Introduction ∞

I want to try to describe the chain of trust with Linux distributions and their applications to better understand points of failure.

Many eyes ∞

The "many eyes" concept: The notion that when something is open that many eyes can examine it.

When given a choice, most people will assume faith in another. Group and crowd psychology has a lot to say about the decision making processes in this circumstance.
The curious will often delve into something even to an extreme degree.
People who have insight (a specific skill and understanding) will often find that they perceive related things without trying. For example, someone who is in the movie special effects industry will pick out effects when they watch a movie. Because of this effect, it's likely that someone who is "in the industry" will pick things out during regular use.
The combination of curiosity and insight exists in some who review a particular item.
Expert groups, when tasked to review something, are definitely given a better chance under circumstances that allow many eyes. Think security audits.

Your eyes: Assuming you have expertise and experience your examination has worth.

Do you have the time and skill to audit your software? How much of it? Could you miss something?

The kernel authors
Every individual application author
Distribution and packaging authors
Package management software authors
Your own and other eyes
- experience and understanding
- time and thoroughness
- human error
Auditing ability and reporting

Data must be transmitted, stored and retrieved. These things offer many opportunities for flaws.

Transmission: All data can be manipulated by ones ISP and possibly others. There is no way to detect such manipulation.

Avoiding this problem requires hardening the connection between transmission/reception and storage.

Storage: Data can be manipulated while in storage. Physical access can alow tampering.

The data and all access to it must be secure. This means physical location security and data security.

Kernel channels
Application channels
Distribution channels
Package channels
The source/destination ISPs, all channels in-between, all who have or can get access to the channels
- Switzerland -- An open source software tool for testing the integrity of data communications over networks, ISPs and firewalls. It will spot IP packets which are forged or modified between clients, inform you, and give you copies of the modified packets.
Physical location security
Devices used for storage or transmission

Hacked?

100% of everything on the system must be assumed to be compromised.
While "cleaning it up", assume the system is automatically healing itself.
While "updating it", assume the system is transparently undoing your fixes.
Heck, when remotely connected.. assume 100% of everything you see is a little virtual machine that has nothing to do with the real system.
While "monitoring it" assume that it's spoofing all reports.

Last updated 2018-10-24 at 02:47:07