News for hackers. Stuff that matters.
Re:Swiss report reveals new details on CIA spying operation by upofadown on Wednesday November 11, 2020 @01:02PM (#25060888)
The difference is that the operation of the Crypto AG machines was secret. Only the employees of the company had access. The operation of some contemporary systems is available to the whole world in the form of source code. In some cases multiple entities with no particular connection actually work on that source code. The trick is in insuring that the source code is the only thing that contributed to the program you are running.

As a fairly extreme example, consider what it would take to backdoor GnuPG. It is distributed to multiple platforms/OSes, most of which allow anyone to check both the signatures on the source code and then recreate the binaries.

Re:Swiss report reveals new details on CIA spying operation by TheSpiceIsLife on Wednesday November 11, 2020 @02:18PM (#25061798)
If you use GnuPG on a system with any unverified-build and audited for security compliance software / hardware, can you be certain GnuPG is behaving as expected?
Re:Swiss report reveals new details on CIA spying operation by dane-pgp on Wednesday November 11, 2020 @05:26PM (#25063752)
For what it's worth, Debian's gnupg2 package builds reproducibly[0]. That doesn't mean that the Debian-specific patches[1] have necessarily been widely audited though, even if the upstream code itself has enough eyes on it.

Also it's not exactly clear how an end user would discover that the Debian package they installed had a different checksum from the version that was reproducibly built, or if sufficiently independent teams are re-creating these checksums and have a way of notifying people of discrepancies.

[0] https://tests.reproducible-builds.org/debian/rb-pkg/unstable...

[1] https://sources.debian.org/src/gnupg2/2.2.20-1/debian/patche...

Re:Swiss report reveals new details on CIA spying operation by upofadown on Wednesday November 11, 2020 @05:00PM (#25063531)
You don't need the other software on a system to be audited for security compliance. You just need to know that it is not actively malicious. So any run of the mill Linux or BSD not running proprietary software.