Core NGINX Developer Forks Web Server Into Freenginx

[skeevy420]

Do you realize that it is possible, and very easy, for me to release an open source OS that has a backdoor in it, that no one can ever find, because it does not exist in the source code?

You just inject arbitrary code at compile time, so that a review of the source turns up nothing suspicious:

https://github.com/ltrzesniewski/InlineIL.Fody

Hell, the GPL doesn't even prevent that. I could release SuperMegaOS under the GPL and my releases could be chock full of backdoor surprises. It would only be the "shady" git builds provided by community members like Sophisticles that wouldn't have the backdoor surprises. The GPL only says what other people can do with my code, not what I can do with my code.

[sophisticles]

If the Chinese government spies on me, they can't touch me, because my own government isn't going to ship me to China, nor do they have the ability to just catch people on our airports.

So yes, Chinese spying IS actually better for someone living in the West than USA spying.

Time to burst your bubble:

https://www.nytimes.com/2022/09/14/opinion/international-world/china-espionage.html

https://warontherocks.com/2015/08/a-guide-to-chinese-intelligence-operations/

https://www.theguardian.com/us-news/2023/jun/20/china-nationals-expatriate-illegal-stalking-trial

https://www.propublica.org/article/operation-fox-hunt-how-china-exports-repression-using-a-network-of-spies-hidden-in-plain-sight

[sophisticles]

This rabid anti-China sentiment that has gripped the USA folks these last ~5 years has already become extremely tiresome. Don't buy Chinese products, don't use Chinese tech, don't consume Chinese culture, don't do this, don't do that... They live in their own little bubble and cant' seem to understand that practically no one gives a fk about their Cold War 2.0 other than themselves, even those people who see China as a competitor.

It is not anti-China sentiment, I have a lot of respect and admiration for the Chinese they have one of the 4 oldest civilizations in the world, they are industrious, they have significant culture, the list goes on but there is no question that they have a system of government that is oppressive and authoritarian, and if you look at the words and actions of its leaders there is cause for significant concern.

[sophisticles]

Still, the rules say one thing and the major players do something different. It's only the little guys that seem to be following the rules as written.

Isn't that the way it always is?

[FedFer]

It would only be the "shady" git builds provided by community members like Sophisticles that wouldn't have the backdoor surprises.

Ah, yes, Sophisticles, our lord and savior, what would we do without you! Our hero <3

[Old Grouch]

Do you realize that it is possible, and very easy, for me to release an open source OS that has a backdoor in it, that no one can ever find, because it does not exist in the source code?

You just inject arbitrary code at compile time, so that a review of the source turns up nothing suspicious:

https://github.com/ltrzesniewski/InlineIL.Fody

Yes, yes I do realise it is possible. Maybe you missed my subtle pointer:

Binary-only distributions, of Linux, or any other operating system depend on you trusting the organisation that provided the source for compilation, the compiler, and and the linker (and other things - think of "Reflections on Trusting Trust") as well as the firmware of the systems doing the compilation, etc.

There does exist a mitigation technique, as you are no doubt well aware: do an Internet search on the phrase "Diverse Double-compiling"

https://ieeexplore.ieee.org/document/1565233

https://dwheeler.com/trusting-trust/dissertation/html/wheeler-trusting-trust-ddc.html

[vegabook]

He says he's based in Moscow. Good luck enforcing a trademark over there...

More open source projects should base themselves in BRICS jurisdictions

[hf_139]

Time to burst your bubble:

https://www.nytimes.com/2022/09/14/opinion/international-world/china-espionage.html

https://warontherocks.com/2015/08/a-guide-to-chinese-intelligence-operations/

https://www.theguardian.com/us-news/2023/jun/20/china-nationals-expatriate-illegal-stalking-trial

https://www.propublica.org/article/o...in-plain-sight

I don't care about any of those.
How does it affect me if the Chinese spy on some US glowies who themselves try to spy on me?
I am all with China on this one.
Please Xi Jinping, destroy the NSA, thank you!