@reed The maintainers are all public. Some distros maintain it better than others, but they're generally trustworthy. I doubt the NSA (or FBI) have put bad guys as maintainers. Now, it is absolutely possible to hack a maintainer, and that is a very real, very serious risk...
@reed At least it's more up to date than Debian! But yes, it's pretty well known nowadays just how bad many distros are at keeping up with security, especially for the kernel. That's why I use source-based distros for my most important work.
so it's not impossible to plant a backdoor on opensource, but it's possible to find and wall-up the door. doing the same against a backdoor on MacOS or Angry Birds is not that easy
@ThoriumBR Well, and the fact that it's usually easier and cheaper to just find a 0day than make one. It's not like major software projects don't already have people inserting bugs by mistake all the time.
The NSA and CIA aren't gods. What they can do is what any well-resourced organization can do. But they do indeed have lots of resources, and the attack surface of most mobile devices is very high.
But they did betray their principles. Remember, they gave up their private key.
But they shut down after so the damage would be limited. Unfortunately they didn't use forward secrecy, (so that private key allowed retroactive decryption of previously-collected traffic) which would have made the entire thing funny rather than tragic...
So although Lavabit had a good idea, they weren't very knowledgeable about cryptography, clearly.
they had no choice... they fought as much as they could, but in the end they had to comply
and no forward secrecy was clearly a mistake for a US-based company protecting secrets. but hindsight is always 20/20, so the next ones will learn from them...
Seems like he was trying to talk everyone into believing that his eventual suicide would be an actual murder as the result of an international conspiracy (obviously I find that one hard to believe):
Know that if I hang myself, a la Epstein, it will be no fault of mine.
Is it possible to disable memory scrambling for RAM?
Can you change what kind of algorithm is used?
Can you check from inside the system what is in use?