I mean, it’s still Open Source, right? So it would be pretty hard for them to hide a backdoor or something??

Right but maybe it combined with other tools they have is what helps them with some exploit.
Like they figured out an exploit but needed SELinux as a piece of the puzzle. It's open source
and we can all read the code but we can't see the other pieces of the puzzle.

Come on, put your conspiracy hat on! ;)

I maintain open source software on a much smaller codebase that is less security critical. We have dozens of maintainers on a project with about 3k stars on GitHub. Stuff gets by that are potentially security vulnerabilities and we don’t know until upstream sources tell us there is a vulnerability

So it would be pretty hard for them to hide a backdoor or something??

It happens, though.

Ghidra was about hiring and cost savings. Its easier to hire when people already know your tools. Also people are more willing to use your tools rather than expensive ones if they can still use them when they leave (go into contracting). Also interoperability with contractors may improve.

We saw a very sophisticated attack on Linux earlier this year with the XZ exploit. That stuff is terrifying and the sort of thing people should be worried about. SELinux is tame, by comparison.

I haven't looked at the keyboard drivers, or much Linux source. I never really had a reason to do a lot of C other than small microcontroller projects.

But I see this stuff and think of how awesome it must have felt to get a different keyboard working on an OS the first time. I have to do all this stuff with cloud, and api levels, and configuring CI/CD pipelines, and sometimes I get to write backend C# code or they let me play in the front end. Most of the time it's telling another team of developers what to do, and listening to our clients explain the problems and I have to figure out if we already have anything to fulfill at least some of those needs.

These drivers are the divine marriage of hardware that's not native to the machine that an OS is running on. It's so beautiful to read. You can visualize where the values enter a memory address, and bits get shifted or something is static so the keyboard always uses the right thing.

The Linux community was pretty paranoid about the NSA in 2000, so the code definitely got a lot more scrutiny than the typical proposal.

It's not paranoia if it's true. Snowden showed us that they really are spying on all of us all the time

It is also important to note that it is pretty easy to do surveillance these days. People care around cell phones and there are massive camera systems that can track someone with high detail.

That's the trubble with the NSA. They want to spy on people, but they also need to protect American companies from foreign spies. When you use their stuff, it's hard to be sure which part of the NSA was involved, or if both were in some way.

GPLv2 only says that people with access to the binary need access to the source code too. If they only used it internally they'd never have to make it public.

Also it is no longer under the NSA. The original NSA branding was also removed due to concerns from the community.

If you have the entire code, not just some part, as most companies do when go Open Source (not free software), then you don't have to worry about unknown behavior because everything is in the source.

Hahaha, good joke

Same for the improvements they did on DES, and for open-sourcing Ghidra. Sometimes they are the good guys.

Signal is weird about actually allowing others to reproduce the APK builds.

Specifically, they are the kind of weird about it that one would expect if the Signal client app had an NSA back-door injected at build time.

This doesn't prove anything. It just stands next to anything and waggles it's eyebrows meaningfully.

You wouldn't phrase it like that. Android is based on Linux, and selinux is part of the Linux security subsystem. Android makes use of selinux features, among others, for security sandboxing.

Yes, android is actually a very secure system if you get rid of the vendor rom and google