Language Selection

English French German Italian Portuguese Spanish

Software flaws don't negate "many eyes" in open source

Filed under
OSS
Security

The allegations from Greg Perry regarding backdoors allegedly placed within OpenBSD about a decade ago seem to be shifting more and more into the realm of fantasy as each day goes by.

To date, Perry has not responded to my inquiry regarding his Dec. 11 e-mail to OpenBSD founder Theo de Raadt, nor to my knowledge has he responded publicly anywhere else. Meanwhile, the two (or three, depending on how you count it) people named in Perry's message to de Raadt as parties to this supposed backdoor activity, Scott Lowe and Jason Wright, have denied their involvement--the latter within the same [openbsd-tech] thread that started all this.

Since no one has heard any more from Perry, I will decline to speculate why he made these accusations, except to note that sometimes silence can speak volumes, and this may indeed be one of those instances.

While the accusations fly, de Raadt has indicated at least to one media outlet that an audit of this part of the OpenBSD code has found some bugs.

"We've been auditing since the mail came in! We have already found two bugs in our cryptographic code. We are assessing the impact. We are also assessing the 'archeological' [sic] aspects of this," de Raadt told iTWire.

It is not clear whether these bugs would allow the insertion of a backdoor or sideways entry-point into an OpenBSD system, nor if, based on de Raadt's statements to iTWire's Sam Varghese, these are the only bugs in this part of OpenBSD.

My colleague Glyn Moody tapped on any possible existence of such bugs in OpenBSD--planted or not--as a fundamental problem with one of the core tenets of free and open source software (FLOSS) development:

rest here




More in Tux Machines

ownCloud Desktop Client 2.2.4 Released with Updated Dolphin Plugin, Bug Fixes

ownCloud is still alive and kicking, and they've recently released a new maintenance update of the ownCloud Desktop Client, version 2.2.4, bringing some much-needed improvements and patching various annoying issues. Read more

Early Benchmarks Of The Linux 4.9 DRM-Next Radeon/AMDGPU Drivers

While Linux 4.9 will not officially open for development until next week, the DRM-Next code is ready to roll with all major feature work having been committed by the different open-source Direct Rendering Manager drivers. In this article is some preliminary testing of this DRM-Next code as of 29 September when testing various AMD GPUs with the Radeon and AMDGPU DRM drivers. Linux 4.9 does bring compile-time-offered experimental support for the AMD Southern Islands GCN 1.0 hardware on AMDGPU, but that isn't the focus of this article. A follow-up comparison is being done with GCN 1.0/1.1 experimental support enabled to see the Radeon vs. AMDGPU performance difference on that hardware. For today's testing was a Radeon R7 370 to look at the Radeon DRM performance and for AMDGPU testing was the Radeon R9 285, R9 Fury, and RX 480. Benchmarks were done from the Linux 4.8 Git and Linux DRM-Next kernels as of 29 September. Read more

How to Effectively and Efficiently Edit Configuration Files in Linux

Every Linux administrator has to eventually (and manually) edit a configuration file. Whether you are setting up a web server, configuring a service to connect to a database, tweaking a bash script, or troubleshooting a network connection, you cannot avoid a dive deep into the heart of one or more configuration files. To some, the prospect of manually editing configuration files is akin to a nightmare. Wading through what seems like countless lines of options and comments can put you on the fast track for hair and sanity loss. Which, of course, isn’t true. In fact, most Linux administrators enjoy a good debugging or configuration challenge. Sifting through the minutiae of how a server or software functions is a great way to pass time. But this process doesn’t have to be an exercise in ineffective inefficiency. In fact, tools are available to you that go a very long way to make the editing of config files much, much easier. I’m going to introduce you to a few such tools, to ease some of the burden of your Linux admin duties. I’ll first discuss the command-line tools that are invaluable to the task of making configuration more efficient. Read more

Why Good Linux Sysadmins Use Markdown

The Markdown markup language is perfect for writing system administrator documentation: it is lightweight, versatile, and easy to learn, so you spend your time writing instead of fighting with formatting. The life of a Linux system administrator is complex and varied, and you know that documenting your work is a big time-saver. A documentation web server shared by you and your colleagues is a wonderful productivity tool. Most of us know simple HTML, and can whack up a web page as easily as writing plain text. But using Markdown is better. Read more