5 steps for tackling bugs and fixes for an open source project

Use ...

T. A. I. L. S.

Why is everyone pushing TAILS lately? (and what has TAILS got to do with the subject of the article?)

At first I thought TAILS was a great idea, but then I looked into it a bit and became quite suspicious, the way it's being pushed all of a sudden everywhere as the ultimate solution for privacy and anonymity, while at the same time nobody knows who the authors are (and I have seen rumors that it's a Pentagon product) makes me think that it's actually a trap riddled with back doors and tools that allow three letter agencys to track users of TAILS...

The solution is simple: Demand the source.

As a second best, here are the build instructions for your scrutiny.

Yeah right, as if it was that easy to spot well disguised back doors in millions of lines of source code...

well, you don't have to read all the code. this thing is built on debian, you can use your own trusted (eg standard debian) mirror to build it, so all you need to look at is where tails is different from a standard debian system.

yes, it will be some work to get that done. and depending on what they put in there, it might still be lots of code to read. especially if they add any custom packages. but if not, then it might just be a bunch of configuration settings to study.

greetings, eMBee.

or I can just stay clear of TAILS and spend my time doing more useful things

"As if it was that easy to spot well-disguised back doors..." The same could be said for any usable OS.

If you want an audit trail, use OpenBSD.

gus3, I'm not criticizing Linux or saying other OS'es are better, I have been using Linux since 1995 and will continue to do so using distros that I trust, my problem isn't with Linux but with TAILS which has raised way too many alarm bells with me so I prefer to stay clear of it rather than spending huge amounts of time analyzing it to see whether my suspicions are correct or not.

linux4567,do you have any specific, verifiable reasons to not like Tails? It's just a bundle of apps you can install individually, rolled into a small live distro. Like Tor, LUKS, NoScript, and so on. The reason for the current flurry of attention is their 1.0 release.

The two main uses for Tails are foiling traffic analysis by hiding your location and your backtrail on the Internet, and encrypting your communications to defeat eavesdropping. Tails uses Tor for the first, and standard tools like SSL, SSH, and OpenPGP for the second. So one thing you could do without being a coder is compare checksums of the binaries of the apps bundled in Tails with the originals from their respective Web sites, and see if there are differences.

Another thing you could do is run a packet sniffer and look for suspicious activity.

A third thing to try is open a Tor session between two endpoints that you control, and again compare checksums of sent and received traffic.

That's all I can think of off the top of my head; I know there are other measures to take for detecting interference with your network traffic that don't require reading source code.