Verify the identity of developers [LWN.net]

Verify the identity of developers

Posted Mar 30, 2024 19:50 UTC (Sat) by dvdeug (guest, #10998)
In reply to: Verify the identity of developers by marcH
Parent article: A backdoor in xz

> These are very real but they were also huge scandals.

Huge scandals? Crypto AG, by the time it came out, was a minor historical note. I'd bet most Americans would consider it a good move that let us spy on foreign enemies, and many wouldn't bat an eye at the amount of spying done on allied powers. The NSA stunt annoyed some in the field of computer security, but few outside it.

> In dictatorships such stuff is business as usual.

I'm not sure. China isn't going to play around with Dual_EC_DRBG; you use their keys for SSL or else. They openly put taps in, and wouldn't bother with something nobody is going to trust. This skullduggery is part and parcel of Western intelligence agencies.

> Developers do not automatically risk jail or death or worse if they refuse a "proposition" from the intelligence agency of a democracy.

https://arstechnica.com/tech-policy/2013/04/wikipedia-edi... There's a risk of jail time. Nor do I think US intelligence agencies are above blackmail, though the CIA might reserve that for people outside the US.

> Nothing's black and white here but there can be a huge differences between "light grey" and "dark grey"

Yes, but at the same time, intelligence agencies, democracy or otherwise, are very clandestine and have a history of this type of stuff.

As another note, a new developer from the Western world could be a genuine newbie, but could also be someone who found a job posting on the dark web when looking to buy the "Easy Home Kit for Cooking Meth", and now gets paid for his identity, quite possibly with no idea who is paying him.

> Yet Western business is nowadays required to distance itself more and more from powerful dictatorships which is costing a LOT. Guess why.

More and more? If we're talking about China, it's got Cold War parallels, two large powers fighting over control of the world. Russia has even more Cold War parallels, and while pulling out of Russia is bad for business, so is letting Russia take over Eastern Europe. There's moral elements, and fears that Chinese products have backdoors. I'm really not sure what you're getting at here. I certainly don't see Western business having much trouble dealing with dictatorships that haven't pissed off the West.

to post comments

Verify the identity of developers

Posted Apr 1, 2024 0:24 UTC (Mon) by marcH (subscriber, #57642) [Link]

> Huge scandals? Crypto AG, by the time it came out, was a minor historical note.

It was probably not mentioned in family dinners but it made the mainstream press which is very rare for topics like this. It also taught many "naive" countries to stop blindly trusting their allies. So yes, it was a pretty big deal.

> https://arstechnica.com/tech-policy/2013/04/wikipedia-edi... There's a risk of jail time.

Whether this particular case has merit or not, publishing classified information is of course pretty stupid and totally unrelated to inserting backdoors in open source projects.

> but could also be someone who found a job posting on the dark web

Yes verifying identities will never be a silver bullet. But it would be for sure more useful in a place with a functional legal system where such a person runs the risk of being caught and prosecuted (as opposed to getting a medal from their dictator).

> I'm really not sure what you're getting at here. I certainly don't see Western business having much trouble dealing with dictatorships that haven't pissed off the West.

My (admittedly confusing) tangent/PS was: businesses and monopolies tend to buy congressmen and run the show in democracies, especially in the US since "Citizens United vs FEC". As you noted, businesses generally don't care about dictatorships, only about money. That's why they are called "businesses". But even in these short-sighted, market-based countries, authorities are starting to realize the magnitude of the risks and problems and are (slowly) taking precautions affecting the bottom line of their uber rich and all powerful businesses. The IT naivety is (slowly) regressing and that's a good thing.