Re: Confirmed Cases Of Trapdoors By Overseas Programmers ?

From: Bernd Felsche (bernie@innovative.iinet.net.au)
Date: 07/15/02 

From: Bernd Felsche <bernie@innovative.iinet.net.au>
Date: Mon, 15 Jul 2002 10:45:02 +0800

alun@texis.com (Alun Jones) writes:

>In article <1103_1026582308@news.utu.fi>, Markus Jansson
><jansson_markus@ziplip.com> wrote:
>>Linux may have and has programming errors, bugs and security holes, even
>>remote ones. It is highly unlikely that it has a backdoor planted since anyone
>>could find it.

>You are assuming that anyone goes looking in depth.

>One of the great advantages of open source coding is that the
>source code is provided for anyone to analyse, debug, patch, etc.
>One of the great disadvantages of open source code is that almost
>nobody does analyse, debug, or patch it. Bugs in open source are

That's not a disadvantage of open source. It's a disadvantage to
*anything* that's been written.

>generally found by the same method as in closed source - someone
>runs the program, and gets output or side-effects they didn't
>expect. Security holes are often found in the same manner, because

No. Many bugs in open source software are found by code review.
See CERT announcements.

>it's easier to throw broken input at a program than it is to
>analyse the source code. Bugs and security flaws alike are
>reported to open source developers by users, who don't generally
>tend to suggest patches, because they are users, not developers.

Many users don't report bugs. More often than not, users will look
for a workaround. In closed-source software, any bug reporting that
does occur, even in supported environments, is frequently *filtered*
so that the bug description can be quite different to the one the
user sees.

>Many of the supposed benefits of open source don't really exist,
>because people do not take advantage of them in anything more than
>the rarest of cases. There are a few real benefits that don't

They don't exist because they're not usually exploited?

Why is that preferable to having closed sources where the
opportunity for independent code review doesn't even exist?

Do you want code review only by the authors of the code, or those
who share the same mind-set?

>I've yet to see any examples of security flaws found in open source
>programs through code analysis - I'm sure there are some examples,

Openssh is a recent one. 

-- 
/"\ Bernd Felsche - Innovative Reckoning, Perth, Western Australia
\ /  ASCII ribbon campaign | I'm a .signature virus!
 X   against HTML mail     | Copy me into your ~/.signature
/ \  and postings          | to help me spread!

Relevant Pages

  • Re: Open source software buggier than corporate
    ... Open source software products tend ... It seems to me there's usually been a Mozilla or Firefox revision ... open source software packages for every troublesome security ... of those bugs appear in the field. ...
    (alt.os.linux)
  • Re: DVI output, ATI or nVidia
    ... > Open source projects are full of long standing bugs which haven't been ... > get fixed faster unless you are the one who is capable of fixing it. ... In my experience just because you are paying for support doesn't ... There are many great reasons to use open source software, ...
    (Fedora)
  • Re: State Department Developing Cyber Toolkit
    ... >>Someone writing Open Source certainly doesn't make them an instant Guru. ... Although, in Real Life, it's a lot harder to see these bugs ... way to architecture (a merging of art and engineering); ... Instead, I submit the retrieved string, decode it *every damned time*, ...
    (alt.computer.security)
  • Re: Paying developers to get features faster
    ... > compile is atleast a lot better than a screen full of warning messages. ... > While that it may not prove the absence of bugs, ... > Rewarding programmers to clean up the code is a great way to create a ... the truth is that the Open Source developer will not ...
    (comp.os.linux.development.system)
  • Re: Paying developers to get features faster
    ... > compile is atleast a lot better than a screen full of warning messages. ... > While that it may not prove the absence of bugs, ... > Rewarding programmers to clean up the code is a great way to create a ... the truth is that the Open Source developer will not ...
    (comp.security.misc)
Quantcast