Verify the identity of developers [LWN.net]

Verify the identity of developers

Posted Mar 30, 2024 18:15 UTC (Sat) by rra (subscriber, #99804)
In reply to: Verify the identity of developers by marcH
Parent article: A backdoor in xz

> Developers do not automatically risk jail or death or worse if they refuse a "proposition" from the intelligence agency of a democracy.

I live in a country that is theoretically a democracy but has something called "National Security Letters" that are substantially similar to this description, which makes me dubious the line is quite this clear-cut.

to post comments

Verify the identity of developers

Posted Mar 30, 2024 19:00 UTC (Sat) by marcH (subscriber, #57642) [Link] (2 responses)

I wrote "not automatically", "shades of grey" and used plenty other adverbs but apparently not enough.

Verify the identity of developers

Posted Mar 30, 2024 19:59 UTC (Sat) by rra (subscriber, #99804) [Link]

> I wrote "not automatically", "shades of grey" and used plenty other adverbs but apparently not enough.

I'm sorry, you're right, you did, and I should have acknowledged that. I still think I disagree with you somewhat about the intensity of the difference, but it's hard to quantify and there's nothing incorrect in what you said.

Verify the identity of developers

Posted Apr 1, 2024 15:31 UTC (Mon) by Lennie (subscriber, #49641) [Link]

For context, I'll post you a link to a talk by a brave man:

https://media.ccc.de/v/27c3-4263-en-resisting_excessive_g...

Resisting the state if they come knocking is euh... hard work to say the least.

Formally good actors can (be made to) turn or get their systems compromised.

Which is why we need to focus on checking code and making code more readable probably less focus less on the actors.