Wow, another NSA leak: Network security code appears on GitHub

So here we are. The NSA has contributed code to the open source community which ostensibly can be used to make our systems more secure.

On the other side of that coin, the NSA is the agency that has been spying on Internet users inside and outside the USA, has coerced vendors to compromise our private data, has been called out on these practices, and has remained unapologetic in their continuance..

So tell me please, how is it that we should now put our trust in NSA code to "secure" our systems?

How do you spell T R O J A N?

> How do you spell T R O J A N?

"NSA code"? Well, it's at least a good first approximation.

@penguinist:

It's really pretty simple... The code is open source and can be vetted for security leaks. I have no problems with the code that the NSA has contributed. I definitely have problems with the unethical, and probably illegal practices that they have engaged in, though.

JaseP:

In theory I agree with you, however the vetting process starts to break down as the code size increases. I looked at the github code for this NSA contribution and decided that I didn't have the time to spare that would be needed to read through it all.

When the code base becomes large it would be very easy for a contributor to insert a seemingly innocent buffer overflow exploit that might go unnoticed by most reviewers.

This is also one of my concerns about systemd. In that case you have a mega amount of library code that runs with root access to your system and I for one do not have the time to vet such large pieces code. Reading through a small focused init proc 0 was "in scope" but systemd not so much.

To illustrate this, let's compare the memory footprint of proc 0 in systemd vs init

CentOS 6.6 with /sbin/init : 19,232

Fedora 22 with /usr/lib/systemd/systemd: 191,312

If you had to personally vet all the code you might not trust, you'd end up vetting code 100% of the time. There's someone else doing it... The code is published. If Linus Torvalds didn't trust something to end up in the kernel,... it wouldn't make it in...

Welcome to the NSA Trust Restoration Objective Justifiable Action Network.

@JaseP:

Again, I find myself agreeing with you in principle. It's just that I would feel better if I knew just how much vetting a particular piece of software did receive by the community. We have thousands of people looking at the kernel so I don't have to worry about that.

Just how many people are looking at some of the other "critical and big" packages (read systemd) I'm not so sure. Maybe there are a multitude out there vetting systemd as we speak. I'll hope that is the case. But until the dust settles, I'm staying with pre-systemd distributions wherever I can.