paranoide

[farmer.ro]

i watched speeches of Jacob Appelbaum exposing the NSA and it left me a few questions regarding Gentoo security;

Question: how can we know for sure that the NSA is not spying on us while using Gentoo, when the NSA seems to have the power to pwn tools like AIDE or Wireshark

Question: it seems to me when using for example Debian it is much easier to wipe the entire disk and do a fresh install within 30 minutes, in contrast Gentoo install might take 1 or 2 days. does this leaves Gentoo more vulnerable to attacks from the NSA

Question: is it possible that the NSA got employees in the GNU/Linux software development team and might program software with malicious tools

how can i maintain anonymity ?

[Maxxx]

[farmer.ro]

if there are 10 vulnerabilities that we know of there might actually be 15, so lets reduce it to 5

what i am trying to say is if you get a possible webkit exploit or any other kind of attack then wiping the disk and do a fresh install lets say once a week which only takes about 30 minutes, reduces the chances of a compromised box, in contrast where the installation takes 2 days and wiping the disk once a week is not really worth the installation time

i hope someone can answer my other questions

[Maxxx]

Ah ok...

For your question i can't answer... i don't know.

[NeddySeagoon]

farmer.ro,

Its no comfort but we can't be sure. Gentoo is no worse that any other distro in this regard.

Consider the following Gentoo comprises only Portage and the Gentoo ebuild repository.
All the applications that you choose to install are $UPSTREAM. Wit a few patches here and there, $UPSTREAM is the same for everyone.
That's a little bit of a simplification - in Gentoo you get to choose ow your packages are built, so you might get lucky and configure security problems out.

As for wiping the HDD and reinstalling, do you really need to rebuild everything?
You only need rebuild vunerable packages. The rest can be reinstalled from your saved binaries, unless you believe that they have been compromised too.

Can you trust $UPSTREAM not to include exploits?
Absolutely not. That's why security is like the layers of an onion. You make it difficult for an attacker to get in, difficult to do anything useful if they do got in and difficult to phone home.

Your firewall makes it harder for things to get in. You know why you are running listening services and on what ports. Everything else is blocked
You don't run a half open firewall either. Only things you want to use are allowed out.
You may run a hardend system (not SELinux). That will stop several classes of exploits.
You can try Tinhat Linux. That runs entirely from DVD. No hdd access at all.
You monitor your logs for nasty things.
Add in tripwire to keep checksums of installed files (on RO media)

The more layers you add to your security onion, the more the security intrudes into your day to day use of your install.
You have to determine the threats you want to defend against and deploy security you are happy to work with.

Oh, you won't be targeted by a government.
Its much easier for a government to extract your pass phrases from you directly by sending the boys round.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[Maxxx]

[fedeliallalinea]

[Maxxx]

Android smartphone has Dirty Cow bug, SELinux isn't secure...
It will be that the safest is the "old" Windows?

[Ant P.]

[Hu]

[59729]

[jonathan183]

[Maxxx]