abusing your OS's reputation?
On 17/04/2022 19:26, Satvik Sinha wrote:
Hi,guys and Good Day! So in recent days ,it was observed that many open source contributors vandalised their or someone else's project's reputation to show agendas of Russia-Ukraine war, Some even vandalised their project to destroy system in Russia and Belarus (Node-ipc being
one of them) that affected many people and their trust on open-source software. So I wanted to ask How safe is Debian doing right now and how will you guys prevent contributors pushing such malicious code into your software and how will you detect a software getting vandalised to showed Anti-war agenda by abusing your OS's reputation?
If there are backdoors in Debian then they are harder to detect. Large intelligence agencies aim for plausible deniability. Look at the
infamous OpenSSL vulnerability[1]. After investing so much time
planting agents and backdoors in Debian, they will not want to blow
their cover by doing something so brash.
There has recently been evidence on Debian Community News about some
cases, for example:
Paul Tagliamonte and Sam Hartman and their Pentagon connections, with
photos
Jonathan Wiltshire and Chris Lamb having GCHQ proximity, with a map
There are approximately 1000 Debian Developers and when one of us makes
an upload, there is no obligation for somebody else to check it. On the other hand, there is a period of days or weeks before new uploads can propagate to stable systems. This may make it more robust if you only
use stable.
debian-project@lists.debian.org is now being censored to stop
discussions like this about Debian integrity.
Regards,
Daniel
1.
https://igurublog.wordpress.com/2014/04/08/julian-assange-debian-is-owned-by-the-nsa/
--
Debian Developer
https://danielpocock.com
i did the analysis (took 3 weeks)
i believe the answer is in the question. debian is based on distributedtrust. i did the analysis (took 3 weeks): it is literally the only distro
On 17/04/2022 19:26, Satvik Sinha wrote:
abusing your OS's reputation?
i believe the answer is in the question. debian is based on distributed trust. i did the analysis (took 3 weeks): it is literally the only distro
in the world with an inviolate chain of trust from a large keyring dating back 20 years that is itself GPG-signed as a package, with a package distribution chain from source where all components within the chain up to release are unbroken and inviolate.
take ubuntu for example: whilst it has the exact same technology the size
of the developer pool, comprising the web of trust, is both much smaller
and also controlled by one Corporation: Canonical. Canonical says "jump",
the developers ask "how high".
take Suse, Fedora etc: their RPM packages break the chain of trust by
failing to properly include a GPG Signature of the Release (i do not recall the exact details, i did the analysis 4 years ago)
take Archlinux: their community is vulnerable to unverified github repositories being abandoned, a hacker re-registering them, and a trojan uploaded and distributed automatically.
i won't even bother going into the absolute moronic practice of "trusting" HTTPS: node, pypi, etc should be blindingly obviously untrustworthy, with
the website being a prime hacking target if nothing else.
even GNU packages are hopelessly inadequately secure as far as social engineering and hacking are concerned.
debian is not a single centralised repository, it is controlled by no-one. you have to compromise hundreds of independent developers before you make
any headway, and as a result it was trusted by e.g. the Venezuelan
Government as the basis for their own distro, many years ago.
there is not even a centralised dependency on a website: packages may be securely distributed by Carrier Pigeon or printed out on paper and OCR scanned if you really want to because there is a full GPG Chain and Checksums, right back to the source code.
and that (GPG Chains) basically, is the key. anyone stupid enough to do something stupid is going to be throwing away their reputation, not just within the debian project as a maintainer, but for life.
you abuse your position as a maintainer by putting in trojan code, because that trojan package had to be GPG Signed, you have to make a *public and irreversible declaration* which will remain in historical archives for the rest of your life and beyond.
this would result in catastrophic consequences for not just their
involvement in debian (which would be terminated with prejudice), but
because their GPG Signature on the trojan package is public, inviolate and irrevocable, it would also have catastrophic consequences for their career
in IT because nobody would ever trust them in a position of responsibility, ever again. they'd be flipping burgers for the rest of their life.
fundamentally, then, you are assuming that there is "one controller of debian", which is false. there are literally hundreds of *independent* developers, all of whom know their responsibility, all of whom know that
they have all other independent developers keeping an eye on them.
this makes debian pretty much the only distro that could be trusted to
remain true to humanity and to its principles and its charter. even when
some of them (you know who you are) are when it comes down to it not very nice people, they can at least be trusted to do the right thing.
l.
itself GPG-signed as a package, with a package distribution chain from source where all components within the chain up to release are unbroken and inviolate.i believe the answer is in the question. debian is based on distributed trust. i did the analysis (took 3 weeks): it is literally the only distro in the world with an inviolate chain of trust from a large keyring dating back 20 years that is
(there is no mechanism to tie a GPG key to an actual person or to find who actually did the signing)This is not an answer to the question though, OP was asking how we prevent abuse of that trust.
reputation, and potentially criminal and civil proceedings.
all identities are known, and inviolate-known [through the
above-described chain].
anyone stupid enough to abuse their position may only do so once, at which point their GPG key is revoked.(only after the abuse is found)
given that GPG key-signing parties require people's real-world identities(depends on your definition of "people's real-world identities")
to be known,
it is easy to track down who signed whose key (it's right(doubtful, considering how GPG key-signing parties actually work)
there in the keyring-archive], and request that the signer provide assistance to the relevant authorities in proving that real-world identity.
GPG-signed as a package, with a package distribution chain from source where all components within the chain up to release are unbroken and inviolate.i believe the answer is in the question. debian is based on distributed trust. i did the analysis (took 3 weeks): it is literally the only distro in the world with an inviolate chain of trust from a large keyring dating back 20 years that is itself
This is not an answer to the question though, OP was asking how we prevent abuse of that trust.
anyone stupid enough to abuse their position may only do so once, atwhich point their GPG key is revoked.
On Mon, May 23, 2022 at 6:28 PM Adam McKenna <adam@flounder.net> wrote:
distributed trust. i did the analysis (took 3 weeks): it is literally the only distro in the world with an inviolate chain of trust from a large keyring dating back 20 years that is itself GPG-signed as a package, with a package distribution chain from source where all components within thei believe the answer is in the question. debian is based on
chain up to release are unbroken and inviolate.
This is not an answer to the question though, OP was asking how weprevent abuse of that trust.
reputation, and potentially criminal and civil proceedings.
all identities are known, and inviolate-known [through the
above-described chain].
anyone stupid enough to abuse their position may only do so once, at which point their GPG key is revoked.
given that GPG key-signing parties require people's real-world identities
to be known, it is easy to track down who signed whose key (it's right
there in the keyring-archive], and request that the signer provide
assistance
to the relevant authorities in proving that real-world identity.
this will sufficiently piss off those people that trusted them that they
will
be unlikely to work with them ever again [reputation]
in addition there is the Debian Trademark which if brought into disrepute through abuse could be utilised to seek damages against the perpetrator.
bottom line is that it would be a spectacularly stupid thing to do to
violate
the trust and responsibility of being a Debian Maintainer, and the really interesting bit to me is that this all works in an entirely distributed manner
and can all entirely be done entirely without a single centralised
authority,
i.e. *not* having to trust f*****g google or f*****g github with anyone's real-world identity in any way shape or form.
l.
they get one and only one chance to do something that stupid.
the response is swift: there was a debian developer wrongfully arrestedfor running a TOR exit node. their key was revoked immediately.
On Mon, May 23, 2022 at 7:59 PM Adam McKenna <adam@flounder.net> wrote:
You are talking about a deterrent though. I think the question is,
what if someone cares more about their political cause than
retaining their uploader access?
they get one and only one chance to do something that stupid.
What if someone's keys are compromised
the response is swift: there was a debian developer wrongfully
arrested for running a TOR exit node. their key was revoked
immediately.
l.
You are talking about a deterrent though. I think the question is,
what if someone cares more about their political cause than
retaining their uploader access?
What if someone's keys are compromised
Sysop: | Keyop |
---|---|
Location: | Huddersfield, West Yorkshire, UK |
Users: | 300 |
Nodes: | 16 (2 / 14) |
Uptime: | 24:55:04 |
Calls: | 6,707 |
Calls today: | 1 |
Files: | 12,239 |
Messages: | 5,352,379 |