Language Selection

English French German Italian Portuguese Spanish

Software flaws don't negate "many eyes" in open source

Filed under
OSS
Security

The allegations from Greg Perry regarding backdoors allegedly placed within OpenBSD about a decade ago seem to be shifting more and more into the realm of fantasy as each day goes by.

To date, Perry has not responded to my inquiry regarding his Dec. 11 e-mail to OpenBSD founder Theo de Raadt, nor to my knowledge has he responded publicly anywhere else. Meanwhile, the two (or three, depending on how you count it) people named in Perry's message to de Raadt as parties to this supposed backdoor activity, Scott Lowe and Jason Wright, have denied their involvement--the latter within the same [openbsd-tech] thread that started all this.

Since no one has heard any more from Perry, I will decline to speculate why he made these accusations, except to note that sometimes silence can speak volumes, and this may indeed be one of those instances.

While the accusations fly, de Raadt has indicated at least to one media outlet that an audit of this part of the OpenBSD code has found some bugs.

"We've been auditing since the mail came in! We have already found two bugs in our cryptographic code. We are assessing the impact. We are also assessing the 'archeological' [sic] aspects of this," de Raadt told iTWire.

It is not clear whether these bugs would allow the insertion of a backdoor or sideways entry-point into an OpenBSD system, nor if, based on de Raadt's statements to iTWire's Sam Varghese, these are the only bugs in this part of OpenBSD.

My colleague Glyn Moody tapped on any possible existence of such bugs in OpenBSD--planted or not--as a fundamental problem with one of the core tenets of free and open source software (FLOSS) development:

rest here




More in Tux Machines

Tiny SODIMM-style COM runs Linux on Atmel Cortex-A5 SoC

Ka-Ro’s SODIMM-style “TXA5″ COM runs Linux on Atmel’s SAMA5D42 SoC, offers Ethernet, LCD, USB, GPIO, and serial I/O, and supports industrial temperatures. The TXA5 is the first Atmel-based member of the Ka-Ro Electronics family of “TX” COMs. Most of Ka-Ro’s COMs have used Freescale processors, and many have been sold under the Strategic Test label, including the i.MX283-based TX-28S from 2012. Read more

Meet Geary: A Thunderbird Email Client Alternative on Linux

On Linux there are a few open source alternatives to the Thunderbird email client. There’s Evolution, KMail, Claws-Mail, Alpine (if you’re really old-school), and a handful of other clients (most of which, don’t live up to anyone’s expectations). There’s also a new kid on the email block. That kid is the brainchild of Yorba. Meet Geary, the new default IMAP email client for the GNOME desktop (and the likes of Elementary OS Freya). Read more

Philly’s open source mentorship program is back and expanding to 3 cities

Women are drastically underrepresented in the open source movement. Of the open source contributions made in 2013, only 11 percent were made by women, according to a survey of the open source community. Girl Develop It wanted to change that. That’s why the nonprofit partnered with civic hacking group Code for Philly last year to launch a summer-long open source fellowship for women. Fellows said the program helped them find their place in the tech community. Read more

SourceForge hijacks GIMP account, loads it with adware

It looks like SourceForge has taken over the account of GIMP user Jernej Simončič who was maintaining the Windows version of the project. Read more