Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Security Experts Call For Boycott of RSA Conference In NSA Protest

Unknown Lamer posted about 7 months ago | from the how-to-add-yourself-to-a-watch-list dept.

Security 112

Hugh Pickens DOT Com writes "ZDNet reports that at least eight security researchers or policy experts have withdrawn from RSA's annual security conference in protest over the sponsor's alleged collaboration with the National Security Agency. Last month, it was revealed that RSA had accepted $10 million from the NSA to use a flawed default cipher in one of its encryption tools. The withdrawals from the highly regarded conference represent early blowback by experts who have complained that the government's surveillance efforts have, in some cases, weakened computer security, even for innocent users. Jeffrey Carr, a security industry veteran who works in analyzing espionage and cyber warfare tactics, took his cancellation a step further calling for a boycott of the conference, saying that RSA had violated the trust of its customers. 'I can't imagine a worse action, short of a company's CEO getting involved in child porn,' says Carr. 'I don't know what worse action a security company could take than to sell a product to a customer with a backdoor in it.' Organizers have said that next month's conference in San Francisco will host 560 speakers, and that they expect more participants than the 24,000 who showed up last year. 'Though boycotting the conference won't have a big impact on EMC's bottom line, the resulting publicity will,' says Dave Kearns. 'Security is hard enough without having to worry that our suppliers — either knowingly or unknowingly — have aided those who wish to subvert our security measures.'"

cancel ×

112 comments

Sorry! There are no comments related to the filter you selected.

money boycott (5, Interesting)

schneidafunk (795759) | about 7 months ago | (#45905975)

"'Though boycotting the conference won't have a big impact on EMC's bottom line"... not buying their products because there's a f-cking backdoor in it will.

Re:money boycott (5, Insightful)

Chrisq (894406) | about 7 months ago | (#45905983)

"'Though boycotting the conference won't have a big impact on EMC's bottom line"... not buying their products because there's a f-cking backdoor in it will.

That relies on your company having people who see security as more than ticking a box to cover them if something goes wrong.

Re:money boycott (2, Informative)

Anonymous Coward | about 7 months ago | (#45906263)

How ticking the bo "bought RSA product" could cover their asses now? If they were the only one to know about the backdoor, they'd could do it but now others knwo they know about RSA backdooring their product.

Re:money boycott (2)

Grishnakh (216268) | about 7 months ago | (#45906493)

Depends on the company. Lots of places will probably still happily spend enormous sums of money on RSA products, even though everyone knows they're backdoored. It's a big company, and as they say, "you can't get fired for buying from $BIG_VENDOR".

Just look at how many large corporations and governments continue to buy products from big, overpriced enterprise software firms, even though that software is all crap. Hell, look at how many companies still spend millions to license and use IBM/Rational ClearCase, even though it's a bloated, obsolete piece of shit that doesn't even support something as utterly basic as atomic commits, when you can download and use many different open-source version control systems for free which all work far better (and faster) than CC.

Rest assured, lots of places will continue to buy from RSA, no matter how obvious it becomes that that decision is idiotic.

Re:money boycott (1)

BobMcD (601576) | about 7 months ago | (#45907145)

This is doubly true because $BIG_VENDOR denied it. So if it were true that a backdoor did exist, you could doubly blame $BIG_VENDOR.

It's like ticking that box twice.

Re:money boycott (0)

Anonymous Coward | about 7 months ago | (#45909035)

There is a difference between "Software A is worse than Software B, but we're buying Software A anyway" and "Software A claims to do security, but in reality it doesn't. But we're still buying it."

Re:money boycott (1)

Grishnakh (216268) | about 7 months ago | (#45909205)

I don't see the difference.

Scenario A: "Software A is a horrible piece of shit that costs a fortune and is far, far worse than Software B, C, D, E, etc., which are all free (not to mention G, H, I, and J which are all expensive and proprietary but still far better than A), but Software A's vendor insists it's great so we believe him and we're buying it anyway."

Scenario B: "Software A claims to be highly secure, even though there's evidence that it's not, which has been aired by multiple reputable media outlets. Software A's vendor insists it's highly secure and the evidence is hogwash; we believe him and we're buying it anyway."

In both cases, the customer is believing the vendor despite much outside evidence to the contrary.

Re:money boycott (0)

Anonymous Coward | about 7 months ago | (#45909867)

I don't see the difference.

Scenario A: "Software A is a horrible piece of shit that costs a fortune and is far, far worse than Software B, C, D, E, etc., which are all free (not to mention G, H, I, and J which are all expensive and proprietary but still far better than A), but Software A's vendor insists it's great so we believe him and we're buying it anyway."

Scenario B: "Software A claims to be highly secure, even though there's evidence that it's not, which has been aired by multiple reputable media outlets. Software A's vendor insists it's highly secure and the evidence is hogwash; we believe him and we're buying it anyway."

In both cases, the customer is believing the vendor despite much outside evidence to the contrary.

If you're going to redefine the scenario to make yourself right, then of course you won't see a difference.

Hint, that bolded part? Did not exist in your original assertion. So I repeat, buying software that does its fucking job, even if there is software that does that job much better, is different than buying software that does not do its fucking job. Or put another way, buying software that does its job 10% as well as some other piece of software, is different from buying software that does 0% of the job it was advertised to do.

And just to clarify, I'm not trying to claim that the former is good, only that I would hope that "you can't get fired for buying from $BIG_VENDOR" would not be valid for the latter.

Re:money boycott (5, Interesting)

kry73n (2742191) | about 7 months ago | (#45906149)

boycotting the conference is the first step and will add to their reputation, companies not doing business is the natural consequence that will follow

Cheap (4, Insightful)

Anonymous Coward | about 7 months ago | (#45905977)

The only thing interesting about this affair is that RSA only got $10M.

Re:Cheap (0)

Anonymous Coward | about 7 months ago | (#45906467)

[...] the government's surveillance efforts have, in some cases, weakened computer security, even for innocent users.

You mean especially for innocent users?... The government does not target criminals, they are the criminals. Until heads start rolling, paranoia is only a reasonable precaution.

Re:Cheap (2)

alex67500 (1609333) | about 7 months ago | (#45906685)

The only thing interesting about this affair is that RSA only got $10M.

That we know about...

Re:Cheap (0)

Anonymous Coward | about 7 months ago | (#45908231)

I'm willing to bet that someone high up in RSA got caught doing something bad, and this was the pro quid quo for staying out of prison.

Re:Cheap (0)

Anonymous Coward | about 7 months ago | (#45910375)

More like entrapped into doing something bad. People think that the snooping program is about catching people doing something bad. It is more about figuring out enough about a person to understand how to entrap them. Those are the only kinds of terrorists the FBI are catching inside the US, the ones who aren't actually part of a terrorist organization, but get taken in by a sting operation. In other words, the ones who are guilty of thought crime. Having such good intelligence on everyone makes everyone extremely vulnerable to manipulation.

Re:Cheap (0)

Anonymous Coward | about 7 months ago | (#45908457)

Yeah, that aspect of this story has consistently bothered me, as well. What do they even do with $10m? Upgrade to extra-soft two-ply for a year?

Why aren't there any lawsuits yet? (1)

Anonymous Coward | about 7 months ago | (#45905995)

I don't know if they sold their products with some clever fine-print disclaimers, but shouldn't those who bought their products bring them into court and demand damage payments?

Or everyone in the industry has slept with the NSA so they don't want to set a precedent by suing RSA?

Re:Why aren't there any lawsuits yet? (2, Insightful)

Dunbal (464142) | about 7 months ago | (#45906031)

Kind of hard to build a case on hearsay. Prove they received 10M, and they will be sued into nothingness. But this is "he said she said" - ain't worth shit.

Reuters reported it. (4, Interesting)

Anonymous Coward | about 7 months ago | (#45906069)

Reuters reported that they did. [reuters.com]

Documents leaked by former NSA contractor Edward Snowden show that the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products, the New York Times reported in September. Reuters later reported that RSA became the most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal computers and many other products.

Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract.

So, who's going to sue them? And on what grounds?

Re:Reuters reported it. (1)

Darinbob (1142669) | about 7 months ago | (#45910591)

This is still hearsay. Where's the evidence other than Snowden's claims? Where are these documents, and who has validated them as authentic other than Reuters? Yes there's enough here to warrant an investigation but everyone's assuming they already know what happenened because of confirmation bias.

Re:Why aren't there any lawsuits yet? (5, Insightful)

TheGratefulNet (143330) | about 7 months ago | (#45906091)

you can defend them all you want.

at this point, anything that comes to light about NSA and shows them in a bad light, I will fully believe until THAT is proven otherwise.

given the reputation, it sounds more likely than not. we're seeing the true color of the 'security' industry, here, and its about time!

and anyone who defends the nsa or rsa, well, you've shown YOUR true colors, as well.

Re:Why aren't there any lawsuits yet? (1, Insightful)

Anonymous Coward | about 7 months ago | (#45906125)

Right on, brother! I, too, accept as fact anything that confirms what I already believe, and I too believe anyone who thinks different than me is a complete ignorant asshole with absolutely no worth as a human being. You, obviously, are an upstanding guy in my opinion. There needs to be more people like us in Washington to break all this partisan bickering.

Re:Why aren't there any lawsuits yet? (-1, Troll)

cold fjord (826450) | about 7 months ago | (#45906381)

at this point, anything that comes to light about NSA and shows them in a bad light, I will fully believe until THAT is proven otherwise.

In short, nothing has changed for you. That was true before the recent leaks, wasn't it?

Re:Why aren't there any lawsuits yet? (4, Insightful)

Grishnakh (216268) | about 7 months ago | (#45906573)

Not necessarily. Before the leaks, who really thought that much about the NSA and what it was doing? Maybe some of us really thought about it and suspected the NSA was spying on us all, but most of us were unaware; it just wasn't something that came up on our radar. Now that there's lots of evidence about what the NSA's been doing, including admissions from the NSA themselves (and a lot of nasty statements by NSA leadership about various people who oppose their spying programs), the onus is on the NSA to disprove any new allegations that arise. At this point, for me (and the OP I'm sure), the NSA has proven themselves to be completely untrustworthy, so for any new allegations against them, I'll choose to believe the allegations until the NSA can really prove them wrong. Why would I do otherwise? It's all about trust: without good evidence, you can only go on trust (and knowledge of what's really feasible; e.g., the NSA monitoring our thoughts by brain implants is obviously fantasy so allegations that aren't feasible like that can be dismissed). Since I distrust the NSA completely, I'll always believe the other side until they're proven wrong.

Much like everyone else on the planet... (3, Insightful)

Grog6 (85859) | about 7 months ago | (#45907185)

I agree; barring incontrovertible evidence to the contrary, the NSA will never be believed again.

Time to dismantle the entire operation and start over with new people; obviously none of these people understand what Domestic enemies are: People who are destroying the Constitution.

It is being destroyed because it is being ignored in the name of "National Security"; that bill of rights is so inconvenient for Despots.

They didn't need to repeal it; take a look around; they know there's nothing we can do about it.

Congress is likely being blackmailed into silence; in our society, everyone is guilty of something, are they not?

And here we always thought the "tinfoil hat" and gun nuts were just crazy... :facepalm:

Re:Much like everyone else on the planet... (1)

zlives (2009072) | about 7 months ago | (#45907937)

i am reminded:

"It is the certainty that they possess the truth that makes men cruel."

Re:Much like everyone else on the planet... (1)

Ash-Fox (726320) | about 7 months ago | (#45909457)

People who are destroying the Constitution.

Why would that matter when the U.S. is in a state of emergency and has been for ages now?

That's like you're trying to say "the Constitution" has some sort of power to begin with, it doesn't.

Re:Why aren't there any lawsuits yet? (1)

mcgrew (92797) | about 7 months ago | (#45908161)

Not only that, but James Clapper, head of the NSA, perjured himself before congress and was not held accountable. It's hard to trust a proven liar.

Re:Why aren't there any lawsuits yet? (0)

Anonymous Coward | about 7 months ago | (#45907415)

Boring pro-NSA shill is boring.

Re:Why aren't there any lawsuits yet? (0)

Anonymous Coward | about 7 months ago | (#45907327)

we're seeing the true color of the 'security' industry

That would be the colour purple, right? Must be, seeing as they're trying to fuck with everyone, especially through back doors.

Re:Why aren't there any lawsuits yet? (3, Informative)

kasperd (592156) | about 7 months ago | (#45907011)

Kind of hard to build a case on hearsay. Prove they received 10M, and they will be sued into nothingness. But this is "he said she said" - ain't worth shit.

Even if it can be proven that they received 10M$ and that they knowingly introduced the backdoor, it is hard to prove that the money was payment for introducing the backdoor. However, it might be sufficient to prove, that they knowingly introduced the backdoor. What payment they received for it, shouldn't affect the outcome of the case, because it is not the payment, which is hurting the customers, it is the backdoor.

Can we prove that RSA knew about the backdoor? Maybe not, but most likely it can be proven that given the knowledge RSA had, RSA should have assessed the algorithm to be most likely backdoored, at the time where they introduced it.

In cryptography it is generally accepted best practice, that any constant whose value isn't justified in some way, should be assumed to be a backdoor until proven otherwise. That is a principle, which RSA knows about. Additionally it has been public knowledge for many years that DECDRBG was relying on a constant whose value was not justified, moreover it had been formally proven, that there was a way to hide backdoor in that constant. It's like finding a smoking gun and saying we can't be sure anybody fired that gun, it could be smoking for so many other reasons.

The fact that DECDRBG uses asymmetrical primitives for a task, which is usually done with symmetrical primitives, is in itself suspect. Symmetrical primitives are usually faster, and there is a wide range of attack techniques that could be applied on asymmetrical primitives but not on symmetrical primitives. Good reasons for asymmetrical primitives is when you are working on a task, which cannot be done symmetrically. In the case of DECDRBG the introduction of a backdoor could not have been done symmetrically.

Re:Why aren't there any lawsuits yet? (0)

Anonymous Coward | about 7 months ago | (#45911063)

That's a nice -1, Troll you've got there. Pity no one will ever see it.

I don't think the full story is out... (1)

msauve (701917) | about 7 months ago | (#45906387)

From what I've read, it may be too quick to gang up on RSA. It sounds like they accepted a payment from the NSA to make Dual_EC_DRBG preferred/default, not to accept a backdoor.

The industry as a whole is responsible for accepting and adopting Dual_EC_DRBG. According to Wikipedia [wikipedia.org] , "Members of the ANSI standard group, to which Dual_EC_DRBG was first submitted, were aware of the exact mechanism of the potential backdoor and how to disable it, but did not take sufficient steps to unconditionally disable the backdoor."

It seems to me that RSA is just being made a scapegoat for an industry failure because they accepted a payment to make it the default (which would be perfectly acceptable if the NSA positioned it as payment to ensure wide acceptance of an improvement over the previous default). I've seen nothing to indicate that RSA knew about or was involved in creating the backdoor, or that it is any more culpable than the rest of the industry for its acceptance as a standard.

Re:I don't think the full story is out... (2, Insightful)

Anonymous Coward | about 7 months ago | (#45906509)

Standard or not, it's been shown, since 2006, that Dual_EC_DRBG is at best cryptographically flawed, and at worst backdoored. There have been better suited algorithms available and supported before, during, and after 2006. So how quickly did this security company update their software? When did RSA stop using a poor and vulnerable algorithm as the default? September 2013.
That's either incompetence or malice. Neither of which should be supported or trusted in a supposed "security" company.

Bad Analogy (4, Insightful)

Anonymous Coward | about 7 months ago | (#45906011)

As child porn wouldn't effect the customers bottom line.

This is more like Bernie Madoff hosting an ethics conference.... today.

Why not just recast the conference as a black hat/government contractor conference and show the tiniest amount of honesty.

Re:Bad Analogy (1)

qwijibo (101731) | about 7 months ago | (#45906429)

They could market it with a twist on google's "do no evil" motto:

RSA 2014 - All evil, all the time. F security, F US technology, and F YOU!

Re:Bad Analogy (-1)

Anonymous Coward | about 7 months ago | (#45906527)

RSA 2014 - All evil, all the time. Fuck security, Fuck US technology, and FUCK YOU!

FTFY. If you can't swear like an adult, don't even try. Fuck off.

Re:Bad Analogy (2)

qwijibo (101731) | about 7 months ago | (#45906605)

Swearing was implied, but I figured if someone at RSA wanted to own their evil, they'd want to jab at F-Secure for their vocal opposition.

"The researchers and experts who have pulled out include Mikko Hypponen, chief research officer of Finland-based antivirus provider F-Secure, and Adam Langley and Chris Palmer, who work on security practices at Google."

swearing? (0)

Anonymous Coward | about 7 months ago | (#45907727)

I thought Qwijibo was sending out grades.

Re:Bad Analogy (3, Informative)

DickBreath (207180) | about 7 months ago | (#45906571)

I agree. The child porn analogy is a bad one. If the CEO were found with it, that would make me think differently of him, but not necessarily the company itself. (Unless he had somehow created a culture of this throughout the company.)

What RSA has done is lose my trust in the company (which includes the CEO and the highest level decision makers in the company). Criminal personal actions of the CEO would only affect my perception of him and that he should be prosecuted -- and not necessarily the company if he had continued to make good business decisions on the company's behalf.

Re:Bad Analogy (1)

kasperd (592156) | about 7 months ago | (#45907155)

As child porn wouldn't effect the customers bottom line.

Is that the worst you can say about that analogy? How about this:

The actions of one person doesn't say anything about the company as a whole. Even if it is the CEO. If the CEO had indeed been involved in child pornography, the response from the company and its employees says more about the company, than the actions of the CEO.

But what is even more disturbing is coming up with involvement in child pornography as the worst a person can possibly do. How about murder? In my book that is worse than involvement in child pornography.

The analogy to child pornography sounds most of all like a sensationalistic statement aimed at getting attention. If you have a good point, you can get it across without resorting to such bad analogies.

Give this guys some cake (2)

cloud.pt (3412475) | about 7 months ago | (#45906015)

About time more americans started acting snowde-like. As in ballsy

Re:Give this guys some cake (0)

Anonymous Coward | about 7 months ago | (#45906041)

I agree, although America should be even more "ballsy", looking at the serious privacy implications of the whole NSA circus.

Re:Give this guys some cake (5, Insightful)

SirGarlon (845873) | about 7 months ago | (#45906115)

Privacy in America is complicated. The majority argument in the Supreme Court decision that legalized abortion, Roe v. Wade [wikipedia.org] , was based on a right to privacy. Since then (1973), the Republican Party has refused to accept that a right to privacy exists, because that would imply that Roe v. Wade is based on a sound principle and therefore abortion has to remain legal. This puts us in the unfortunate position of privacy rights being collateral damage in the culture war. Any Federal court nominee is going to get asked in his/her confirmations hearings whether there exists a right to privacy, and an affirmative answer means the Republicans will block that nominee. Most nominees prevaricate.

It's not the only reason privacy is a suppressed issue in mainstream American politics. Both parties have an authoritarian streak a mile wide (manifested in slightly different ways, so they can hate each other anyway) and privacy is the enemy of authority.

A lot will have to change before America is willing to make privacy a priority. What I find encouraging about Snowden's relevations is that it looks like enough people are talking about privacy that the issue might not crawl away to die again. Give it time.

Hmmmm (0)

Anonymous Coward | about 7 months ago | (#45906449)

So you are telling me that because of abortion the NSA is putting back doors in software?

Re:Hmmmm (4, Interesting)

SirGarlon (845873) | about 7 months ago | (#45906539)

Not quite. I am telling you that because of abortion, no one is willing to stop the NSA putting back doors in software.

Re:Give this guys some cake (1)

Anonymous Coward | about 7 months ago | (#45906555)

Holy shit, I never thought about that. Republicans are the real threat to privacy.

Republicans are the real threat to reason. (1)

Grog6 (85859) | about 7 months ago | (#45907233)

n/t.

Re:Give this guys some cake (0)

Anonymous Coward | about 7 months ago | (#45911187)

Correction - authoritarians are the threat to privacy. This type of thing comes from both "sides"

Re:Give this guys some cake (0)

Anonymous Coward | about 7 months ago | (#45908615)

If you think Republican leaders really care about abortion, I got a bridge to sell you. It's just pandering to the base.

Re:Give this guys some cake (1)

Obfuscant (592200) | about 7 months ago | (#45909409)

The majority argument in the Supreme Court decision that legalized abortion, Roe v. Wade, was based on a right to privacy. Since then (1973), the Republican Party has refused to accept that a right to privacy exists, because that would imply that Roe v. Wade is based on a sound principle and therefore abortion has to remain legal.

Your conclusion does not follow from your argument. The "right to privacy" is only one part of the abortion debate and even if one accepts the specific "right to privacy" that the court created to cover Roe V. Wade one can still be opposed to abortion.

Your assumption that Republicans oppose "the right to privacy" as a whole because they oppose the SCOTUS invention of a right to support federally funded abortion is also suspect. There is a fourth amendment that tells us what we have a right to be secure in that creates a significant right to privacy which is not questioned, only the "right to privacy" that results in the right to terminate a pregnancy.

Re:Give this guys some cake (4, Insightful)

Rosco P. Coltrane (209368) | about 7 months ago | (#45906051)

If all Americans started acting just a little Snowden-like, there would be another revolution in this country. That on the other hand is just some guy renowned in a very narrow, very specialized field, sulking.

It's better than nothing though - as the American public's response to the absolute outrage that is this whole affair has only been a big, fat, shameful nothing.

Re:Give this guys some cake (4, Insightful)

TheGratefulNet (143330) | about 7 months ago | (#45906109)

america's response is based on FEAR of the three letter agencies.

even congress is not above them, and if they can't get honesty from the org, how can we even hope to get a fair shake?

there won't be a revolution. the government has us locked up too much with fear and they also have more firepower and the fight would be horrible. no one wants that.

peaceful ways won't work and we can't use any other ways.

we feel helpless.

what are we SUPPOSED to do, when the world's biggest (and essentially only) superpower has us fully under its control? what exactly do you propose when the powerful hold ALL the cards?

fighting a less powerful government could be possible, but fighting the US government is not going to happen anytime soon.

I think people care but they feel utterly unable to do a single thing to fight it or bring about change. I'd love to hear what you think we COULD do, for real, that will have any effect.

Re:Give this guys some cake (0)

Anonymous Coward | about 7 months ago | (#45906375)

america's response is based on FEAR of the three letter agencies.

It is also pretty evident that the reason people want to keep their guns has nothing to do with wanting to have the ability to get rid of a corrupt government.

Re:Give this guys some cake (2)

Grishnakh (216268) | about 7 months ago | (#45906649)

what are we SUPPOSED to do, when the world's biggest (and essentially only) superpower has us fully under its control? what exactly do you propose when the powerful hold ALL the cards?

fighting a less powerful government could be possible, but fighting the US government is not going to happen anytime soon.

I think people care but they feel utterly unable to do a single thing to fight it or bring about change. I'd love to hear what you think we COULD do, for real, that will have any effect.

Who's "we"? American citizens, or citizens of other nations? If you're not American, the answer is pretty simple: shunning. You don't *have* to do business with American companies. Stop buying from RSA, Microsoft, etc. (esp. companies which most likely have NSA backdoors). Start buying from companies in your own country instead.

The US is a lot like the Roman Empire. Eventually, it collapsed because of excessive corruption and overextension. The same thing is going to happen to the US, it's just a matter of time. The process will accelerate if the economy collapses, caused by other countries not trading with them.

Re:Give this guys some cake (0)

Anonymous Coward | about 7 months ago | (#45906775)

Vote for somebody who isn't part of the R or D parties.

Re:Give this guys some cake (1)

bob_super (3391281) | about 7 months ago | (#45907265)

> what are we SUPPOSED to do, when the world's biggest (and essentially only) superpower has us fully under its control?
> what exactly do you propose when the powerful hold ALL the cards?

You mean the late 18th century British?

Re:Give this guys some cake (0)

Anonymous Coward | about 7 months ago | (#45908943)

Stop having children.

Re:Give this guys some cake (2)

mrchaotica (681592) | about 7 months ago | (#45906205)

It's better than nothing though - as the American public's response to the absolute outrage that is this whole affair has only been a big, fat, shameful nothing.

The American media's response to this absolute outrage has been a big, fat, shameful nothing, so most Americans still don't even know what's going on!

Re:Give this guys some cake (1)

LVSlushdat (854194) | about 7 months ago | (#45907107)

It's better than nothing though - as the American public's response to the absolute outrage that is this whole affair has only been a big, fat, shameful nothing.

What do you expect from what has become the defacto US Department of Propaganda? With little Jay Carney as Secretary.. He lies really good, but of course, he *has* to, to be able to cover up the lies his boss tells..

Re:Give this guys some cake (0)

Anonymous Coward | about 7 months ago | (#45910323)

If all Americans started acting just a little Snowden-like, there would be another revolution in this country.

If all Americans flew to Russia, we'd all be Russian.

Oh wait, what I said was stupid rhetoric.

Re:Give this guys some cake (0)

Anonymous Coward | about 7 months ago | (#45906101)

Run and hide?

Re:Give this guys some cake (1)

cloud.pt (3412475) | about 7 months ago | (#45907951)

Better than facing death sentence for actually doing a good thing, IMHO. The time of martyrs is long gone: we have attained a maturity level, as a species and a global society, which should prevent us from taking irrational action such as murdering people because they read the bible (North Korea) or they export an encryption algorithm to foreign countries (US). He just decided it was better to be labeled a false traitor than a dead one.

IF IT WERE NOT FOR SNOWDEN !! (-1)

Anonymous Coward | about 7 months ago | (#45906057)

We would be a lot better off not knowing this !! Would you rather know the boggieman is under your bed or the evil monkey lives in the closet or would you rather be blissfully unaware !! LIVE NOW IN FEAR !! Thanks for nothing SNOWDEN !!

This is worse than child porn (for the company) (4, Insightful)

Arrepiadd (688829) | about 7 months ago | (#45906089)

'I can't imagine a worse action, short of a company's CEO getting involved in child porn,' says Carr.

The CEO getting involved in child porn means his personal life is tainted and he goes to jail and hell and all that.
This is bad news for the company because people lose their trust on the company. No one needs to identify with the CEO of a company... but not trusting a company in the security field doesn't bode well for said company.

Re:This is worse than child porn (for the company) (3, Funny)

Alsee (515537) | about 7 months ago | (#45906403)

I'm going to have to disagree. A company's CEO getting involved in child porn would definitely be worse.

What sort of company has a child as CEO?

-

Re:This is worse than child porn (for the company) (1)

Jah-Wren Ryel (80510) | about 7 months ago | (#45906995)

> What sort of company has a child as CEO?

Most of them?

Re:This is worse than child porn (for the company) (1)

fatphil (181876) | about 7 months ago | (#45910187)

Well, I know one whose CEO only knew 4 words...

developers, developers, developers, and developers.

Surprised the nappy never fell down during his monkey dance.

Re:This is worse than child porn (for the company) (2)

ciderbrew (1860166) | about 7 months ago | (#45906441)

A CEO into child porn would have the top interest in software security. That's the type of CEO you need. Money isn't the motivation.

Re:This is worse than child porn (for the company) (1)

doesnothingwell (945891) | about 7 months ago | (#45907815)

I hate this thread but: Is the NSA worse than child porn? I think I taste vomit.

Re:This is worse than child porn (for the company) (0)

Anonymous Coward | about 7 months ago | (#45907141)

"I didn't do it, it was an NSA setup because I wouldn't play ball with them."

Not Guity, Case closed.

Has anybody seen the actual "evidence"? (1, Interesting)

Ronin Developer (67677) | about 7 months ago | (#45906133)

I asked this when this original story first broke headlines. There are allegations, but has anybody ACTUALLY seen proof they compromised security on the NSAs wishes for a paltry $10M?

When I attended the conferences back in the 1990's, the NSA was there...they even presented findings on the strength of DES and the need for a newer algorithm. Skipjack and Clipper, promoted by Al Gore, was the scare at the time.

Back then, licensing of the libraries (BSafe and TIPEM) came in two flavors - the low-cost Mom/Pop shop licensing (with 10% royalties paid on profits and $10K for a license to distribute and $250K+lower royalties for larger organizations. Being a little guy, the Mom/Pop deal made sense. Larger corporations would easily pay out $10M from royalties alone.

The licensing has since changed - probably because of the expiration of the RSA related patents. Perhaps, the new owners, EMC, felt that they should take the money (they are publicly traded, right?). RSA Labs was private in the past (and, had a reputation to uphold). It was well known at the time there were values that would make algorithms such as RSA and Diffie-Hellman and DES/3DES weak. Discussions centered on how to eliminate those weaknesses. EC was just coming into existence outside of the academic circles. Given source was available (for a price) and compilable, there was plenty of opportunity to examine the code for holes. The biggest, publiclly, known threat we knew of was when SecureId and SecureToken was compromised - that was admitted by the company. Too much money, particulary in secure systems design and certification was to be made - why build upon a loosely constructed house of cards?

So, did RSA/EMC intentionally weaken their products for a paltry $10M? Where is the proof, beyond circumstantial supposition, that this occurred? Can somebody point me to links showing this evidence? Or, is this conjecture based on documents that Snowden supposedly "leaked"? If so, how was the veracity and authenticity of these "admissions" proven? Is there a check, signed contract or ledger book showing the transaction(s) actually took place?

Sadly, so many in the security field will do anything to make a name for themselves - 15 minutes of fame. If there is real proof, then the call for a boycott and public raking over the coals is justified. I am asking to see the proof.

A bigger problem we, as consumers and businesses, are now facing are all the compromised wireless routers that was revealed last week. Given that the shutdown of Blackhole malware kit and no suitable replacement, we are seeing a rise of Ransom-ware. But, a single compromised machine on a wireless network behind one of these routers opened up the entire network - the attackers could access ANY machine without having to go through the originally infected host at will. We should be asking how THAT happened and insist upon inspection of the hardware and firmware by respected engineers and cryptographers (under NDA) for any critical parts or components sold for use in our routers. Their stamp would put their reputations on the line if an easily manifested exploit were found. And, did any of the companies selling products with these vulnerabilities know of the backdoors in their products? Just wondering.

Re:Has anybody seen the actual "evidence"? (4, Insightful)

Error27 (100234) | about 7 months ago | (#45906385)

The wikipedia entry is good on this:

http://en.wikipedia.org/wiki/RSA_Security#NSA_backdoor [wikipedia.org]

RSA has not disputed any of the facts but only argued that they did it out of ignorance. $10 million buys a lot of stupid. $10 million is peanuts for EMC but for RSA at the time, it was quite a bit [theregister.co.uk] .

Re:Has anybody seen the actual "evidence"? (5, Insightful)

hydrofix (1253498) | about 7 months ago | (#45906423)

I was also skeptical when I first saw the news articles (like this one [bbc.co.uk] ) that said that RSA had published a statement where they supposedly refuted the existence of that NSA deal. The existence of the deal was originally broken by Reuters in this article [reuters.com] , where they cite "two sources familiar with the contract" as their sources. But then, after more in-depth analysis of the RSA blog post [rsa.com] where they supposedly "denied" the existence of the deal, it was revealed that actually RSA neither denied nor acknowledged that such deal existed [techdirt.com] in their statement. They are just using general wording to give an impression, that they would certainly never do such thing. But they are not directly denying the existence of the deal.

Now, thinking logically, it's pretty damn clear that they would have denied that such a deal was ever made, if they were in the position of making such a claim. But given they don't directly deny the claims presented by Reuters, it would seem a much more logical explanation that the deal indeed was made, and RSA just went into damage control mode after the publication of the Reuters article. Lying to the public would have meant more damage if Reuters would have later been able to present the actual paper of the deal, so I suppose we can take their lack of directly denying this deal's existence as an admission of sorts. This is also the reason why speakers are canceling their appearance in the conference ("Your company has issued a statement on the topic, but you have not denied this particular claim." [f-secure.com] )

So, I think we have grounds to believe that there is actually quite much truth to the original story by Reuters. As they say, the deal was "handled by business leaders rather than pure technologists". I am pretty sure that this is a yet-another example of a major manager-level f*ck up. Tech companies very often have all the expertise on the technical personnel level, while managers are a "necessary evil" who often have much fewer insight into the technical field where the company actually operates. Of course, anyone with even the slightest idea of how the IT security field functions, would never ever endanger their company's credibility (at least for such little reward as $10 million), because deals like this tend resurface in the public sphere sooner or later. All we can assume that someone in the management made a very major f*ck-up and made this secret deal with NSA without much consulting from the technical folks. But I am pretty sure that now that this deal has surfaced in the public sphere, it will end up costing RSA a great deal more in lost sales than what the "business leaders" anticipated they could gain in short term from making the deal with NSA.

Re:Has anybody seen the actual "evidence"? (1)

chihowa (366380) | about 7 months ago | (#45907249)

The blame for this can't be kept entirely off of the techie's shoulders, though. While management may have made the deal and pocketed the money, management isn't capable of actually altering the product. At some point the product they shipped was made to be different than the product the technical side originally designed and it took cooperation from the technical team to make that change happen.

Re:Has anybody seen the actual "evidence"? (1)

hydrofix (1253498) | about 7 months ago | (#45907653)

That might be somewhat mitigated by the fact that the deal and the alteration to the software were done in 2004, but the first researcher analyses to hint of problems with this algorithm weren't published until 2006. When making the change, the developers were not necessarily told that NSA had paid RSA to use that algorithm. It might have passed as just another security improvement to the product.

Re:Has anybody seen the actual "evidence"? (1)

chihowa (366380) | about 7 months ago | (#45909789)

Good point wrt withholding the knowledge of the payment. Being paid to use the algorithm is certainly sketchy, but if the technical team received only the word that the NSA had advised they use a particular algorithm it could certainly seem like advice worth following.

Re:Has anybody seen the actual "evidence"? (0)

Anonymous Coward | about 7 months ago | (#45907567)

It was probably perceived by RSA as more of a mafia-style offer that couldn't be refused (whether the NSA intended to deliver it as such or not). I think RSA would rather take $10M with a little coercion than having the NSA find different leverage to put a backdoor in and not pay RSA a cent.

Who knows what info they had on the managers that approved the deal?

Re:Has anybody seen the actual "evidence"? (2)

Alsee (515537) | about 7 months ago | (#45906977)

Huh?

I'll break this issue down into three levels. First there's the compromised algorithm itself. The algorithm and source code for it is public. Anyone can trivially test that it's about a hundred times SLOWER than the alternative algorithms. It has zero redeeming features. And anyone with the slightest security knowledge can see that it was covered in huge red flags all over it (unexplained magic numbers pulled out of the algorithm-submitter's ass are a HUGE security no-no). It had squat track record of being vetted by the global security community for flaws. No one with the slightest security expertise would ever willingly use it, much less set it as a default algorithm.

Second, there's RSA's products. Anyone who bought it can check the configuration to see that the compromised algorithm is in there, and that it's set as the default. Anyone with an internet connection can do a search and check the product specs. I'll admit I haven't personally checked this detail, but it's beyond implausible that the story has run this long without anyone here posting a fact-check on it if it were false.

So that just leaves the third aspect. Whether RSA got paid twenty pieces of silver.... errr.... I mean ten million dollars....to set the compromised algorithm as the default in their products. I would say that is a forgone issue when RSA's response on the story was an astonishingly lame we-didn't-know-it-was-compromised and we-would-never-knowingly-compromise-our-customer's-security. If they hadn't been paid $10 million by the NSA to do, then the first words out of their mouths would have been to deny the $10 million NSA payment.

So that just leaves us with two possibilities. Either RSA knowingly took a $10 million payoff to look the other way and install a compromised back door as the default setting in their products, or they don't have a single competent security person on their entire staff.

It's hard to say which of those two possibility would be worse for a security company, but we don't have to ponder which applies here. It is utterly implausible that RSA doesn't have competent security experts on staff. They make highly sophisticated security products. They know damn well how to make products that will strongly protect you from attack by random hackers. However they are also willing to sell out your security so that the US Government has a back door into your system.

So... if you want top tier security products to protect your business and you don't give a hoot that it comes with a back door for US spook agencies, sure, go with RSA. They've got some of the top security experts. But if you want security products that don't come with back doors, there are other world-class security companies to turn to. World class security companies with world class security experts who, even in a drunken stupor, would neverselect an unproven absurdly slow ugly blatantly-backdoored random number generator to use.

-

Re:Has anybody seen the actual "evidence"? (0)

Anonymous Coward | about 7 months ago | (#45908501)

tl dr
The security hole is there, they know/knew about it, but kept taking money for it. Allegations that NSA may have had a hand in it hardly matter. They conned their customers for years, that alone is reason to boycott them.
Same goes for Microsoft and the other top shit companies that rely on security through obscurity to cheat people out of their money.

PS 10 mil might not be much for a company, but for a few individuals in position to change the code it's a lot, maybe a life time of paychecks.

Re:Has anybody seen the actual "evidence"? (0)

Anonymous Coward | about 7 months ago | (#45911327)

Sorry but after the bullshit these guys have been doing for the last few years, and the 100% patently false information they've been spewing in an effort to defend themselves, I 100% believe the submitter instead of NSA, no proof required. From now until the end of time, fuck the NSA and anything they have to say to defend themselves, ever. All of their credibility has been lost and will never be reacquired.

cold_fjord! (0)

Anonymous Coward | about 7 months ago | (#45906201)

No problem. cold_fjord will be there for their consolation

Security researchers toddling...? (0)

Anonymous Coward | about 7 months ago | (#45906227)

I applaud a boycott at this point, but I find the slow researcher withdrawal more than a little disconcerting. WHY?

It's been what, a couple weeks since the NSA funded backdoor announcement, right? We had 1 or 2 immediate withdrawal from researchers, but there wasn't a vast uproar of action in response to RSA, specificially with regard to their conference. There's been more coverage of the story, and more and more researchers and technologists are chiming in, but that initial reaction from the security field en masse was, well, rather impotent. I'm not saying they aren't right. Not at all. This is a wholesale stab in the back that RSA has committed, as far as I'm concerned. What is disconcerting, in my opinion, was that there wasn't an immediate 180 by security researchers with regard to the RSA conference. An IMMEDIATE reaction. Yes, I understand they want to, or need to, vette out the claims, since they are pretty damning. But this didn't just happen yesterday. I'm wondering what the pause is. Why the staggered complacency on the matter? Being vocal is one thing, and many a researcher has, and some even have done more. But, where is the widespread physical protest of this conference, and RSA, in the security field? All I'm saying is, from where I'm sitting, it's been a slow momentum for withdrawal from the conference. I keep saying the conference because, aside from not buying or using any product of RSA and EMC, or writing a scathing report online, what other form of protest do you have? I'm just a little disappointed is all. I figured the security field, when taken as an overall, the top teir folk, or majority of researchers were all on the 'same page' so to speak about their industry. I know reputations are everything in your field, but isn't this something you'd stick your neck out on? If it's not, at what point would you?

As a lowly IT Admin, I read these stories at arms distance. I now know, with 100% certainty, that keeping my systems up to date is no longer enough to keep out the intruders. Steps will be take beyond the norm for me, or perhaps, the norm is something else that I'll adapt to. Something that others, a very small number, have been implementing for quite a while. But my overall concern is that the response by the security field, beyond lip service and op-ed, doesn't give me confidence for the future security of our technology going forward. I hope this concern does not go unnoticed.

Re:Security researchers toddling...? (1)

wonkey_monkey (2592601) | about 7 months ago | (#45906561)

I find the slow researcher withdrawal more than a little disconcerting.

All depends what you're researching and who with.

Re:Security researchers toddling...? (1)

ZouPrime (460611) | about 7 months ago | (#45906715)

People go to these conferences for the networking opportunities, not necessarily because they care about the flagship product of the main sponsor.

Can they be sued... (2)

MitchDev (2526834) | about 7 months ago | (#45906271)

for not truthfully advertising their products as "Insecurity Solutions"

Missed point - off topic comment to follow (2, Interesting)

ka9dgx (72702) | about 7 months ago | (#45906347)

We're all running systems based on some derivative of Unix. The user based permission model was fine for 1970s computer science departments, but it's totally crap for the world we now live in. We all should be running systems that are at least Orange Book A1 level secure, but we aren't. The resources are available to do it, we could totally pump this out in a year or two in the open source world.... but we won't.

Everyone thinks they have secure enough systems... but they don't, not by a country mile. Nobody seems to understand that trusting applications to do their jobs, and not subvert the systems, is a stupid thing.

We have persistently insecure computing... encryption, even if done perfectly, doesn't help fix that.

Re: My off topic post (2)

BringsApples (3418089) | about 7 months ago | (#45906703)

Revelations of back doors are, as I suspect, limited - perhaps there are many more that we don't know of yet. And since that's the case, since people are more into making money than they are into making sense, then "computers" themselves cannot be "trusted". That doesn't mean that we can't use them as they are however. I'm not about to go off and learn what the shit "systems that are at least Orange Book A1 level secure" even means. I'm going to continue to use commercial software and hardware, because life's simply to short, and I only care so much about privacy - as long as I'm not being charged with some bullshit charge (and I have been charged with some bullshit charge in the past) that I cannot prove is a bullshit charge (I was able to prove that what I was charged with was total bullshit and it got thrown out), aka some terrorist plot or something like that.

"Computers" should be treated like girls that have a stinky vagina. There's obviously something wrong, but that doesn't mean that she's not cool to talk to, ask questions of, play games with.

Not a cipher... (2, Informative)

Anonymous Coward | about 7 months ago | (#45906479)

Not a cipher, but a pseudo-random number generator. Which means that every cipher, signature, or other algorithm that used random keys was compromised.

ok then, let's have it (4, Interesting)

BringsApples (3418089) | about 7 months ago | (#45906549)

What end-user products should one avoid in order to avoid this back door?

Re:ok then, let's have it (2)

mrjimorg (557309) | about 7 months ago | (#45907537)

The problem is that these products don't exist to large extent. The reason is that people are unwilling to accept any performance degradation in exchange for security. So, instead they use insecure systems, then they install 'anti-virus' which seeks to un-infect a system during/after an infection. This is like telling doctors "You don't need a hazard suit for that Ebola patient. If you get Ebola we'll give you some drugs". So, in order to protect ourselves we run virtual machines so that threats such as viruses are contained.
It's disgraceful that in 2014 we don't have secure operating systems. SE Linux is better than most, but not by much. If I went to you with a USB key and said 'run this on your SE Linux box, would you feel comfortable doing that knowing that your system is safe? Probably not.
If you want real security here is what you need:
1. A true microkernel that has been mathematically proven. This code would never change because it has been proven to be perfect. There is a field of CS/Math that allows for this. The only updates that would ever be needed for this code would be if the field of CS/Math allowed for more advanced features to be proven, and probably not even then.
2. Drivers and hardware must be assumed to be subverted and untrusted. Drivers would all run in user-space processes. No hardware or drivers may be allowed to access any resources that has not be assigned to them. Hardware DMA should go through a virt-phys translation that is set up to prevent access to any unauthorized areas of memory. This can be done using new virtualization extensions such as intel VT-X and ARM MR-IOV. This is because buggy drivers/hardware are the biggest security threat vector for exploits. However, I've seen issues in VT-X that allows a PCI device to lock out the entire bus which I consider to be a DOS failure.
3. Trusted Hardware. This is the soft spot in Intel's armor. There have been some publicly embarrassments for Intel in this field- such as a cache exploit that was a significant threat in certain circumstances, or the backdoor into TPM which invalidates it's only purpose. If a company were to release a version of the ARM processor that has undergone provability in same way that software can be proven they may be able to create a secure processor that is guaranteed to not have issues to exploit.
4. A layered security approach. None of this "I to become root now, so I'll use su root". You should start in a root container that has access to the entire system within which a subcontainer would be created for what you as a user can access. Within that you can create subcontainers, each of which would have even more limit access than their parent.
I should be able to create a container that has no access to the network, or to the disk, etc
My document editor should only have access to my Documents directory
I should be able to create a container within which none of my secure files are accessible (my passwords file, my tax docs, etc). In Linux any program I run can read any file that I have permission to access- this is totally unacceptable!
5. Visibility - the difference between malware and useful software is whether the user wants that program to be doing what its doing. When I look at my Linux system I see hundreds of processes and I don't know what many of them are doing. Any of those programs could be malware and I wouldn't know the difference. We need to have a better way for users to really see what's going on in your system and what resources are accessible to which programs. For instance:
You should be able to see which programs have access to the keyboard events. This would immediately tell you if you have a keylogger
You should be able to see which programs have access to which parts of your harddrive, and what they are doing. Can't tell you how many times I've heard my HDD spin up without any idea why. It sends a chill up my spine every time
You should be able to limit which ip addresses a program can access and which protocols it can use. No more 'call home' programs- even if your browser was exploited.
Secure computing has great potential. If we did have truly secure systems and we knew that our systems were immune to these issues then you can image having web browsers that could download and execute native code. However, now we have java as a virtual computer to provide us security and even then it doesn't really protect us because bugs spring up in the optimization process and put us at risk. Additionally these java programs have very course limits on their security. I dream of a day when systems are so secure we don't have to worry about it anymore.

Re:ok then, let's have it (1)

Anonymous Coward | about 7 months ago | (#45909069)

This sounds like the HURD, the design principles of which seem to me possibly better than the current monolithic approach of the Linux kernel. Is the HURD the closest (free software) thing we have to a solution like this?

Re:ok then, let's have it (1)

mrjimorg (557309) | about 7 months ago | (#45909563)

Honestly, I think Qubes is a better match. Although, last time I looked at HURD there were no virtualization extensions

not showing up? Really? (1)

slashmydots (2189826) | about 7 months ago | (#45906557)

No way, go there and freaking trash the place. Go all "occupy" on them or plan silly string attacks or flash mob protests in the middle of presentations. THAT would send them more of a message than slightly lower than average attendance.

I'll do my part (0)

Anonymous Coward | about 7 months ago | (#45906681)

I'll do my part, I will not be there. (Wasn't going to be anyway, so I was planning ahead!)

Boycott won't work (1)

Anonymous Coward | about 7 months ago | (#45906823)

Those security conferences are packed with government contractors that know better than to bite the hand that feeds them.

Is it much of a stretch..... (0)

Anonymous Coward | about 7 months ago | (#45907859)

... to believe that, due to NSA intrusion, supposed 'secure' devices and systems are easier to hack into by the criminal element? A company manufacturing a product that the NSA has paid for a 'backdoor' in could also use that insecure code in other products. As an example - the Target point of sale hardware that was hacked. Could a weakness from another product also be in these devices? If that is the case - would you go as far as to say the NSA is liable for the losses?

Discounted, surplus tickets available for 50% off (1)

Supp0rtLinux (594509) | about 7 months ago | (#45908057)

So in summary, there's discounted tickets available now...

Stupid, stupid, stupid. (1)

eyenot (102141) | about 7 months ago | (#45908625)

Uh, hello pinhead. HELLO PINHEAD!

NOT going to the conference is EXACTLY what the NSA wants you to do!

If you DO go to the conference, then you get to discuss the issue with like minds and with the source of the issue.

If you "boycott" the conference, trust me, there's already a prepared script for handling that "quote" "contingency" "quote".

I would have some serious questions for whomever first pitched the idea of boycotting the conference as some kind of political statement. Can it be traced to a person or circle of people? What is / are their identity(ies)?

Re:Stupid, stupid, stupid. (1)

bill_mcgonigle (4333) | about 7 months ago | (#45910117)

Can it be traced to a person or circle of people? What is / are their identity(ies)?

IIRC, the head of R&D at F-Secure.

99.9% of this industry serves the NSA (0)

Anonymous Coward | about 7 months ago | (#45909281)

The scum drawn to this conference LOVE the fact that the NSA budget has exploded over recent years. They are the worst kids of Human parasites willingly feeding on the horrific abuses unleashed by Team USA and Team Blair.

For every individual in the IT security businesses that PRETENDS to have a conscience (be in no doubt, the boycotters are merely indulging in a reputation ploy), thousands simply throw themselves at any opportunity to serve the massively expanding full surveillance initiatives. Each of them hopes they might one day be in a position where NSA people offer them hundreds of thousands of dollars to help author back-doors into the products sheeple stupidly trust.

The ONLY reason RSA is drawing opprobrium is because of the crude and clumsy methods RSA used in serving the NSA, bringing the whole project into disrepute. Those in the security business EXPECT companies as well placed as RSA to fully implement PLAUSIBLE DENIABILITY constructs, so sites like this can imply that the RSA was wholly innocent. The team for which the owners of Slashdot so willingly bat for, do not like it when entities on their side screw up so badly, that reputation management is almost impossible.

Even so, the owners of Slashdot have repeatedly promoted stories implying that RSA is 'innocent', no matter how laughable that suggestion may be. Even in the face of cast iron proof, FUD campaigns, as the owners of Slashdot well know, always manage to influence the thinking of a good number of the type of betas who hang around sites like this one.

Anyone moronic enough to continue supporting the system that abuses them, by voting, is likely to fall for the old "give them the benefit of the doubt" ploy.

Sadly, in so-called professions, people will always go along with 'the money'- even doctors in the USA will willingly work against the interests of their patients, if by doing so their pockets are sufficiently enriched. And IT professionals consider their 'moral' duties lie way, way, way below those of doctors. This fact is why, when you allow your system to be absolutely corrupted at the top, it cannot be 'repaired' by relying on the morality of people lower down. Humans, by and large, assume they will always work to lower moral standards than those found in people they perceive to be above them. Open corruption at the top is thus a complete cancer.

And it gets worse. The extremist zionists that own Yahoo recently served malware designed to exploit Java weaknesses to 2 million plus users outside the USA. The malware operates on behalf of the usual zionist crime gangs in the Ukraine vicinity and Israel. However, Yahoo, courtesy of its well-appointed 'family' friends in the USA and Europe, is above the Law, and faces no legal sanctions whatsoever. This is how blatant they are.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>