Do you trust Open Source software entirely?! (lemmy.ml)

submitted 4 days ago* (last edited 4 days ago) by behuman@lemmy.ml to c/opensource@lemmy.ml

23 comments fedilink hide all child comments

I've some questions about Ghidra released by NSA on Github. And research about it then saw a ycombinator thread for it. That answer was clever and funny.

As title marked, you really okay for just "open source" to trust it?

you are viewing a single comment's thread
view the rest of the comments

[-] CameronDev@programming.dev 2 points 3 days ago

Only true if they can abuse the backdoor, if its tied to NSA infrastructure (which a competent backdoor would be), they couldn't use it. There is also precedence, the Germans didnt hesitate to publicise that Angela Merkel's phone was hacked, they could have used the malware to feed false information instead. Stuxnet was exposed to embarrass the US/Israel.

Cyber security companies would also have no qualms about publicising it. Finding a NSA backdoor would put them on the map, and they have no use for a backdoor.

[-] XiJinpingStanAccount@lemmy.ml 3 points 3 days ago

Also just want to add to your points that the NSA didn't have to admit they developed this. Putting their name to it basically guaranteed that everyone would pour through the code and assume the worst. So it get hyper scrutinzed. So if they had wanted to put a back door in it they would have released it without saying they made it.