Theo de Raadt is one of the key hackers outside the mainstream GNU/Linux world. Here's his self-penned bio: I am the founder of OpenBSD -- a freely redistributable 4.4BSD-based operating system with an emphasis on security. Donations allow me to put my efforts into OpenBSD and related projects. In 1999, I created OpenSSH with other members of OpenBSD. It is now incorporated into all Unix systems plus hundreds of other network enabled products. It is now the most "vendor re-used" piece of open source software, with more than 90% of the SSH market.
Unfortunately, de Raadt raises the disturbing possibility that there is a big problem with part of OpenBSD - and one that undermines that “emphasis on security” in a deeply troubling way:
I have received a mail regarding the early development of the OpenBSD IPSEC stack. It is alleged that some ex-developers (and the company they worked for) accepted US government money to put backdoors into our network stack, in particular the IPSEC stack. Around 2000-2001.
source:linuxsecurity.com
The lead developer of the OpenBSD operating system says that he believes that a government contracting firm that contributed code to his project "was probably contracted to write backdoors," which would grant secret access to encrypted communications. Posting to an OpenBSD discussion list Tuesday, Theo de Raadt said that while he now believes that a company called Netsec may have been involved in backdoors, he doesn't think that any of this software made it into the OpenBSD code base.
The controversy was kicked off last week, after former Netsec CEO Gregory Perry e-mailed de Raadt privately, to warn him that there might be 10-year-old bugs in the software that OpenBSD uses for secure Internet communications. Perry said that the back door code was developed as a way for the U.S. Federal Bureau of Investigation to monitor encrypted communications within the U.S. Department of Justice.
این هم در ادامه خبر قبلی من که دیگه به دنیای اوپن سورس اعتماد ندارم.می بینید پول عجب چیزی هست که وجدان رو هم میشه باهاش خرید. متن کامل رو هم اگر می خواید به لینک زیر مراجعه کنید.
http://www.networkworld.com/news/2010/122210-openbsd-chief-believes-contractor-tried.html?source=nww_rss (http://www.networkworld.com/news/2010/122210-openbsd-chief-believes-contractor-tried.html?source=nww_rss)
این هم در ادامه خبر قبلی من که دیگه به دنیای اوپن سورس اعتماد ندارم.می بینید پول عجب چیزی هست که وجدان رو هم میشه باهاش خرید. متن کامل رو هم اگر می خواید به لینک زیر مراجعه کنید.
http://www.networkworld.com/news/2010/122210-openbsd-chief-believes-contractor-tried.html?source=nww_rss (http://www.networkworld.com/news/2010/122210-openbsd-chief-believes-contractor-tried.html?source=nww_rss)
البته نظر شما و اینکه شما حق دارید به کسی اعتماد بکنید یا نه، کاملا برای همه محترمه.
منتها، شما فکر میکنید مثلا همین دولت آمریکا، به این پروژه و مسئولانش یا به قول شما یه گروه از برنامه نویسهاش، پول داده، ولی به طور مثال اصلا کاری با MS نداشته؟؟
کد این مجموعه کاملا بازه، خیلی ها اونو کامپایل میکنن، کد رو میبینن. ولی مثلا شما تا به حال فکر کردید که اصلا امکان دیده شدن سورسهای بسته نیست و اگه این طرف یک درصد احتمال پیدا شدن این حفره ها و درهای پشتی باشه، توی کدهای بسته اصلا و ابدا ممکن نیست.
خیلی بامزست، فکر کنید MS اگه یه همچی کاری بکنه، حتما تو کد کامنت میذاره که برنامه نویسهاش بفهمن اینو نباید دست بزنن! دست کم تو کد باز طرف مجبوره کلی جون بکنه تا حفره رو مخفی کنه!!