On 04/15/2017 04:46 AM, Pete Biggs wrote:
Not wishing to extend this thread further, but ...
There are conspiracy theories out there that the NSA is involved with bringing systemd to Linux so they can have easy access to *"unknown"* bugs - aka backdoors - to all Linux installations using systemd *[1]*.
They're conspiracy theories, and that's it.
Hmm. That's not quite it. Wikileaks recently posted a trove of docs on CIA exploits. It was big news. I'm surprised you missed that. And, yes, the exploits also include more than a few against linux. Go to their site and look under vault7. Or search for "linux" or "redhat"... you'll get hundreds of hits. Here's just one: https://wikileaks.org/spyfiles4/documents/FinSpy-3.10-User-Manual.docx (If you have only a few seconds to look at it, see page 34.)
The bottom line is that in general people don't like not understanding things and when they come across something they don't understand they create a mythology around those things to rationalise their non-understanding.
True, but that "mansplanation" can point in a lot of ways, including at Pollyanna.
.... Systemd is complex; it's implementation was badly handled on a social level. Nevertheless it is open source. It is highly unlikely that the NSA, or any other agency, would risk putting in backdoors to code that could be audited by Joe "random hacker" Blogs, let alone that might be discovered by hostile agencies.
Years ago it was revealed that one of the linux developers inserted an exploit into the gcc code which, when the login code was compiled, would give him access to any system running it, effectively every linux system. This exploit was in the linux code for a long time and was never discovered. It was revealed only by the developer himself, and only because he was retiring. Point is: Code is often complex, especially that written in C (or C++ and others), so much so that an exploit can be written into it and not discovered for a long time, or ever. This is yet another argument against systemd: it would be much easier to hide an exploit in it than in a handful of bash scripts.
There is no doubt that most security agencies have a long list of zero- day exploits in their toolbox - I would hazard to suggest that they wouldn't be doing their job if they didn't! But I seriously doubt they would commission exploitable code in something that is openly auditable.
P.
P., I used to think that too... indeed, I was thoroughly convinced of it. But reality changed my mind.