I’ve some questions about Ghidra released by NSA on Github. And research about it then saw a ycombinator thread for it. That answer was clever and funny.
As title marked, you really okay for just “open source” to trust it?
You must log in or register to comment.
Not entirely and with absolute certainty, but more than any proprietary software in general. The more eyes on it the better.
At the end of the day, you have to trust someone and a few black boxes in between as soon as you connect to the internet. So if there’s something I’d really rather not let out into the world, it’s either on an airgapped encrypted system or a piece of paper hidden where my keys get lost.
If there is a healty sized developer group contributing. I tend to just install.
If there’s just single developer, not much history and mayde AI involved, I’ll just skip the software.
I don’t have time to review the code and I don’t think the developer wants me to feed the code to AI.
If AI is one of the developers and already involved, AI review is an option, if I really need to run it.
Open-source has the advantage of more eyes on the code. I trust someone, somewhere has looked. That’s all I can do.
Anyone who says “jUsT cHeCk ThE cOdE” should be ignored.
With Open Source software, I need a reason not to trust it. With proprietary software, it’s the other way around. Developer being the NSA has been a reason for me not to trust Ghidra.
I trust no one or anything entirely
IMO the most important part of open source is the Ulysses pact called “right to fork”. It’s like the developer says “if I ever become a tyrant, you have an easy way out of my tyranny”.\ That’s what makes me trust it more than closed source. Not Linus’ Law.
I have found myself by default believing the devs that break off from a massive project and create a fork saying they’re fed up with whatever and they’re going to do it right on their fork.
Ghidra is used by the best and brightest malware inspectors. If it was backdoored, it would have been discovered almost immediately.
The NSA has two conflicting missions, one is to hack everyone, and the other is to protect American networks and interests. Ghidra is from the later, its goal was to make malware analysis cheap and accessible so that more people can investigate and defeat malware.
Ghidra is used by the best and brightest malware inspectors.
Can you prove your claim?
If it was backdoored, it would have been discovered almost immediately.
That’s the hope. Reality is, these things still happen. Remember that even the extremely secure Linux Kernel was almost, if it was not discovered accidentally and looked into it, hit bey huge backdoor. What makes you so sure that Ghidra developers and inspectors is on the same level?
Go to any cyber security conference. Check out the CTF teams, Ghidra is used everywhere.
Can you prove that there is a backdoor? Remember that it is freely available, and if China, Russia, NK or any other nation state could find a backdoor, they would be shouting it from the rooftops to shame the US.
I dont doubt that the NSA could have seeded a backdoor in an open source project, but I very much doubt they would sign their name to it…
Can you prove that there is a backdoor?
I didn’t say there is, I only ask for proofing your point. Remember: Not able to find anything is not the proof of absence. You can only proof something you can find. All I am saying is, if even Linux Kernel ALMOST got hid by a backdoor that was extremely sophisticated, it could happen to Ghidra as well. I’m not saying Ghidra is unsecure or anything like that.
if China, Russia, NK or any other nation state could find a backdoor
Then they would most likely use it to their advantage without telling anyone. Shaming a nation is not as lucrative like
abusing a backdoor.
The NSA has two
conflictingcomplementary missions, one is tohack everyoneattack humans, and the other is toprotect American networks and interests.defend capitalEven if we take your definitions, they are still conflicting.
Attacking humans means developing malware.
Defending capital means protecting that capital from others malware.
If either of them do their job too well, the other will be failed. That is by definition conflicting.
Just add certain.
Hack certain humans. Protect certain capital
for intended bugdoor?
I dont know what you mean by that. Do you mean that the NSA would leave a bug in accidentally? Or intentionally?
Accidentally is definitely plausible, they are only human after all.
Intentionally would be incredibly stupid. The offensive side of the NSA spends billions developing malware that can’t be easily found and attributed to them. Inserting one of those malwares into a piece of software they have publically claimed ownership off completely defeats the point. If they wanted to backdoor an open source software, why wouldn’t they do it anonymously…
No.
