a fundamental problem with one of the core tenets of free and open source software (FLOSS) development:

rest here




More in Tux Machines

Ubuntu Developers Working on Feature Parity for Unity 8 - Video

A large part of the work that's been done for Unity 8 is focused on making it looks and feel like Unity 7. Canonical is not trying to reinvent Unity; it's rewriting it for the future. Read more

GPS Navigation for Ubuntu Touch Gets More Features

GPS Navigation is a free app for Ubuntu Touch, and it's been getting constant updates for the past few weeks. It's still in the development stages, but it looks like it's coming together just nicely. Read more

Next Tizen Smartphone, Samsung Z3 SM-Z300H, Imported to india for Testing

The Samsung Z3 SM-Z300H is going to be the second Tizen based Smartphone to begin testing in India and hopefully final release. We Initially reported on the existence of the Z3 with Sammobile confirming it will be the next Tizen mobile phone to be released. Now our friends at Best Tizen Apps have noticed a shipment of a few “SM-Z300H” Smartphones making the journey from Korea to Bangalore India, reported for testing purposes. The phone is shipped as costing $205 USD per unit around 13,039 INR, but this is more of a speculated price and does not reflect final retail pricing. Read more

It's Now Easier Managing Systemd In KDE

For those running KDE on a systemd-based Linux system, the KDE Control Module for controlling this init system and its options has been updated. Read more