Anyone remember _NSAKEY and all the trouble it caused?
Actually, it didn't cause any trouble because it wasn't a backdoor - the NSA was just the technical authority to review Windows to ensure it met US export laws.
@Borateen:
Thanks. That's the one - many people panicked, but even a decade after people figured out how to substitute their own keys for the built-in one, nothing has happened. There are far easier ways to snoop on and control a Windows PC; the NSA simply doesn't need to integrate such a device into the OS.
The NSA isn't just responsible for cracking enemy codes, it also has the less glamorous job of protecting the US's own information systems. You could likewise make the claim that it's snuck secret backdoors into Linux, since the NSA has submitted a number of patches to the Linux kernel.
What's hilarious is people made the same claims back in the 70s, when the NBS went to the NSA for suggestions on DES, and the NSA told the NBS to change the s-box design. Everybody was convinced that the NSA had snuck secret backdoors into this wonderful encryption algorithm. Until 20 years later, when differential cryptanalysis was invented. Turns out that the design of DES would have been quite vulnerable to differential cryptanalysis, and it was only somehow by a freak coincidence *cough* *cough* that the s-box design kept it safe.
And what makes this particularly ludicrous: this whole issue stems from comments made by the NSA in public comments to congress. If they really snuck backdoors into the code, would they have been talking about it in a public hearing? Seriously? It seems like a conspiracy theory derived from the belief that the NSA is simultaneously a brilliant evil organization, and at the same time a group of bumbling buffoons.
@jepzilla: Gosh, what other big companies has the NSA worked with recently? Oh, the phone companies, you say? and then they had to be given immunity for violations of the law because they cooperated with NSA? You don't say.
@jepzilla: Your Linux point makes no sense at all. The Linux kernel is open and can be viewed by anyone. So trying to sneak a backdoor into the Linux kernel would never work because Linux developers would see it.
The Windows kernel on the other hand cannot be viewed by anyone, so whether MS or NSA admit or deny anything is useless to the outside world since no one can verify their claims.
@jepzilla: Although the NSA may have never snuck intelligence gathering code to the masses (false), there are no checks keeping them from doing so.
So you shouldn't defend them because of their past goodwill. You should simply look at them as an organization with many conflicts-of-interest, and be wary when they 'collaborate' with complacent, market-share dominant companies.
Just like any other organization that has the power and interest to undermine Americans' rights, we shouldn't just rely upon trust to keep us safe.
@jepzilla: It's the same concept that people who think George Bush planned 9/11 use. They talk about how he's so stupid... but then how he was the mastermind in a great conspiracy, all in the same sentence.
@Coolmodo: If anyone were trying to hide malicious code they wouldn't make it that obvious. You're not going to just see:
private void doEvilShit() {...}
You wouldn't just SEE it. You'de have to know exactly what you're looking for and understand every aspect of the code. In complex code, undocumented functionality can hidden quite easily.
This is also why bugs still exist in ALL source-code. Regardless of it being open or closed source.
@Coolmodo: First, it wouldn't be hard to slip a backdoor into the Linux kernel. It's been done before. Even the simple '&& userid = 0' trick would work.
Second, lots of organizations, including foreign governments, have access to the Windows source code. It's not released to the world, but it's out there. It's even been leaked, on occasion.
@Borateen: @Coolmodo: @marissasentme: The NSA has been working with Microsoft on Windows for more than a decade. You can find their guide to security hardening various versions of Windows online, with a little googling. And for as long as they have been, they've been accused of slipping backdoors into Windows. I'm sure none of you remember the _NSAKEY debacle from Windows NT4. But see my above point: lots of people have access to the Windows source code, and as far as I know, nobody has ever found these purported NSA backdoors. It doesn't even make sense... slip backdoors into Windows... which the Chinese government gets access to? So what, the Chinese government can find the backdoor and use it to hack American government computers?
This hysteria over a purported NSA backdoor is just one any number of things people and government organizations could be doing to me. I see no reason to treat it any more credibly than any other. Lots of crap could be going on in the world, including the NSA slipping backdoors into Windows. But I see no reason why that is particularly more likely than any other possible threat out there. It's like the Calvin and Hobbes comic, where Calvin is perfectly happy, then sees and ad for some gum and now MUST HAVE IT for his own happiness. You all can buy into it if you want. I have better things to worry about.
But isn't that *just* what a multibillion dollar corporation working with a secret government agency to spy on all your Gizmodo-reading, Facebook-ing, movie-pirating activity would say?
Coincidence? I think not.
Now, if you'll excuse me, I have some Tivo'd Glenn Beck to watch for the 7th time.
"improved security" should be taken with a few tons of salt.
The NSA is an intelligence gathering organisation and anyone reading this should not be naive to think they made a few recommendations to prevent viruses or Trojans from affecting the system.
You just need to look at history to see how businesses have colluded with intelligence agencies around the world.
So again, let us not be naive, wishful thinking is for children.
When in the past a company like MS would have completely denied working with the NSA, today people have become shrewd and witty, they can even market collusion as a great thing for the customer "hey this is NSA approved security man!".
Not surprising. The NSA goes through every version of Windows and produces deployment guides to help other departments improve the security of their computers. You can find the Win2K and XP guides with a little googling.
I see it as a good thing. Windows is used by a majority of people (I think like 90%?), and their help will make 7 a more secure OS, and will protect the users more.
You must understand the perverse thought process of the common office fridge thief. If you lock up some things, they will assume everything not under lock and key is fair game. You're only giving them further justification for their thievery. It's best to simply poison the food and watch them drop.
This could create other problems as well. Some people never clean their old food out of the office fridge. They'll go on vacation, forgetting their liverwurst and Gouda sandwich. It will gradually develop a fine green patina, and impart it's flavor on everything else stored in the fridge. Then you have to explain why their new fridge locker is in the bottom of a dumpster somewhere because they didn't leave a key.
The locker is an innovative idea that addresses a common problem. But I prefer the old fashioned approach of a good slap in the face when someone does something stupid, inconsiderate, or immoral. Steal from me, I'll slap you in the face. If I stole from you, I'd expect nothing less to happen to me. It keeps us all honest. #fridgelocker
@beercheck: i did that to a co worker. i spiked some salsa in the fridge with 4 dried ground up habanero peppers. to quote her reaction "This salsa is hot as the dickens!" HR caught word and all i got was a "warning". #fridgelocker
@beercheck: I eat habañero peppers like candy, but I've seen those not used to them drop to the ground in tears, so your advice seems solid for me. Having built up a tolerance, I could enjoy a meal that would inflict pain on others.
For those who want to take this a step farther, here's some ideas:
The Sneak Attack
Dry (by roasting) and grind 10 habañeros into a powder. Mix with 1 tsp Jamaican Curry, 1 tsp Gram Marsala, and ¼ Cup Brown sugar. Add ¼ Cup of Vinegar. Cook down to a thick sauce. It's excellent on grilled chicken or Salmon. But you won't know it's hot until half way through your meal. The mixture of the curry and sugar traps the capsaicin (the molecules that give the pepper it heat). It takes anywhere from 30 seconds to 5 minutes for the glaze that encapsulates the capsaicin to break down and release the heat. It dulls the heat a bit, but that is more than compensated for by the increased amount you (or in this case your victim) will consume.
The Punishment
Mixing the pepper attack with the traditional visine attack. For those who don't already know, visine (an eye drop) works by dilating blood vessels in your eye. Ingested, it dilates other things too, eventually working its way through your body and down to the colon. Leakage ensues. Mixed with a goodly amount of habañeros... Fire in the Hole!
If habañeros seem tame to you, another pepper known as "bhot jolokia" hold the world record for hottest pepper known to man. It's the white pulp on the inner wall of the pepper that contains the heat. For the strongest dose, freeze them, run under warm water to remove the skins. Cut in half and remove the seeds. Dry slowly and grind. Freeze the resultant powder. Place the cold powder in a coffee filter. Pour ice-cold Vodka over the powder and collect the liquid that drips through. Let it dry. The white or yellow resin in the bottom is pure capsaicin. You'll need about 50 peppers to get a single gram of capsaicin, but it's so potent you need special licensing in many places to have it. Make your own pepper spray, prank your room mates with a few drops in their bottle of sex lube... use your imagination.
I take no responsibility for the stupid and potentially harmful results of people taking my advice. The above if for academic purposes only and should not be attempted by anyone ever. #fridgelocker
@vlatro: I reckon Guatemalan Insanity Peppers would kick your silly bhot jolokia clear to Shelbyville.....if they weren't so damned tough to obtain. #fridgelocker
A friend of mine had a great solution for people stealing his food out of the fridge at work.
One day he bought a thing of dog biscuits and put icing all over them. Dropped them all in a pastry box and left a name tag on it (not his).
He dropped it off in the kitchen, they looked just like little cookies, and they must have tasted decent, because sure enough, the box was empty by lunch.
He came back from lunch and left the dog biscuit box on the counter... it didn't take long for people to put two and two together... he claims his food has been much safer since. #fridgelocker
11/20/09
Actually, it didn't cause any trouble because it wasn't a backdoor - the NSA was just the technical authority to review Windows to ensure it met US export laws.
11/20/09
[www.cnn.com]
[en.wikipedia.org]
11/20/09
Thanks. That's the one - many people panicked, but even a decade after people figured out how to substitute their own keys for the built-in one, nothing has happened. There are far easier ways to snoop on and control a Windows PC; the NSA simply doesn't need to integrate such a device into the OS.
[www.schneier.com]
11/20/09
11/20/09
What's hilarious is people made the same claims back in the 70s, when the NBS went to the NSA for suggestions on DES, and the NSA told the NBS to change the s-box design. Everybody was convinced that the NSA had snuck secret backdoors into this wonderful encryption algorithm. Until 20 years later, when differential cryptanalysis was invented. Turns out that the design of DES would have been quite vulnerable to differential cryptanalysis, and it was only somehow by a freak coincidence *cough* *cough* that the s-box design kept it safe.
And what makes this particularly ludicrous: this whole issue stems from comments made by the NSA in public comments to congress. If they really snuck backdoors into the code, would they have been talking about it in a public hearing? Seriously? It seems like a conspiracy theory derived from the belief that the NSA is simultaneously a brilliant evil organization, and at the same time a group of bumbling buffoons.
11/20/09
I'm sure there's nothing here to worry about...
11/20/09
11/20/09
The Windows kernel on the other hand cannot be viewed by anyone, so whether MS or NSA admit or deny anything is useless to the outside world since no one can verify their claims.
11/20/09
So you shouldn't defend them because of their past goodwill. You should simply look at them as an organization with many conflicts-of-interest, and be wary when they 'collaborate' with complacent, market-share dominant companies.
Just like any other organization that has the power and interest to undermine Americans' rights, we shouldn't just rely upon trust to keep us safe.
[en.wikipedia.org]
11/20/09
Now, the windows kernel..heh, remember when the win2k (I think, maybe xp?) source was leaked? and it was hilarious?!
11/20/09
11/20/09
private void doEvilShit() {...}
You wouldn't just SEE it. You'de have to know exactly what you're looking for and understand every aspect of the code.
In complex code, undocumented functionality can hidden quite easily.
This is also why bugs still exist in ALL source-code. Regardless of it being open or closed source.
11/20/09
Second, lots of organizations, including foreign governments, have access to the Windows source code. It's not released to the world, but it's out there. It's even been leaked, on occasion.
@Borateen: @Coolmodo: @marissasentme: The NSA has been working with Microsoft on Windows for more than a decade. You can find their guide to security hardening various versions of Windows online, with a little googling. And for as long as they have been, they've been accused of slipping backdoors into Windows. I'm sure none of you remember the _NSAKEY debacle from Windows NT4. But see my above point: lots of people have access to the Windows source code, and as far as I know, nobody has ever found these purported NSA backdoors. It doesn't even make sense... slip backdoors into Windows... which the Chinese government gets access to? So what, the Chinese government can find the backdoor and use it to hack American government computers?
This hysteria over a purported NSA backdoor is just one any number of things people and government organizations could be doing to me. I see no reason to treat it any more credibly than any other. Lots of crap could be going on in the world, including the NSA slipping backdoors into Windows. But I see no reason why that is particularly more likely than any other possible threat out there. It's like the Calvin and Hobbes comic, where Calvin is perfectly happy, then sees and ad for some gum and now MUST HAVE IT for his own happiness. You all can buy into it if you want. I have better things to worry about.
@JessicaAlba: I'm not even American.
11/20/09
11/20/09
Coincidence? I think not.
Now, if you'll excuse me, I have some Tivo'd Glenn Beck to watch for the 7th time.
11/20/09
The NSA is an intelligence gathering organisation and anyone reading this should not be naive to think they made a few recommendations to prevent viruses or Trojans from affecting the system.
You just need to look at history to see how businesses have colluded with intelligence agencies around the world.
So again, let us not be naive, wishful thinking is for children.
When in the past a company like MS would have completely denied working with the NSA, today people have become shrewd and witty, they can even market collusion as a great thing for the customer "hey this is NSA approved security man!".
11/19/09
11/19/09
11/19/09
11/19/09
just kidding... I see the worth of this.
11/19/09
11/19/09
YES! this is a poster that needs to be made.
11/19/09
11/19/09
11/19/09
11/19/09
11/10/09
This could create other problems as well. Some people never clean their old food out of the office fridge. They'll go on vacation, forgetting their liverwurst and Gouda sandwich. It will gradually develop a fine green patina, and impart it's flavor on everything else stored in the fridge. Then you have to explain why their new fridge locker is in the bottom of a dumpster somewhere because they didn't leave a key.
The locker is an innovative idea that addresses a common problem. But I prefer the old fashioned approach of a good slap in the face when someone does something stupid, inconsiderate, or immoral. Steal from me, I'll slap you in the face. If I stole from you, I'd expect nothing less to happen to me. It keeps us all honest. #fridgelocker
11/09/09
Thievery can lead to teachable moments. #fridgelocker
11/09/09
11/09/09
11/10/09
For those who want to take this a step farther, here's some ideas:
The Sneak Attack
Dry (by roasting) and grind 10 habañeros into a powder. Mix with 1 tsp Jamaican Curry, 1 tsp Gram Marsala, and ¼ Cup Brown sugar. Add ¼ Cup of Vinegar. Cook down to a thick sauce. It's excellent on grilled chicken or Salmon. But you won't know it's hot until half way through your meal. The mixture of the curry and sugar traps the capsaicin (the molecules that give the pepper it heat). It takes anywhere from 30 seconds to 5 minutes for the glaze that encapsulates the capsaicin to break down and release the heat. It dulls the heat a bit, but that is more than compensated for by the increased amount you (or in this case your victim) will consume.
The Punishment
Mixing the pepper attack with the traditional visine attack. For those who don't already know, visine (an eye drop) works by dilating blood vessels in your eye. Ingested, it dilates other things too, eventually working its way through your body and down to the colon. Leakage ensues. Mixed with a goodly amount of habañeros... Fire in the Hole!
If habañeros seem tame to you, another pepper known as "bhot jolokia" hold the world record for hottest pepper known to man. It's the white pulp on the inner wall of the pepper that contains the heat. For the strongest dose, freeze them, run under warm water to remove the skins. Cut in half and remove the seeds. Dry slowly and grind. Freeze the resultant powder. Place the cold powder in a coffee filter. Pour ice-cold Vodka over the powder and collect the liquid that drips through. Let it dry. The white or yellow resin in the bottom is pure capsaicin. You'll need about 50 peppers to get a single gram of capsaicin, but it's so potent you need special licensing in many places to have it. Make your own pepper spray, prank your room mates with a few drops in their bottle of sex lube... use your imagination.
I take no responsibility for the stupid and potentially harmful results of people taking my advice. The above if for academic purposes only and should not be attempted by anyone ever. #fridgelocker
11/10/09
11/10/09
Links:
Do "insanity peppers" really exist?
[answers.google.com]
Naga Jolokia pepper (aka bhot jolokia)
[en.wikipedia.org] #fridgelocker
11/09/09
11/09/09
One day he bought a thing of dog biscuits and put icing all over them. Dropped them all in a pastry box and left a name tag on it (not his).
He dropped it off in the kitchen, they looked just like little cookies, and they must have tasted decent, because sure enough, the box was empty by lunch.
He came back from lunch and left the dog biscuit box on the counter... it didn't take long for people to put two and two together... he claims his food has been much safer since. #fridgelocker