full-disclosure - Re: Allegations regarding OpenBSD IPSEC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 17 Dec 2010 19:51:43 +0100
From: news <news@...cean.net>
To: Gary Baribault <gary@...ibault.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Allegations regarding OpenBSD IPSEC

Has I said, that has may true for your organisations hould not be true
for others.

Each organisation has organised has it can. Has small entity may has the
architect design and put the concrete. Has big company most probably has
you said.

It depends. No one except NETSEC has knowing of NETSEC organization.
Anyhas, it has very probability Mr Perry is wright.

Le vendredi 17 décembre 2010 à 13:14 -0500, Gary Baribault a écrit :
> I'm an information system's architect, and I do just that, I build the
> plan for a system. I select technology and get the overall plan done.
> I then hand off the plan to someone who does the design. That person
> takes my plan and working with some help from me, gets more physical,
> how much bandwidth, memory, CPUs, storage, what DB, specifically how
> many modules, what the modules do, what other modules they communicate
> with. The designer then hands of his/her design to the programmers.
> He/She supervises, and helps with the test cases, but generally does
> not see the code. The Architect very rarely sees the code. Check the
> lead programmers, and in the case of VPN/IPSec programmers, they are
> probably going to be very good programmers with a ton of experience.
> Easily capable of this type of thing, but on the other hand, well
> knows with a reputation to protect. I'm not saying if this was done or
> not, it could be, but probably wasn't.
> 
> What you can be sure of is that the actual doing was done much closer
> to the programmer than the Architect.
> 
> Gary B
> 
> On 12/17/2010 12:52 PM, Paul Schmehl wrote:
> > --On December 17, 2010 12:31:37 PM -0500 Larry Seltzer 
> > <larry@...ryseltzer.com> wrote:
> >
> >>> The one thing Mr. Perry has not done, and which, if his claims
> have any
> >>> merit at all, he could easily do, since he claims he's no longer
> under
> >> NDA,
> >>> is post the code that proves that there is a backdoor. After all,
> he
> >>> supposedly wrote it, along with others.
> >>
> >> Actually, he did not say that he wrote code. He said that "Jason
> >> Wright and several other developers were responsible for those
> >> backdoors"
> >>
> >
> > I quote Mr. Perry:
> >
> > "I left NETSEC in 2000 to start another venture, I had
> > some fairly significant concerns with many aspects of these
> projects,
> > and I was the lead architect for the site-to-site VPN project
> > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > developed for Executive Office for United States Attorneys, which
> was
> > a statically keyed VPN system used at 235+ US Attorney locations and
> > which later proved to have been backdoored by the FBI so that they
> > could recover (potentially) grand jury information from various US
> > Attorney sites across the United States and abroad."
> >
> > Still think he never wrote any and had no knowledge of the code?
> What does 
> > "lead architect" mean?
> >
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/