IBU

Consol

From gnupg-users-bounces@@@gnupg.org Fri Jul 26 17:05:07 2013
Message-Id: <201307261457.r6QEvhh1029861@@@fire.js.berklix.net>
To: "Mark H. Wood" <mwood@@@IUPUI.Edu>
Subject: Re: Why trust gpg4win? 
From: "Julian H. Stacey" <jhs@@@berklix.com>
Organization: http://www.berklix.com BSD Unix Linux Consultancy, Munich Germany
User-agent: EXMH on FreeBSD http://www.berklix.com/free/
X-URL: http://www.berklix.com
In-reply-to: Your message "Fri, 26 Jul 2013 09:22:32 EDT."
 <20130726132232.GA2414@@@IUPUI.Edu> 
Date: Fri, 26 Jul 2013 16:57:43 +0200
Cc: gnupg-users@@@gnupg.org
X-BeenThere: gnupg-users@@@gnupg.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Help and discussion among users of GnuPG <gnupg-users.gnupg.org>
List-Archive: <pipermail/>
List-Post: <mailto:gnupg-users@@@gnupg.org>
List-Help: <mailto:gnupg-users-request@@@gnupg.org?subject=help>
List-Subscribe: <http://lists.gnupg.org/mailman/listinfo/gnupg-users>,
 <mailto:gnupg-users-request@@@gnupg.org?subject=subscribe>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: gnupg-users-bounces@@@gnupg.org
Sender: "Gnupg-users" <gnupg-users-bounces@@@gnupg.org>

"Mark H. Wood" wrote:
> On Fri, Jul 26, 2013 at 12:14:08AM +0200, Julian H. Stacey wrote:
> > Hi, Reference:
> > > From:     atair <atair04@@@googlemail.com>=20
> > > Date:     Thu, 25 Jul 2013 21:17:43 +0000=20
> >=20
> > atair wrote:
> > ...
> > Therefore, changes that look like
> > back doors are VERY unlikely to find their way in a release, because
> > hundreds of people are looking how the software evolves and will
> > reject such a patch.
> > ...
> >=20
> > Yes, malign code would have to hide in plain view in source (& most
> > likely evil patches wouldn't get past the view of the people commiting
> > the `improvement' to the source repository ;-).
> >=20
> > However you missed the point that many MS users are not programmers,
> > & will not be compiling their own binaries, so any malign entity
> > could regularly hack their nasty extras in, compile & issue binaries
> > that dont match published source (sure that would breach licence,
> > but irrelevant to an evil doer), & those without access to exactly
> > the same set of compiler tools would not easily knowof embedded
> > evil extra mods.
> 
> But it takes only one person who can and does do this inspection, to
> reveal the evil deed.  

Not likely to happen regularly, per release, Analysing MS binaries.

I've no longer any idea how many different C compilers may currently be
available for MS, (I long ago gave up compiling for MS PCs :-)

I've never seen any net site that offers .exes to run on MS
that states exactly which compiler assembler linker etc was used &
in which order modules & libs were linked etc.

Knowing MS, they probably slip a mickey in as a tracer, & vary the generated
.exe according to which compiler (if theirs) licence number built it. 

One can't assume whoever offers a .exe has used a the same free GCC
compiler for MS aka http://www.cygwin.org that we might by default
reach for.

It would be hard Work, comparing & analysing different _binaries_
not _sources_ to differentiate benign irrelevant differences from
link order & tools used, & maybe date stamp & trace of compiler
host & licence number, as opposed to possible differences from to
malign source manipulation,

I wouldn't waste time working unpaid analysing MS binaries to protect
clueless MS end users.  More fun to develop source code for projects.
I assume the vast majority would see it the same, most would only
get interested if someone waved money at us to analyse binaries for
MS end users.

The same BSI https://www.bsi.bund.de/EN/Home/home_node.html that a
previous writer would prefer to distrust, I'd also consider perhaps as
a sponsor to pay independent consultants to analyse &/or generate
binaries for public use ... & not just for GPG.

Then the question: If government paid someone to do that, how could
we (the end user, this list, or the paying sponsor) trust that
person ?  The old Roman
    https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%3F

Solution:
  Get a collection of companies & governments or EU etc to sponsor
  generating of binaries on a custom compiler host where all parts
  of entire OS are read-able under http:// & ftp:// & where that
  host also offers a copy of itself so people can download a
  checksum'ed copy of image of host so people can run a clone & see
  the checksums are same.

  Could be fun work !
  ( It's fascinating how such projects start & grow & funded, at a lecture
  2 days back to 300 in Munich on 24th July 
     https://gnunet.org/tor2013tum
  2 Americans from
    https://www.torproject.org 
  mentioned some of their users include US government, which was
  why when one arm of US government proposed blocking them, they got
  told by another arm of US government: Don't do that, we use them too!
  Some of torproject sponsors are arms of government
    https://www.torproject.org/about/sponsors.html.en 
  So similarly, best not assume BSI is bad, or good, it might be a mix,
  not that I know.

Cheers,
Julian
- -- 
Julian H. Stacey, BSD Unix Linux C Sys Eng Consultant, Munich http://www.berklix.com
 Reply below not above, like a play script.  Indent old text with "> ".
 Send plain text.  No quoted-printable, HTML, base64, multipart/alternative.

_______________________________________________
Gnupg-users mailing list
Gnupg-users@@@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users


------- End of Forwarded Message