I don't think Walmart's new logo is as bad as YAHOO's one. I blame Marissa Mayer.

Well, open-source is about sharing, but then again, I too always scoffed at Canonical's branding as sterile mumbo-jumbo.

Yeah, I prefer logos that don't really have a meaning or can have, like, a few million of them.

That's a copy of this.

Not of this?

.

That's just total nonsense. "Open-source" isn't about any one thing (you picked security) any more than the academic community of atomic physicists isn't solely about exploding atom bombs on civilians.

You mean to tell me that Richard Stallman started project GNU in order to help the government break into people's computers? What the hell are you talking about here?

Reid's philosophy seems to be to treat the world with pure cynicism.

.

.

Okay--interesting and disturbing, but it doesn't damn the idea of sharing source code per se, which was Stallman's ideology when he started GNU in 1983. The hacker ethos of sharing code goes further back still, which Stallman probably absorbed while at the MIT media lab.

I have no idea about Ubuntu. I never bothered to see who developed it and why, since it feels like a decroded piece of crap.

.

.

I'm not disagreeing with any of that. The open source community needs to be vigilant about rogue contributors with dubious motives, and the most seasoned open source hackers in the crypto community must be painfully aware of what a cluster**** the general security situation is.

But, for Christ's sake, we were talking about a logo that simply embodied what Richard Stallman had previously stated with words (his "four freedoms"). No conspiracies here, just branding. Okay?

Are you saying that the Linux kernel is controlled by Redhat? I don't think that any one company can control kernel development. Last I checked, Linus Torvalds has the final say on everything that goes in.

.

.

Did you read the article you linked to? Here are some excerpts:







You introduced the word dictator to this thread to say that Linus isn't the Linux dictator. Yet Linus Torvalds is one of a handful of open source project leaders that the phrase "Benevolent dictator for life" brings to mind, and is even listed as one on the Wikipedia article for the phrase.

I am willing to concede that your point doesn't necessarily depend on these things, but your post seems a tad ironic in light of these facts!

Perhaps the flavor of dictator you had in mind was one who "rules with an iron fist" instead of with benevolence.

.

Well that's certainly true. Even the president of the United States has appease those who wield "soft" power over him. It's certainly possible for the dictator to be forced to pick his/her battles in order to prevent those "underneath" said dictator from revolting.

In fact, I'm not sure if there has ever been a figure in history that approached having "god"-like, arbitrary power.

I work for a company which develops tools for software quality, a company which not only offers its services for free to open source developers but also unilaterally runs its own tools against many high-profile open source projects, and Debian packages in particular. This company also publicly pursues and promotes awareness of the sorts of bugs you're talking about, because the fact that we can find them and our competitors can't is a major selling point.

So bear that all in mind when I tell you that you're full of ****.

Closed-source software is universally worse than open-source. Most people who write closed-source software are five flavors of don't-give-a-**** between boredom and bad management, and that's before you consider the (I would have expected) even more obvious and direct means for a closed-source project to be sabotaged under a secret court order than to hide security flaws inside code anybody can read or even just run cppcheck against. All of this compounds against the fact that software development is an inherently difficult activity requiring utter perfection the first time around, which isn't something that human beings can deliver, and is the real reason that open-source software is buggy.

Let's look at a couple of recent open-source SSL bugs, since you seem to be interested in those sorts of bugs specifically.

Apple's open source SSL bug from back in February looked like this:


What does this mean? If the conditional branch isn't taken, it jumps to the fail label. If the conditional branch is taken, it jumps to the fail label. So any code following the conditional is skipped. Sure hope it isn't important! (Spoiler: it is).

Clearly a dastardly NSA plot, right? Except this sort of bug shows up all the time, thanks to distracted developers resolving merge conflicts under a time crunch. You want to know who's the real culprit here? Here are some clues for you: open concept offices where nobody can concentrate, poor code style guidelines, no institutional use of static analysis (which can detect that a huge chunk of code can no longer be entered), poor testing standards (since the tests covering the rest of the method should always fail after this change), and no measurement of test coverage (since you'd immediately notice that some of this code is no longer covered by tests). i.e. poor management and technical leadership company-wide.

Heartbleed is an out-of-bounds array access bug in OpenSSL. Clearly a dastardly NSA plot, right? Except this is the most common form of C/C++ security bug. It's practically guaranteed that any significant C codebase has at least one of these bugs, because C is among the worst possible languages for writing secure code and it's actually impossible to do without invoking at least some non-portable behavior. On top of the inherent difficulty of writing secure C, the developers of OpenSSL are frankly very poor engineers in a lot of ways. The internet has beaten them up a lot so I won't expound on this, but it's just not very surprising that they would accidentally introduce an error like this one.


And finally, be realistic here. The NSA isn't dropping security vulnerabilities in SSL. They don't need to. SSL is terrible and it doesn't work; the chain of trust is already controlled by American companies, users are trained to ignore all potential MITM attacks, and for the rare few people technically sophisticated enough to self-sign they will just threaten and shoot and subpoena until they control the endpoint, which statistically speaking is in a Five Eyes nation anyway. And even if your conspiracy isn't bull****, now that Raytheon employees carry burner laptops there are an awful lot of folks in the world who'd love to crack their VPN, and lil hint: none of those folks work for the NSA.

Educated stupid?

I now want to play the Stanley Parable (Mentat's non-Ubuntu-NSA-conspiracy desktop--thanks, Google-NSA-conspiracy reverse image search).

(In NSA-America, Google images searches you?)

Pardon me for interrupting Jon`C's effort-post.

+1 post #62

.

.

.

Reid, scrutiny is important, especially in a post-Snowden world, so you're probably right on many specifics.
Aside from that, though, your perspective on software publishing is just plain :tinfoil:, and is oddly hostile to open-source, which makes me wonder how much time you've really spent using and understanding open source software.



Community driven scholarship predates and includes as a subset open source development, and should not be treated with any skepticism, per se. I can't think of many technological advances since the days of sputnik and project ARPA (especially related to computing) in which the state-of-the art didn't initially emerge from a university, government agency, or in a corporate R&D lab that took a very long view, like Bell Labs.

It would be a terrible shame if you were to conflate the idea of sharing research with this straw-man of yours: specifically, that because the conventional wisdom is that open-source software is more secure than the proprietary, closed-source alternative, that somehow too many people (in your opinion) are therefore complacent in scrutinizing the security of their systems, ostensibly due to some misplaced "appeal to some greater sense of community and higher human values". Whereas, I see those "higher human values" as both genuine and innocent, while having little if anything to do with the realm of security, and at the same time being incredibly important to advancing academic scholarship in a public way. In other words, you've foolishly allowed your conspiracy theory implicate academia, which is a sacred cow of mine. If you tone down the paranoid rhetoric a bit, you're less likely to overstep the domain of what you know and say something stupid.

Also, I don't know what kind of global software utopia you have in mind, but I fail to see how refraining from relying on publicly published source code could change that.

BTW, nothing in my post exonerates the activities of the NSA. I just don't see the connection between open source ideology and your conspiracy theory.

I mean, you're basically calling open source advocates the 21st century version of the "useful idiot", but with the NSA replacing the USSR.

.

.

.

I still fail to see the connection between open source and NSA backdoors. Do you think closed source software is better in this aspect?

I'm guessing the Ubuntu log was intended to reflect the positive aspects of the Ubuntu project, which directly result from the values of open source, and have a direct impact on users (e.g., a free product, excellent customization, a supportive community, and a platform for compiling code should you so desire), which must have been possible because the people who designed it weren't cynical ****s that only see the negatives in anything.

Edit: Just to clarify, I meant "must have been possible (to design the logo without cognitive dissonance) because...".

Mark Shuttleworth started Ubuntu as a philanthropic venture. What a cynical guy! Don't buy into it, it's a trick.

Edit: Nevermind, it looks like I made that up.

.

What should he have done instead? Designed an operating system from scratch? Developed closed-source versions of all crypto libraries (I'm sure that'd go over well with the community!)? Placed a big red disclaimer on the Ubuntu website telling users that it is not secure?

.