@reed The maintainers are all public. Some distros maintain it better than others, but they're generally trustworthy. I doubt the NSA (or FBI) have put bad guys as maintainers. Now, it is absolutely possible to hack a maintainer, and that is a very real, very serious risk...

PHP got his repos hacked by someone planting a shell, but other devs got the backdoor pretty fast, took the repo down, and rebuilt everything

@reed At least it's more up to date than Debian! But yes, it's pretty well known nowadays just how bad many distros are at keeping up with security, especially for the kernel. That's why I use source-based distros for my most important work.

so it's not impossible to plant a backdoor on opensource, but it's possible to find and wall-up the door. doing the same against a backdoor on MacOS or Angry Birds is not that easy

So s/VLC/everything/

@ThoriumBR Well, and the fact that it's usually easier and cheaper to just find a 0day than make one. It's not like major software projects don't already have people inserting bugs by mistake all the time.

and if I am not mistaken, Snowden said something about Angry Birds being used by the CIA to track some people

I'm not surprised. Most apps phone home and use insecure connections.

maybe not explicitly said angry birds, but something that lead to speculate about

it was something like sending data to be executed on the phone, as the game had a lot of privileges and could do a lot of things

The NSA and CIA aren't gods. What they can do is what any well-resourced organization can do. But they do indeed have lots of resources, and the attack surface of most mobile devices is very high.

They don't even need to use that most of the time.

and "do this or we can bring an army of tax auditors to spend time on your company"

lavasoft got served one of those and choose to close shop

S32 and CNOS (NSA orgs) just hack without getting any judge's permission.

Lavabit?

Yeah. But they weren't hacked, just given a demand.

yep, lavabit... they got served a NSL and choose to close down so they would not betray their principles nor disobey the government

But they did betray their principles. Remember, they gave up their private key.

But they shut down after so the damage would be limited. Unfortunately they didn't use forward secrecy, (so that private key allowed retroactive decryption of previously-collected traffic) which would have made the entire thing funny rather than tragic...

So although Lavabit had a good idea, they weren't very knowledgeable about cryptography, clearly.

they had no choice... they fought as much as they could, but in the end they had to comply

and no forward secrecy was clearly a mistake for a US-based company protecting secrets. but hindsight is always 20/20, so the next ones will learn from them...

Hopefully.

Douchebag hacker tip #49: If you get kernel mode on your target, invert their zero page.

I can't decide on the headline for this article:

cnbc.com/2021/06/23/…

"The end of an era"

or

"The end of a crazy person"

Seems like he was trying to talk everyone into believing that his eventual suicide would be an actual murder as the result of an international conspiracy (obviously I find that one hard to believe):

Know that if I hang myself, a la Epstein, it will be no fault of mine.

@forest as I said somewhere else..

Question is Suicide, "Suicide" or ""Suicide""?

The fuck is memory scrambling?

That's when you scramble memory.

You are welcome.

en.wikipedia.org/wiki/Memory_controller#Security for a real answer

Thank you, that explains it.

Always happy to help

I'll VTC for additional details

5 days trying to get an ISP, and counting...

it looks like tomorrow morning someone will appear here to connect me to civilization

Memory scrambling uses an LFSR. It's not secure.

doc.lagout.org/security/DFRWS-EU-2016-7.pdf

> Lest we forget: Cold-boot attacks on scrambled DDR3 memory

hm