NSA operation ORCHESTRA: Annual Status Report

What Hacker News said

Strong rec ensmotko · 2014-04 · on “"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"”

Check out phk's fosdem talk[0]. I've linked to the the part where he talks about openSSL, but I'd suggest watching the whole thing. I'm now starting to believe the talk wasn't a joke at all... [0] [this video]

Strong rec TacticalCoder · 2014-04 · on “"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"”

There's a talk that was given in Belgium / Brussels at FOSDEM2014 two months ago or so by Poul-Henning Kamp (FreeBSD) regarding the NSA and how he'd do it if he had to create holes in software: [this video] He's talking specifically about OpenSSL quite a lot (basically saying it's too complex to ever be secure and probably received many "security patches" from NSA employees). The entire talk is an eye opener. He explains how NSA shills are reading reddit / HN and poisoning communities / standards / protocols / etc. How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things. He talks about shills submitting a few correct patches over the mo

Recommends higherpurpose · 2014-04 · on “Julian Assange: "Debian Is Owned By The NSA"”

Debian's 2006 PRNG anyone?! Maybe these are stupid dumb mistakes, but if I were NSA this is exactly how I'd implement backdoors. 2 lines of code cloned here (go to fail), 2 lines of code commented out there (Debian PRNG issue), and just like that you create huge vulnerabilities in the system. Hard to notice, and impossible to blame on anyone. Everytime they seem to be some brilliant "stupid mistakes". And as others have said, do listen to the FreeBSD developer's talk on NSA' ORCHESTRA operation (subverting open source projects): [this video]

Recommends notdonspaulding · 2014-04 · on “PHK: OpenSSL must die, for it will never get any better.”

Also worth watching is his FOSDEM talk where he was calling for this before news of Heartbleed broke. [this video]

Recommends romanovcode · 2014-04 · on “IBM, Microsoft, Facebook, Google, others pledge $3.6 million to fund OpenSSL”

OpenSSL source code is a disaster. It's spaghetti that doesn't do what you think it does with horrible documentation. People submit patches from people they don't even know and then you have it: An SSL library that is flawed but everyone is using it. An spying agency and hackers dream. We don't need OpenSSL, we need another library built from scratch with very clean code and documentation. Everyone who has more interest on why OpenSSL is a catastrophe should watch operation ORCHESTRA[0]. [0] [this video]

Recommends AlyssaRowan · 2014-10 · on “Making sure crypto remains insecure [pdf]”

Hmmm… and ElGamal's signing scheme didn't qualify? I don't think that's a reason, or even an excuse: Schnorr actually did claim his patent read on DSA. (That obviously never went anywhere, and the US Government, in a show of force via the NSA, filed their own patent on DSA.) The NSA also really doesn't seem to have had much of a problem negotiating the licensing of patents with industry participants in the past! It is, after all, in an extraordinarily strong bargaining position: an awful lot of public money to throw around (openly, via on-the-book government contracts, and otherwise); the backing of a 'superpower' government and its negotiators; a remarkably good idea of what the position of

Recommends hackermailman · 2018-04 · on “Ask HN: What is your favourite tech talk?”

This talk was an interesting thought experiment by PhK of FreeBSD on how if he were tasked by some agency to sabotage open source projects and standards how he would go about doing it [this video] A talk by Robert Harper at OPLSS in 2017 is really good as well, covering the basics of programming language background [LINK] "concrete syntax is where computer science meets psychology.... at the moment it's all a matter of opinion"

Recommends no_identd · 2018-09 · on “Microwave Weapons Are Suspect in Ills of U.S. Embassy Workers”

>I have this notion that surrounding a subject with basket case conspiracy theories would be a good way to get people not to take it seriously :) Indeed, it would. A lot of clever people have discussed the issue of disinfo & FUD, you might wish to: * Watch this talk from FOSDEM '14 by Poul-Henning Kamp [Contextually, one important tidbit to keep in mind while watching it: At the time phk gave the talk, the heartbleed vulnerability in OpenSSL wasn't yet known!]: [this video] * and, perhaps, read these two blog posts, but tread carefully with those two, as, unlike the above video, the below edges MOST dangerously close to basket case conspiracy theory territory - arguably, it doesn't get there, but