<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on What can the OpenBSD IPsec backdoor allegations teach us? ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/102-339443/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-05-19T03:25:52-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA[nope]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3418376]]></link>
        <description><![CDATA[It was FreeBSD.  I wrote an article about it for TR: China chooses FreeBSD as basis for secure OS]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3418376]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Sun, 13 Feb 2011 00:20:39 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Or...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3418346]]></link>
        <description><![CDATA[just a silly way to bring attention to alois.cohard web-links?I like your avatar! Wonder why! P.S. (edited) - wasn't OpenBSD that OSS the Chinese government adopted as it's sanctioned public operating system? Seems to me this could just be FUD generated by our side, to throw them off guard. Not that it would be particularly funny, because I don't trust my government much more than theirs; unfortunately.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3418346]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sat, 12 Feb 2011 21:04:37 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[it's possible]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3406922]]></link>
        <description><![CDATA[Yes, your solution (or something like it, perhaps, in case the inserted code is not actually  identical in each case) is possibly effective.  First, though, you have to know what you're trying to find, and that may not be an easy discovery.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3406922]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Mon, 10 Jan 2011 12:17:42 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[A late response to a very scary answer...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3406566]]></link>
        <description><![CDATA[If it inserts the same everywhere, would it not be possible to digest the binaries by checking the compiled binaries of different source codes; looking for identical blobs of a certain length?I realize that would take some number crushing... and of course, if there are a lot of inserts that belong there, on account of the properties of the compiler, otherwise - it'd be some doing to go through it all...EDIT:+late]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3406566]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Mon, 10 Jan 2011 00:35:28 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[I understand that about source...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3403642]]></link>
        <description><![CDATA[I was just musing on directional camouflage, and how to foil it. Thinking of, how to look at something differently to have the unexpected stand out. I guess the first option you mentioned would be the closest, of course, I have no idea if it'd make finding bad things easier...Maybe what's needed is simply a &quot;code insert detection 101&quot; course... after all, seeing lots of examples of real back doors would let a code inquisitor construct an intuition for them.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3403642]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Thu, 30 Dec 2010 22:33:56 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Actually . . .]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3403628]]></link>
        <description><![CDATA[Pretty much the best you could do, at this point, is one of three things:1. something like rdoc, which gives you an organized listing of methods and modules, and provides auto-formatting of documentation from comments2. something that produces a very verbose, point-by-point explanation of what every token in your source code does, providing a word-count that's probably two orders of magnitude greater than the token-count of your code, and doesn't really help anyone better understand what the code is doing3. learn to read source codeWhat you describe is, in fact, basically what source code  is: a higher-level, succinct, understandable representation of the less human-readable machine language.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3403628]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Thu, 30 Dec 2010 20:23:51 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[So... lowering the gain...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402784]]></link>
        <description><![CDATA[no way to reorganize instructions into a more obvious format?Like the stealth of a F-117 Nighthawk works best if the radar receiver is close to the radar emittor, a reorganization of the instructions might help?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402784]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Mon, 27 Dec 2010 11:36:05 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Yeah, and I'd be real surprised]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402801]]></link>
        <description><![CDATA[If the IPs to which the data was sent were owned by fbi.gov or nsa.gov.  Those boys usually know how to cover their tracks pretty well.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402801]]></guid>
        <dc:creator><![CDATA[Sterling "chip" Camden]]></dc:creator>
        <pubDate>Mon, 27 Dec 2010 11:33:27 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[You're talking about a type of artificial intelligence]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402800]]></link>
        <description><![CDATA[... far beyond the capabilities of an  rdoc  or  lint.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402800]]></guid>
        <dc:creator><![CDATA[Sterling "chip" Camden]]></dc:creator>
        <pubDate>Mon, 27 Dec 2010 11:30:51 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[BTW... is there a way to make a code paraphraser...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402782]]></link>
        <description><![CDATA[It would be like an interpreter of sorts, reads instructions (code or binaries) and writes a documentation-style description of what it does.It'd have to follow the threads of instructions, so that instructions that connect are described together...Would it be possible to make such a program so that it could conceivably help check what a program does?It would be immensely useful for checking small apps for all sorts of platforms, so that could be used to fund it's development from being useful on a small scale (phone apps) to a very large scale (kernels)...]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402782]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Mon, 27 Dec 2010 11:18:45 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Take responsibility for your own words.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402779]]></link>
        <description><![CDATA[&gt;  Extrapolating this to the max and concluding that it is my believe that the entire OSS is unsecure or flowed, is just an undeserved exageration. It's what you  said   I will think twice before posting anything else in Techrepublic forums. Try thinking twice before posting anything  categorical here without first checking to see whether it's at all reasonable.  There's a big difference between, on one hand, equating 98% with 0%, and on the other hand, asking questions about whether it's actually 98%.  Reasonable questions will generally be treated as reasonable questions; categorical statements that are patently ridiculous, on the other hand, are more likely to be treated as if they are ridiculous.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402779]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Mon, 27 Dec 2010 10:58:47 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[That assumes]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402780]]></link>
        <description><![CDATA[that the Feds were using the BD frequently and for long spans of time.Having a tool like that, you don't use it for casual eavesdropping. You use it when it lets you achieve something very specific. The odds of finding it by way of its activity is proportional to the amount of activity.Even if everything goes to logs, finding evidence in the logs is tough, with the volume of traffic to consider.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402780]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Mon, 27 Dec 2010 10:54:49 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[yes]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402776]]></link>
        <description><![CDATA[It is indeed possible for a compiler to insert something malicious into every piece of software it compiles -- including new copies of the compiler.  If the source of the compiler changes sufficiently over time, it is possible this might eventually break down due to incompatibilities between the old compiler's malicious code insertion and the new compiler version's design, so that the propagation of the malicious code in future versions of the compiler would cease.  It is also possible that the malicious code inserted into compiled binaries might be discovered by a binary debugger, hex editor, or behavioral analysis of the resulting program.  Otherwise, though, there would be no sign of it in the source code (which, incidentally, is another point about how obscuring one's source code often does nothing at all for the security of the software; source is for fixing, not for finding, in general).]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402776]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Mon, 27 Dec 2010 10:49:47 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[How?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402775]]></link>
        <description><![CDATA[Are you asking whether someone would have noticed &quot;strange&quot; network traffic, analyzed it, and discovered that it is somehow related to the IPsec VPN?  It's possible that someone might have noticed it that way; it is also possible that nobody would have noticed it that way.  Hard to say.  There are too many variables involved.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402775]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Mon, 27 Dec 2010 10:43:01 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Thanks!]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402663]]></link>
        <description><![CDATA[Thanks for explaining.However I thought someone might have spotted it(not necessarily a sysadmin) when configuring or trying to improve performance maybe...]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402663]]></guid>
        <dc:creator><![CDATA[mira_pl]]></dc:creator>
        <pubDate>Mon, 27 Dec 2010 06:01:21 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Maybe]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402638]]></link>
        <description><![CDATA[if it's true.But sysadmins aren't by default going through the sourcecode, now are they? A backdoor is not &quot;findable&quot; in the function of the program, unless it's buggy. It's not an easter-egg type, where you can click somewhere on the GUI to bypass a password...]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402638]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Mon, 27 Dec 2010 04:14:55 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Can someone please care to explain]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402594]]></link>
        <description><![CDATA[...how is it possible that so many users seem to have missed the existence of that backdoor? I can understand it's possible if you only use the system but what about sysadmins? Was it so well hidden?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402594]]></guid>
        <dc:creator><![CDATA[mira_pl]]></dc:creator>
        <pubDate>Mon, 27 Dec 2010 00:36:48 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Obviously they don't know if they have a valid reason]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402135]]></link>
        <description><![CDATA[unless they examine all the data.  Called &quot;FISHING.&quot; Hence they have to get it.Physical access too time-consuming and risky.  You are assuming they have someone in their sites.  This is normally not the case.  They have to process tons of information from innocents to find one guilty--like the needle in the haystack.  You tell me--How would YOU find him if you don't know where he is???And, of course, this must be done without chance of discovery, without risking  exposure (publicity might be created)and everything getting shut done.And since we are here on forum this venue may be used to steer everyone in the wrong direction.  Just to let you know...]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402135]]></guid>
        <dc:creator><![CDATA[dina04@...]]></dc:creator>
        <pubDate>Fri, 24 Dec 2010 04:57:30 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Unfortunately, one breach is all it takes.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402134]]></link>
        <description><![CDATA[I know--MS is constantly trying to plug its holes.  But this is different.  More simplicity--not less--can add transparency.  Beware the technospies trying to get your trade secrets...they can be coming from anywhere.  Of course our gov can access everything--who doesn't believe that after 911?  But are the rogues in cahoots???]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3402134]]></guid>
        <dc:creator><![CDATA[dina04@...]]></dc:creator>
        <pubDate>Fri, 24 Dec 2010 04:41:18 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[A hint Chad.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3401992]]></link>
        <description><![CDATA[&quot;Make your contribution such as it is required, at the stage at which it occurs, by the accepted purpose or direction of the talk exchange in which you are engaged.&quot;That was Grice.Grice has things to make you a better soldier for your cause. Specifically, you must get over your fixation with the bare words. We all use metatext. We all rely on the kindness of strangers - or rather, the effort of our audience to understand what we mean.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-339443-3401992]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Thu, 23 Dec 2010 12:07:43 -0800</pubDate>
    </item>
    </channel>
</rss>

