Tag: tech

OpenBSD IPSec backdoor allegations: triple $100 bounty

In case you hadn’t heard: Gregory Perry alleges that the FBI paid OpenBSD contributors to insert backdoors into OpenBSD’s IPSec stack, with his (Perry’s) knowledge and collaboration.

If that were true, it would also be a concern for FreeBSD, since some of our IPSec code comes from OpenBSD.

I’m having a hard time swallowing this story, though. In fact, I think it’s preposterous. Rather than go into further detail, I’ll refer you to Jason Dixon’s summary, which links to other opinions, and add only one additional objection: if this were true, there would be no “recently expired NDA”; it would be a matter of national security.

I’ll put my money where my mouth is, and post a triple bounty: Continue reading “OpenBSD IPSec backdoor allegations: triple $100 bounty”

chkdsk considered harmful

This list of sysadmin horror stories reminded me of a story of my own:

A long, long time ago, possibly as much as fifteen years ago, I wrote a boot loader of which I’m still quite proud, even though I’ve long since lost the code. I also wrote an installer for it, naturally. The binary was very small (a few kilobytes), even though it included a command-line interface, a partitioning tool, a screen saver and a game, so instead of installing it in a separate partition, I simply installed it in the space between the MBR and the first partition, which on a DOS system in those days was on the order of 30 kB for completely idiotic reasons.

At some point during the development, inevitably, either due to a bug in the installer or incorrect command-line parameters, I managed to install the loader on top of the FAT on one of my DOS partitions. Continue reading “chkdsk considered harmful”

Haystack II

According to this story in Fast Company, it seems Iranian authorities were well aware of Haystack and exploited its numerous flaws to monitor the (alleged) dissidents who had swallowed Heap’s snake oil.

I told you so.

The author of the piece, Niel Ungerleider, asks: “Can someone make a Haystack that works?” My answer remains unchanged: an unconditional, resounding “no”. Haystack is profoundly, fundamentally, conceptually flawed, because of a little thing called traffic analysis. In the words of Jacob Appelbaum, quoted in the Fast Company piece: Haystack “effectively alerts authorities that you are trying to use it.”