Language Selection

English French German Italian Portuguese Spanish

Software flaws don't negate "many eyes" in open source

Filed under
OSS
Security

The allegations from Greg Perry regarding backdoors allegedly placed within OpenBSD about a decade ago seem to be shifting more and more into the realm of fantasy as each day goes by.

To date, Perry has not responded to my inquiry regarding his Dec. 11 e-mail to OpenBSD founder Theo de Raadt, nor to my knowledge has he responded publicly anywhere else. Meanwhile, the two (or three, depending on how you count it) people named in Perry's message to de Raadt as parties to this supposed backdoor activity, Scott Lowe and Jason Wright, have denied their involvement--the latter within the same [openbsd-tech] thread that started all this.

Since no one has heard any more from Perry, I will decline to speculate why he made these accusations, except to note that sometimes silence can speak volumes, and this may indeed be one of those instances.

While the accusations fly, de Raadt has indicated at least to one media outlet that an audit of this part of the OpenBSD code has found some bugs.

"We've been auditing since the mail came in! We have already found two bugs in our cryptographic code. We are assessing the impact. We are also assessing the 'archeological' [sic] aspects of this," de Raadt told iTWire.

It is not clear whether these bugs would allow the insertion of a backdoor or sideways entry-point into an OpenBSD system, nor if, based on de Raadt's statements to iTWire's Sam Varghese, these are the only bugs in this part of OpenBSD.

My colleague Glyn Moody tapped on any possible existence of such bugs in OpenBSD--planted or not--as a fundamental problem with one of the core tenets of free and open source software (FLOSS) development:

rest here




More in Tux Machines

NVIDIA 367.44 Stable Linux Driver Released

While the NVIDIA 370 Linux driver series is currently in beta, the 367 driver series has been updated as the latest long-lived branch release. The Pascal-based TITAN X, GeForce GTX 1060 3GB, and GTX 1060 6GB are now officially supported... That's just with regards to proper product detection as I've been using the GTX 1060 fine on earlier driver releases, etc. Read more Also: Nvidia 367.44 Driver Adds TITAN X (Pascal) and GeForce GTX 1060 Support to Linux

OpenIndiana Operating System Gets MATE 1.14 Desktop Environment, New ISOs

Alexander Pyhalov from the OpenIndiana development team was happy to announce the availability of the latest MATE 1.14 open-source desktop environment for the Solaris-derived operating system. Read more

Canonical Announces Snapcraft 2.15 for Ubuntu 16.04 LTS with Many New Features

We reported earlier on the release of the major Mir 0.24.0 display server for the Ubuntu Linux operating system, and now we would like to inform you about the latest Snapcraft 2.15 tool for packaging apps in the Snap universal binary format. Read more

KDevelop 5.0.0 release

Almost two years after the release of KDevelop 4.7, we are happy to announce the immediate availability of KDevelop 5.0. KDevelop is an integrated development environment focusing on support of the C++, Python, PHP and JavaScript/QML programming languages. Many important changes and refactorings were done for version 5.0, ensuring that KDevelop remains maintainable and easy to extend and improve over the next years. Highlights include much improved new C/C++ language support, as well as polishing for Python, PHP and QML/JS. Read more