Language Selection

English French German Italian Portuguese Spanish

Software flaws don't negate "many eyes" in open source

Filed under
OSS
Security

The allegations from Greg Perry regarding backdoors allegedly placed within OpenBSD about a decade ago seem to be shifting more and more into the realm of fantasy as each day goes by.

To date, Perry has not responded to my inquiry regarding his Dec. 11 e-mail to OpenBSD founder Theo de Raadt, nor to my knowledge has he responded publicly anywhere else. Meanwhile, the two (or three, depending on how you count it) people named in Perry's message to de Raadt as parties to this supposed backdoor activity, Scott Lowe and Jason Wright, have denied their involvement--the latter within the same [openbsd-tech] thread that started all this.

Since no one has heard any more from Perry, I will decline to speculate why he made these accusations, except to note that sometimes silence can speak volumes, and this may indeed be one of those instances.

While the accusations fly, de Raadt has indicated at least to one media outlet that an audit of this part of the OpenBSD code has found some bugs.

"We've been auditing since the mail came in! We have already found two bugs in our cryptographic code. We are assessing the impact. We are also assessing the 'archeological' [sic] aspects of this," de Raadt told iTWire.

It is not clear whether these bugs would allow the insertion of a backdoor or sideways entry-point into an OpenBSD system, nor if, based on de Raadt's statements to iTWire's Sam Varghese, these are the only bugs in this part of OpenBSD.

My colleague Glyn Moody tapped on any possible existence of such bugs in OpenBSD--planted or not--as a fundamental problem with one of the core tenets of free and open source software (FLOSS) development:

rest here




More in Tux Machines

Ninja Blocks prepares to begin shipping, announces major Ubuntu IoT deal

Ninja Blocks has begun shipping the Ninja Sphere and announced it has signed up as a key partner for Canonical’s Ubuntu Core embedded device operating system, as it opens its first office in the US. The startup launched in 2012, when it was selected to participate the Startmate accelerator program, and also smashed a Kickstarter campaign for its first product, which was also called Ninja Blocks. Read more

Netrunner 14.1 – Main Edition (Frontier)

The “14.1” indicates an updated and polished release of Netrunner 14 LTS on the same underlying base. Since 14.1 is using the same base “trusty” like Netrunner 14, there is no need for users of 14 to migrate: Simply updating from the shared backports ppa of the Frontier release cycle should give the same result, while keeping customizations in place. Read more

Wayland 1.6.1 & Weston 1.6.1 Released

Bryce Harrington, the former Canonical employee part of Ubuntu's X/Mir team turned Samsung open-source employee, has issued the first maintenance update for Wayland 1.6. Wayland 1.6.1 and the reference compositor Weston 1.6.1 were released on Friday night by Harrington. The Wayland 1.6.1 stable update has just over a dozen changes and they're mostly tiny bug-fixes/corrections but there is also improved handling for some error situations between servers and clients. The brief Wayland 1.6.1 release announcement can be read on the Wayland mailing list. Read more

GParted Live 0.21.0 Beta 1 Is Now Based on Linux Kernel 3.16.7

GParted Live, a small bootable GNU/Linux distribution for x86-based computers that can be used for creating, re-organizing, and deleting disk partitions with the help of tools that allow managing file systems, has been upgraded to version 0.21.0 Beta 1. Read more