full-disclosure - Re: Allegations regarding OpenBSD IPSEC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 17 Dec 2010 13:14:15 -0500
From: Gary Baribault <gary@...ibault.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Allegations regarding OpenBSD IPSEC

I'm an information system's architect, and I do just that, I build the
plan for a system. I select technology and get the overall plan done.
I then hand off the plan to someone who does the design. That person
takes my plan and working with some help from me, gets more physical,
how much bandwidth, memory, CPUs, storage, what DB, specifically how
many modules, what the modules do, what other modules they communicate
with. The designer then hands of his/her design to the programmers.
He/She supervises, and helps with the test cases, but generally does
not see the code. The Architect very rarely sees the code. Check the
lead programmers, and in the case of VPN/IPSec programmers, they are
probably going to be very good programmers with a ton of experience.
Easily capable of this type of thing, but on the other hand, well
knows with a reputation to protect. I'm not saying if this was done or
not, it could be, but probably wasn't.

What you can be sure of is that the actual doing was done much closer
to the programmer than the Architect.

Gary B

On 12/17/2010 12:52 PM, Paul Schmehl wrote:
> --On December 17, 2010 12:31:37 PM -0500 Larry Seltzer
> <larry@...ryseltzer.com> wrote:
>
>>> The one thing Mr. Perry has not done, and which, if his claims have any
>>> merit at all, he could easily do, since he claims he's no longer under
>> NDA,
>>> is post the code that proves that there is a backdoor. After all, he
>>> supposedly wrote it, along with others.
>>
>> Actually, he did not say that he wrote code. He said that "Jason
>> Wright and several other developers were responsible for those
>> backdoors"
>>
>
> I quote Mr. Perry:
>
> "I left NETSEC in 2000 to start another venture, I had
> some fairly significant concerns with many aspects of these projects,
> and I was the lead architect for the site-to-site VPN project
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> developed for Executive Office for United States Attorneys, which was
> a statically keyed VPN system used at 235+ US Attorney locations and
> which later proved to have been backdoored by the FBI so that they
> could recover (potentially) grand jury information from various US
> Attorney sites across the United States and abroad."
>
> Still think he never wrote any and had no knowledge of the code? What does
> "lead architect" mean?
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/