full-disclosure - Re: OpenBSD Paradox

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 15 Dec 2010 15:43:04 -0500
From: musnt live <musntlive@...il.com>
To: Theo de Raadt <deraadt@....openbsd.org>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: OpenBSD Paradox

On Wed, Dec 15, 2010 at 3:22 PM, Theo de Raadt <deraadt@....openbsd.org> wrote:
>> We has OpenBSD tell us:
>>
>> "We have never allowed US citizens or foreign citizens working in the
>> US to hack on crypto code"
>> http://marc.info/?l=3Dopenbsd-tech&m=3D129237675106730&w=3D2
>
> That statement remains true.

> Our project permitted American developers to work on any part of the
> tree which was not specifically cryptography; in this particular
> instance that includes the parts of IPSEC which are 'dual use' or 'not
> related to cryptography'.  We did not permit them to work on the
> crypto-specific parts.
>

Military is clever at words and dual use for is example, dual use of technology.

So is your approach: "He is not backdoor crypto! Only the portion on
the network - so is your data sniffable"

In all wording from OpenBSD, there is not one denial: "IPSEC is not
backdoored" only word trickery:

"We is full disclosing someone say IPSEC is backdoor"
"We is full disclosing IPSEC is not worked on by Americans"
"We is receive strange email"
"We is have DARPA funding cut!"

Never have we see:

"OpenBSD is not backdoored"
"OpenBSD audited is this code in the past"
"OpenBSD is currently going back to is audit"

Furthermore is fact that is as developer, one developer can seek help
from another developer and this is developer who put backdoor:

CryptoDeveloper = I has no idea how is to make this work
RogueDeveloper = I is has this special piece of code is for you
CryptoDeveloper = Is thanks!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/