Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

A week ago asking this question of Microsoft or such would have got me labelled as paranoid, and asking this question about Ubuntu would have seemed plain stupid, bordering offensive.

Then we found out that there's been a "$250m-a-year US program works covertly with tech companies to insert weaknesses into products".

This is (evil) genius: if you insert secret weaknesses into software or services, e.g. SSL key generation, then your job of breaking in to steal data is made a lot easier. In deed, this is why those agencies can now apparently decrypt a fair bit of SSL traffic on the fly.

I felt smug, thinking open source saves the day: hard to introduce code that does something daft when everyone's looking (much much easier in closed source world). Although this can still happen, e.g. Debian's massive SSH key fail of 2008.

Back then, people at slashdot were asking who introduced the change that nobody noticed and which left the OS wide open.

It seems that with a $250m budget you've got various options to pay someone to try to sneak in vulnerabilities unnoticed, either out in the open or, as in the Debian case, more internal. This $250m has been used to bribe companies. So what of Canonical? I love Ubuntu and have always trusted it, but knowing they're (a) a company and (b) short of cash, made me think: actually they're in quite a good position to do such evil bidding. I mean sending all your local searches off to amazon seems nothing compared to what they could do, after all, as Shuttleworth says We have root!

The German Government recently spotted that they can't trust Windows 8 machines, will they move to Ubuntu? (they're rather partial to Debian anyway.)

I posed the question in a provocative manor, but I believe it's valid; I'm not seeking opinion, nor rants, but wanted to see if anyone could answer categorically No (and back that up with evidence).

share|improve this question

closed as primarily opinion-based by Rinzwind, Thomas W., vasa1, Seth, Alaa Ali Sep 11 '13 at 19:21

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
This is not a discussion site. Try ubuntuforums.org or ubuntu-discourse.org and this "Does Ubuntu deliberately contaminate its binaries to help NSA?" is impossible to answer. How can anyone prove it is done "deliberately" unless they them self say so? –  Rinzwind Sep 11 '13 at 14:00
3  
I think this question is important for many of us, but it is not easy to answer, because nobody knows. Therefore it will tend to a discussion, which is not welcome here. –  Dee Sep 11 '13 at 14:33
3  
I think this is an answerable question. Ubuntu provides the source code and it should be answerable if the binaries produced by the builders are being generated from that source. –  Jorge Castro Sep 11 '13 at 14:42
2  
Debian has a goal to do this: wiki.debian.org/ReproducibleBuilds A proper answer would find out if Ubuntu does this as well. –  Jorge Castro Sep 11 '13 at 14:49
2  
Until we have fully reproducible builds, this is obviously basically impossible to answer other than by assertion. That said, it's worth noting that the people who maintain our build toolchain are mostly outside the US, and they also tend to be the sort of contrary engineer type who'd probably rather quit than insert backdoors ... (I work for Canonical in relevant areas and nobody has ever approached me to insert backdoors, not that there's a particular reason you should believe me.) –  Colin Watson Sep 13 '13 at 13:26

2 Answers 2

Even though this is a valid question, I think it cannot be known whether these practices take place. After all, the purpose of hidden vulnerabilities that are designed into software is for them to remain hidden.

There are a few things to take into account, though:

  • It is harder to hide secret backports in open source software. They almost have to be at the level of algorithms.
  • Why would NSA try to get into Ubuntu if they can already read your email and listen in on your phone?
  • Why would Ubuntu take such a risk? After all, losing their credibility in the linux world would incite people to use other linux systems.

Quite frankly, Ubuntu is dependent on a lot of different software. To be honest, I do not think deliberate contaminations fit the Ubuntu spirit. That being said, who knows...

share|improve this answer
    
Your bullets: (1) yes, hard*er*, I agree. (2) getting access to all Ubuntu machines would be quite handy, especially if ppl turn to Ubuntu to flee insecurities of Windows/Apple. (3) They might not have a choice. But your final remark misses the point: Ubuntu is based on a lot of different software, yes, but it's one central company that compiles and publishes the binaries. So that's the single point of weakness. It's not about spirit of kindly floss ppl, it's about what big companies are forced to do. –  artfulrobot Sep 12 '13 at 8:06

I believe this is more on-topic in security.stackexchange.com or opinion based, but anyways I'll try to answer.

So what of Canonical?

"What of Canonical", what? Nobody/nothing is perfect, system has weakness and humans are the same. Anyone and anything can be vulnerable at any time for any reason. The only one that you can trust is yourself, and sometimes not even that you can do.

So, where is your trust? Nowhere if your are paranoid, and anywhere if you are naïve.

So, what you can do? Nothing and anything. Nothing if you don't care or anything if you care enough to try and fix it (be it creating your own cryptic code, or whatever).

I felt smug, thinking open source saves the day: hard to introduce code that does something daft when everyone's looking (much much easier in closed source world). Although this can still happen, e.g. Debian's massive SSH key fail of 2008.

Did anyone really trust blindly whatever is being throw at them? Yes, if they find comfortable doing so. And there is the example. Nobody verified, everybody trusted, someone failed. Point.

The German Government recently spotted that they can't trust Windows 8 machines, will they move to Ubuntu? (they're rather partial to Debian anyway.)

I love Germans, but I'm not German... whatever they do and how they deal with their problems are probably not of my business. I'll be in the spectators bench anyway, there is nothing I can do, and even if some group asked me, I probably will not participate. If they move to Ubuntu, fine. If they move to Debian, fine. If they stay with Windows, fine. Do you get my point? Only time can be judge and history will tell if they did the correct decision. Right now, we only can hope, that whatever they do, is the best for the future.

A week ago asking this question of Microsoft or such would have got me labelled as paranoid, and asking this question about Ubuntu would have seemed plain stupid, bordering offensive.

Still now you will be labeled as so. Everybody has their opinions. Being manipulated or not. You can only try to argue with them, reach a point of consensus, but it will be still an opinion. And, as an opinion, is weak and can change with time.

Then we found out that there's been a "$250m-a-year US program works covertly with tech companies to insert weaknesses into products".

The policies that each country and individuals have, is not of my business. Unless they seem inconvenient to me, they can do whatever they want. I'm happy either way (not being paranoid, or not being manipulated to be paranoid, has its advantages ;)).

This is (evil) genius: if you insert secret weaknesses into software or services, e.g. SSL key generation, then your job of breaking in to steal data is made a lot easier. In deed, this is why those agencies can now apparently decrypt a fair bit of SSL traffic on the fly.

If you have something you don't want to be known, just DON'T DO IT! Then you will not be particularly preoccupied if it gets know. This is a general advise, not targeted to the scope of the paragraph, but it rings to it quite nicely. Again, my opinion.

I'm not ranting at you, actually I was pretty calm when I wrote this. If some one wants to agree or not with me, it will be still their opinion. BTW, NSA, Google, Microsoft, anyone who is reading this: This is solely my opinion. Do whatever you want with it. I probably change my mind once I hit the "Post your answer button", not that anyone actually cares...

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.