[148748] in cryptography@c2.net mail archive
Re: [Cryptography] how reliably do audits spot backdoors?
daemon@ATHENA.MIT.EDU (Jerry Leichter)
Thu Dec 26 15:03:02 2013
X-Original-To: cryptography@metzdowd.com
From: Jerry Leichter <leichter@lrw.com>
In-Reply-To: <CAMm+Lwi=5oX_0Ujf26g7fAdhkejcBvp6_6630ArKHFF2qQxkvw@mail.gmail.com>
Date: Thu, 26 Dec 2013 14:50:52 -0500
To: Phillip Hallam-Baker <hallam@gmail.com>
Cc: Benjamin Kreuter <brk7bx@virginia.edu>,
"cryptography@metzdowd.com" <cryptography@metzdowd.com>,
"James A. Donald" <jamesd@echeque.com>
Errors-To: cryptography-bounces+crypto.discuss=bloom-picayune.mit.edu@metzdowd.com
--===============4424452557073465474==
Content-Type: multipart/signed; boundary="Apple-Mail=_3FA8A09C-55A7-4659-B519-5E7A3851D8C4"; protocol="application/pkcs7-signature"; micalg=sha1
--Apple-Mail=_3FA8A09C-55A7-4659-B519-5E7A3851D8C4
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=iso-8859-1
On Dec 26, 2013, at 10:12 AM, Phillip Hallam-Baker <hallam@gmail.com> =
wrote:
> Stability of installation packages is a lot more important than many =
developers imagine.
>=20
> Mosaic was not the first Web browser. It wasn't even one of the first =
dozen. What set it apart was that it worked without the need for the =
installer to spend hours fixing it first. Today that is reasonably =
common but in 1992 it was revolutionary.=20
>=20
> I recently tried to install the IETF tool for writing in their stupid =
documentation format and found that the code would not run because it =
needed another package. Python suffers from the same dll hell idiocy as =
Windows used to before people started to get a clue and realize that =
shared object libraries are not your friend....
The solution to this problem in large parts of the commercial world =
these days is the virtual appliance. Why screw around getting the =
user's copy of Windows or Linux configured just as you need it? Give =
him a VM image all properly configured and have him just boot it.
MacOS has done this in a weak way through its application bundles for =
years. Mac applications never have dependencies you have to resolve - =
what you see as foo.app is actually a (hidden, unless you choose to =
unhide it) directory within which live the executable and all the =
libraries and config files and basic data - e.g., message files in =
multiple languages. Sure, you end up with tons of copies of some common =
pre-requisite libraries, probably in multiple versions; the Sparkle =
automatic updating framework probably lives in half the third party =
application bundles on a Mac user's disk. But who cares? Relative to =
code sizes, disk space is free these days, and the developer then knows =
you're running against exactly the libraries he built against.
For a consumer OS, this is "good enough" isolation - and a hell of a lot =
better than the DLL hell of Windows or any of the Linux package =
managers. It's not, of course, nearly as complete a solution as the =
virtual appliance.
Virtual appliances *typically* come as closed-source solutions, but =
there's no reason you couldn't package up the sources, and even the full =
build environment, inside the appliance.
-- Jerry
--Apple-Mail=_3FA8A09C-55A7-4659-B519-5E7A3851D8C4
Content-Disposition: attachment;
filename=smime.p7s
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIO5DCCBJ0w
ggOFoAMCAQICEDQ96SusJzT/j8s0lPvMcFQwDQYJKoZIhvcNAQEFBQAwbzELMAkGA1UEBhMCU0Ux
FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5hbCBUVFAgTmV0
d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdDAeFw0wNTA2MDcwODA5MTBa
Fw0yMDA1MzAxMDQ4MzhaMIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNh
bHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsTGGh0
dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQGA1UEAxMtVVROLVVTRVJGaXJzdC1DbGllbnQgQXV0
aGVudGljYXRpb24gYW5kIEVtYWlsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsjmF
pPJ9q0E7YkY3rs3BYHW8OWX5ShpHornMSMxqmNVNNRm5pELlzkniii8efNIxB8dOtINknS4p1aJk
xIW9hVE1eaROaJB7HHqkkqgX8pgV8pPMyaQylbsMTzC9mKALi+VuG6JG+ni8om+rWV6lL8/K2m2q
L+usobNqqrcuZzWLeeEeaYji5kbNoKXqvgvOdjp6Dpvq/NonWz1zHyLmSGHGTPNpsaguG7bUMSAs
vIKKjqQOpdeJQ/wWWq8dcdcRWdq6hw2v+vPhwvCkxWeM1tZUOt4KpLoDd7NlyP0e03RiqhjKaJMe
oYV+9Udly/hNVyh00jT/MLbu9mIwFIws6wIDAQABo4H0MIHxMB8GA1UdIwQYMBaAFK29mHo0tCb3
+sQmVO8DveAky1QaMB0GA1UdDgQWBBSJgmd9xJ0mcABLtFBIfN49rgRufTAOBgNVHQ8BAf8EBAMC
AQYwDwYDVR0TAQH/BAUwAwEB/zARBgNVHSAECjAIMAYGBFUdIAAwRAYDVR0fBD0wOzA5oDegNYYz
aHR0cDovL2NybC51c2VydHJ1c3QuY29tL0FkZFRydXN0RXh0ZXJuYWxDQVJvb3QuY3JsMDUGCCsG
AQUFBwEBBCkwJzAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG
9w0BAQUFAAOCAQEAAbyc42MosPMxAcLfe91ioAGdIzEPnJJzU1HqH0z61p/Eyi9nfngzD3QWuZGH
kfWKJvpkcADYHvkLBGJQh5OB1Nr1I9s0u4VWtHA0bniDNx6FHMURFZJfhxe9rGr98cLRzIlfsXzw
PlHyNfN87GCYazor4O/fs32G67Ub9VvsonyYE9cAULnRLXPeA3h04QWFMV7LmrmdlMa5lDd1ctxE
+2fo8PolHlKn2iXpR+CgxzygTrEKNvt3SJ/vl4r7tP7jlBSog7xcLT/SYHFg7sJxggzpiDbj2iC0
o6BsqpZLuICOdcpJB/Y7FLrf3AXZn9vgsuZNoHgm5+ctbn9fxh6IFTCCBRowggQCoAMCAQICEG0Z
6qcZT2ozIuYiMnqqcd4wDQYJKoZIhvcNAQEFBQAwga4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJV
VDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29y
azEhMB8GA1UECxMYaHR0cDovL3d3dy51c2VydHJ1c3QuY29tMTYwNAYDVQQDEy1VVE4tVVNFUkZp
cnN0LUNsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgRW1haWwwHhcNMTEwNDI4MDAwMDAwWhcNMjAw
NTMwMTA0ODM4WjCBkzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQ
MA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxOTA3BgNVBAMTMENP
TU9ETyBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBAJKEhFtLV5jUXi+LpOFAyKNTWF9mZfEyTvefMn1V0HhMVbdC
lOD5J3EHxcZppLkyxPFAGpDMJ1Zifxe1cWmu5SAb5MtjXmDKokH2auGj/7jfH0htZUOMKi4rYzh3
37EXrMLaggLW1DJq1GdvIBOPXDX65VSAr9hxCh03CgJQU2yVHakQFLSZlVkSMf8JotJM3FLb3uJA
AVtIaN3FSrTg7SQfOq9xXwfjrL8UO7AlcWg99A/WF1hGFYE8aIuLgw9teiFX5jSw2zJ+40rhpVJy
ZCaRTqWSD//gsWD9Gm9oUZljjRqLpcxCm5t9ImPTqaD8zp6Q30QZ9FxbNboW86eb/8ECAwEAAaOC
AUswggFHMB8GA1UdIwQYMBaAFImCZ33EnSZwAEu0UEh83j2uBG59MB0GA1UdDgQWBBR6E04AdFvG
eGNkJ8Ev4qBbvHnFezAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADARBgNVHSAE
CjAIMAYGBFUdIAAwWAYDVR0fBFEwTzBNoEugSYZHaHR0cDovL2NybC51c2VydHJ1c3QuY29tL1VU
Ti1VU0VSRmlyc3QtQ2xpZW50QXV0aGVudGljYXRpb25hbmRFbWFpbC5jcmwwdAYIKwYBBQUHAQEE
aDBmMD0GCCsGAQUFBzAChjFodHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vVVROQWRkVHJ1c3RDbGll
bnRfQ0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29tMA0GCSqGSIb3
DQEBBQUAA4IBAQCF1r54V1VtM39EUv5C1QaoAQOAivsNsv1Kv/avQUn1G1rF0q0bc24+6SZ85kyY
wTAo38v7QjyhJT4KddbQPTmGZtGhm7VNm2+vKGwdr+XqdFqo2rHA8XV6L566k3nK/uKRHlZ0sviN
0+BDchvtj/1gOSBH+4uvOmVIPJg9pSW/ve9g4EnlFsjrP0OD8ODuDcHTzTNfm9C9YGqzO/761Mk6
PB/tm/+bSTO+Qik5g+4zaS6CnUVNqGnagBsePdIaXXxHmaWbCG0SmYbWXVcHG6cwvktJRLiQfsrR
eTjrtDP6oDpdJlieYVUYtCHVmdXgQ0BCML7qpeeU0rD+83X5f27nMIIFITCCBAmgAwIBAgIQbDkx
1BIhYvJPPyuqUq3TXjANBgkqhkiG9w0BAQUFADCBkzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdy
ZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExp
bWl0ZWQxOTA3BgNVBAMTMENPTU9ETyBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBF
bWFpbCBDQTAeFw0xMzEyMTIwMDAwMDBaFw0xNDEyMTIyMzU5NTlaMCExHzAdBgkqhkiG9w0BCQEW
EGxlaWNodGVyQGxydy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDcxkWWIpx9
1jeZsY58KmdNT9YcnXrfzFTzt0FGBkQ+kHKX1CqirfmGXSK2dGGZG1pkcnQYC/xYjWV/EuKM+34v
mvrmqpYqP6ZcvTE5xEHhcjSQTVGtFRH/ysswm6ckEIhlQ+szhGMkE9DGiMN+ExoDdGXW0vkjIxvm
YlZtI4ohw0plXB5jBz+JXR+uWovnvRrYVNujXV8P1f4oGHEiqS++ThsDkdrwgUAuVt3Vd+AR2b9u
4p7BBg2ifK+nnpB9Qvp8nJu4byIs86J07k5NVjprMUrZ4zpA1GuVIavFwntDIVueGRpi4jwtr/OE
NQOOfJ+n8hp2rs0LfrRWH+dRQW5jAgMBAAGjggHgMIIB3DAfBgNVHSMEGDAWgBR6E04AdFvGeGNk
J8Ev4qBbvHnFezAdBgNVHQ4EFgQUGC6zwEozq6+Xt9SC3MUWhApg0oUwDgYDVR0PAQH/BAQDAgWg
MAwGA1UdEwEB/wQCMAAwIAYDVR0lBBkwFwYIKwYBBQUHAwQGCysGAQQBsjEBAwUCMBEGCWCGSAGG
+EIBAQQEAwIFIDBGBgNVHSAEPzA9MDsGDCsGAQQBsjEBAgEBATArMCkGCCsGAQUFBwIBFh1odHRw
czovL3NlY3VyZS5jb21vZG8ubmV0L0NQUzBXBgNVHR8EUDBOMEygSqBIhkZodHRwOi8vY3JsLmNv
bW9kb2NhLmNvbS9DT01PRE9DbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3VyZUVtYWlsQ0EuY3Js
MIGIBggrBgEFBQcBAQR8MHowUgYIKwYBBQUHMAKGRmh0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NP
TU9ET0NsaWVudEF1dGhlbnRpY2F0aW9uYW5kU2VjdXJlRW1haWxDQS5jcnQwJAYIKwYBBQUHMAGG
GGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTAbBgNVHREEFDASgRBsZWljaHRlckBscncuY29tMA0G
CSqGSIb3DQEBBQUAA4IBAQBDmBD7c/0z1sApyjMF3WMva4b2Kid9frR+p1+BhKtTOYXQ1NOYF5bb
Qm/c0mEQ0JGaNA64x2ujfjnfwaKt9BPa4FP2Ffvvod5uu8pasxuOR07iODBx8b78vqXOS4fUsdE+
Ial+ALtsAQcjdh8TRWN+myFcSf0qQH/7k3IODp2eVy4i4mHEDvHwMoUWaIsUACOoHgpxbqHqDyXg
c7uey1TH1F+CjcSzyycEP8dAzxuh7npov0IWFniY/y6Qm/ZSeTPU6CpzH29t/IZiJUfzgfzYQnR1
DED4ZMBQ8BjAZdpdqz7F00Vudwsojrj7qqreBVN1D7MAjpoevnq0r5qjomM0MYIDqzCCA6cCAQEw
gagwgZMxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcT
B1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTkwNwYDVQQDEzBDT01PRE8gQ2xp
ZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1haWwgQ0ECEGw5MdQSIWLyTz8rqlKt014w
CQYFKw4DAhoFAKCCAdcwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
MTMxMjI2MTk1MDU2WjAjBgkqhkiG9w0BCQQxFgQUIQndBbiCfiscf6uGJJ4xOjHQVjIwgbkGCSsG
AQQBgjcQBDGBqzCBqDCBkzELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3Rl
cjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxOTA3BgNVBAMT
MENPTU9ETyBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIQbDkx1BIh
YvJPPyuqUq3TXjCBuwYLKoZIhvcNAQkQAgsxgauggagwgZMxCzAJBgNVBAYTAkdCMRswGQYDVQQI
ExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBD
QSBMaW1pdGVkMTkwNwYDVQQDEzBDT01PRE8gQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1
cmUgRW1haWwgQ0ECEGw5MdQSIWLyTz8rqlKt014wDQYJKoZIhvcNAQEBBQAEggEAPRsCyZNCFCaR
EUjLCOvT822yztOC0/wRzLmp8B1SPfccD05MMa1k8y6BHLEbBQ1SkxM9SSXFpKx4A138YTcrc3HZ
1LojoFM5P9a++92ga52zQPrxmaGzqzkpPZvmEe1ez59i8Q91KOdrz+wCucV4i4R4aEJNxZheqSZh
2Ons0rDrrRoGknTzqujG/W0t8WDeAMtNxA1XPyiycoxaV0g1uq3Lnwi8/sNrD+d8Zg6M+FwDyegz
TQ9YKEevO4oZxGZ/VLK0mIikkHQjYiaAfaWPzn7HrXyyog2t+unaSGBFbHYuFtiiQ4NFSsKFwtI6
D++C4gtBavS66lD8J749ENmbiAAAAAAAAA==
--Apple-Mail=_3FA8A09C-55A7-4659-B519-5E7A3851D8C4--
--===============4424452557073465474==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
The cryptography mailing list
cryptography@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
--===============4424452557073465474==--
