lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20030821230914.GA13305@pit.databus.com>
From: barney at databus.com (Barney Wolff)
Subject: Re: Popular Net anonymity service back-doored

On Thu, Aug 21, 2003 at 02:41:33PM -0700, Aron Nimzovitch wrote:
> 
> Only a fool would blindly depend on someone else's software to gain
> anonymity without examining the code.  If you need anonymity, then you
> should easily be willing to invest sweat equity, or have a contractual
> arrangement when the threat is only financial.  For more serious
> threats requiring anonymity, not reviewing the source when it is
> available seems beyond stupid.  I could unserstand your ire if you
> were one of our clients, but this was a free service wasn't it?

Examination of the code is all very well, but what assurance did you
ever have that the source code released was identical to what was
actually running on the server?  Or that their compiler or libraries
hadn't been trojaned?

-- 
Barney Wolff         http://www.databus.com/bwresume.pdf
I'm available by contract or FT, in the NYC metro area or via the 'Net.


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ