Hi Elias,

<p>

I'd like to point out a few problems with your comment.

<p>

The Gauntlet firewall published by Trusted Information Systems was not an

Open Source program. It's what we call "disclosed source-code", and that's

very important because that difference means that nobody had much reason to

read it or work on it. The software license didn't provide them any incentive

to do so - you would have only been fixing bugs in a program that somebody

else has an exclusive right to sell. Who wants to be the unpaid employee of

another company? With real Open Source, you have the same right to sell the

program as anyone else, or to distribute it for free, for that matter, and thus

you aren't some company's unpaid dupe. For an explanation of what Open Source

is, see <a href="http://perens.com/OSD.html">The Open Source Definition</a> .

<p>

At the time of the Morris Internet worm, the BSD software distribution of which

Sendmail is a part was under a restrictive license and required an expensive

ATT Unix license before you could get the system. This is also not what we

today know as Open Source. Besides, you are writing about the epochal Internet

virus, and few people even considered Internet security before that event.

<p>

Yes, all compilers have a bootstrap problem. One can avoid it by compiling the compiler with another compiler, once in a while, and then compiling the result with itself. This method can also be used to <i>detect</i> the Trojan: compare the generated executable with one that doesn't have another compiler in its heritage - if there's a significant difference, look for a Trojan there.

<p>

Most users do not compile their own applications, but they get them

from a trusted source who has compiled them and cryptographicaly signed

them. You might not be aware that in all Linux distributions of any

import, the packager does compile all programs. If there is a trojan

slipped in, you can trace it to the person who compiled the program and

bring charges if necessary.<p>

And what good would it do anyone to grep through source code for strcpy()? We've already done that ourselves, and have fixed obvious problems.<p>

Sure, it's no <i>guarantee</i>, but it's much better than the alternative, which lets Microsoft embed snide comments (if they really <i>aren't</i> trap-doors, embedding a trap-door would be as easy) in their software and have them undiscovered for years.

<p><blockquote>

Thanks

<p>

Bruce Perens

</blockquote>

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/19/1388#1388