Re: Ken Thompson's UNIX backdoor

2004-04-15 Thread Diego Iastrubni
ביום חמישי, 15 באפריל 2004, 00:28, נכתב על ידי Shachar Shemesh: > not being exactly anything else. Closest I can offer is that it's > pronounced like the "ch" in "Technology". שה'קר well i still pronounce "ch" as in sandwitch, as Spanish grammer tells me to :) -- diego, kde-il translation te

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Shachar Shemesh
Diego Iastrubni wrote: ביום רביעי, 14 באפריל 2004, 12:38, נכתב על ידי Gilad Ben-Yossef: On Wednesday 14 April 2004 12:18, Diego Iastrubni wrote: you said it yourself, you cannot fully trust something you did not write yourelf 100% (HW+compiler). Actually, even trusting yourself is n

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Diego Iastrubni
ביום רביעי, 14 באפריל 2004, 12:38, נכתב על ידי Gilad Ben-Yossef: > On Wednesday 14 April 2004 12:18, Diego Iastrubni wrote: > > you said it yourself, you cannot fully trust something you did not write > > yourelf 100% (HW+compiler). > > Actually, even trusting yourself is not good enough - how do y

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread linux-il
Shlomi Fish wrote: Just a small amount of trivia, induced by what was probably a simple typo. And a bit in-accurate. Nice try to compress it all into 4 paragprahs, but people should better read the refference you give before they relay on it. (what made me jump was that I explictly remember writin

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Jonathan Ben Avraham
On Wed, 14 Apr 2004, Shlomi Fish wrote: > On Wednesday 14 April 2004 12:51, Jonathan Ben Avraham wrote: > > On Wed, 14 Apr 2004 [EMAIL PROTECTED] wrote: [snip] > > > The original speaker was trying to bash Linux/FOSS by saying that > > > you can't trust the code put into it. [snip] > > I suspect t

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Shlomi Fish
On Wednesday 14 April 2004 12:51, Jonathan Ben Avraham wrote: > On Wed, 14 Apr 2004 [EMAIL PROTECTED] wrote: > > Tzafrir Cohen wrote: > > > There are other parts of hardware. For instance: assume that the disc > > > controller has some idle time. Make it search for a pattern of the > > > login bina

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Geoffrey S. Mendelson
Jonathan Ben Avraham wrote: > I suspect that the story is based on a short-lived Unix version, and that > when Ken Thompson "admitted" this after fourteen years, the affected code > was probably not in use for 13 years except on some legacy PDP 10 machines > at Bell labs. It also assumes that no

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Jonathan Ben Avraham
On Wed, 14 Apr 2004 [EMAIL PROTECTED] wrote: > Tzafrir Cohen wrote: > > There are other parts of hardware. For instance: assume that the disc > > controller has some idle time. Make it search for a pattern of the login > > binary of a certain distro and change it a bit. > > > > Filesystem reading

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread linux-il
Diego Iastrubni wrote: old... read also this: http://www.acm.org/classics/sep95/ ביום רביעי, 14 באפריל 2004, 08:52, נכתב על ידי Yedidyah Bar-David: Not that I undermine Thompson's point - it's a well-written article that I recommend to anyone. But this has nothing to do with FOSS or not FOSS. yo

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Gilad Ben-Yossef
On Wednesday 14 April 2004 12:18, Diego Iastrubni wrote: > you said it yourself, you cannot fully trust something you did not write > yourelf 100% (HW+compiler). Actually, even trusting yourself is not good enough - how do you know the Men In Black(TM) did not hypnotically plant an unconscious c

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread linux-il
Tzafrir Cohen wrote: There are other parts of hardware. For instance: assume that the disc controller has some idle time. Make it search for a pattern of the login binary of a certain distro and change it a bit. Filesystem reading code is not very large: try grub. Some disk controllers can be upda

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Diego Iastrubni
old... read also this: http://www.acm.org/classics/sep95/ ביום רביעי, 14 באפריל 2004, 08:52, נכתב על ידי Yedidyah Bar-David: > Not that I undermine Thompson's point - it's a well-written article that > I recommend to anyone. But this has nothing to do with FOSS or not FOSS. you said it yourself,

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Alon Altman
On Wed, 14 Apr 2004 [EMAIL PROTECTED] wrote: > http://www.computerworld.com.au/index.php?id=1224882570&eid=-219: > > In a speech intended to serve us a wake-up call to anyone relying on the > "many eyes" that look at the Linux source code to quickly find any > subversions, the CEO of Green Hills S

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Tzafrir Cohen
On Wed, Apr 14, 2004 at 10:26:55AM +0300, Shachar Shemesh wrote: > Yedidyah Bar-David wrote: > 2. Compile GCC on a Sun Solaris using the Forte compiler. Take the > resulting binary, and use it to cross compile GCC for Linux. To be > insecure you now require that Forte have the backdoor to GCC 3.3

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Yedidyah Bar-David
While I basically agree with your analysis, in particular to the conclusion part, and while I did not seriously intend to make people start making their own CPUs, I do not completely agree with some details. I do not believe gcc was ever bootstrapped. I am pretty much sure it was cross-compiled, pr

Re: Ken Thompson's UNIX backdoor

2004-04-14 Thread Shachar Shemesh
Yedidyah Bar-David wrote: The only way to have a really secure system is to make it *all* by yourself - the CPU, the rest of the hardware, the assembler, compiler, and the rest of the software. Sure, sure. The thing is, what happens if you want to make 100% - 10E-15 secure (14 nines)? What if you

Re: Ken Thompson's UNIX backdoor

2004-04-13 Thread Yedidyah Bar-David
On Wed, Apr 14, 2004 at 08:18:24AM +0300, [EMAIL PROTECTED] wrote: > http://www.computerworld.com.au/index.php?id=1224882570&eid=-219: > > In a speech intended to serve us a wake-up call to anyone relying on the > "many eyes" that look at the Linux source code to quickly find any > subversions,

Ken Thompson's UNIX backdoor

2004-04-13 Thread linux-il
http://www.computerworld.com.au/index.php?id=1224882570&eid=-219: In a speech intended to serve us a wake-up call to anyone relying on the "many eyes" that look at the Linux source code to quickly find any subversions, the CEO of Green Hills Software Inc. last week reminded his audience how Uni