From owner-freebsd-questions@freebsd.org Sun Jan 27 19:47:49 2019 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1F06B14BAA4E for ; Sun, 27 Jan 2019 19:47:49 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from mout.kundenserver.de (mout.kundenserver.de [217.72.192.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "mout.kundenserver.de", Issuer "TeleSec ServerPass DE-2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 56CCC81923 for ; Sun, 27 Jan 2019 19:47:48 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from r56.edvax.de ([92.193.226.69]) by mrelayeu.kundenserver.de (mreue109 [212.227.15.183]) with ESMTPA (Nemesis) id 1MqrsF-1hahos2dwP-00mtEq; Sun, 27 Jan 2019 20:47:43 +0100 Date: Sun, 27 Jan 2019 20:47:42 +0100 From: Polytropon To: Valeri Galtsev Cc: freebsd-questions@freebsd.org Subject: Re: Wireless interface Message-Id: <20190127204742.f558599b.freebsd@edvax.de> In-Reply-To: References: <20190126213957.adfeb61c.freebsd@edvax.de> <5C4CE8B8.4030608@gmail.com> <20190127013705.3e8cd5f3.freebsd@edvax.de> Reply-To: Polytropon Organization: EDVAX X-Mailer: Sylpheed 3.1.1 (GTK+ 2.24.5; i386-portbld-freebsd8.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K1:aegzpcRSMK5BI1stwZSEguK2fdJttAB6gPbluKNFD7pf8OgoUyb zBxS4itBvw23tAc1XBIvFbBlN4FpOKcVOu8uVbyV0J2bxL3F21vXucnSIQcgyqyBYigggEi 1SbNzX4Gdxmer1TmbNltnqWpfOlMVvYEdeu6SfHmZ+YiGGJ3qSEHqntEM11kkXN7F9kxsGb UWb6M4jq08HTvLkRwMbZg== X-Spam-Flag: NO X-UI-Out-Filterresults: notjunk:1;V03:K0:pdNsJGRXmE8=:4Da8y1AZBNA6uul7H2NIqd gIylPbOKaTxDCQKcMSI9SbVMX+/qCzYSLgWykMNfolk1Doo5A9fyLv5Z+AiwJmurIdBGYUmaB BP2Rxvj7Bn5AUmR1dfNFhawbIAazEoe9qI6hgRafuoAUIJu0+AQ4lF9FrDnz3jzPMgSQ7a5YA 7b8CZyOl9Phka6AcVHc3D0CEpcwpfx9feMt2JTcN+OrhygO9nfWQVLzN1y9HsmXs39Yl5fv/M eqNRkk/cdLrQ6Zv4/S1ZcXDI73jcYyzFNkMciyNfDRvhndugdFsX+sPkwEHEJkNSCkaLWWOpM jvx5FvJZuZYdrYuajdrbQUgYW/raFECHIOapWl64tjunNcQO0aDHTz2Wg1PpAKTYTScIoZi4F KlInIXoTaDPG8/Fmzez0VGfkd599HOIEtLqxL3B0xCYHzwB1Q8+GLfzw5BkizuzoNU+smraWl 9LLLED7els1hL8GFi3ODcnvF4Ek2lR4s9Khi+pEF7yBzePJOdByyFlJKGXsI7Hbkpne+a0HjF FhKMiq5hW93YryOL6RjiAt8xkpRz32qLpaoIjQGJpKDt6x9gDYn7ZRD2OX1QNmTdoWbT7/cgX g/OuDYAfNGIoYMJOfouPHxP21v/VXbRmWmZeOIeAm8Wp+SUTaWoniexJlH2hQTpo2NdjZO/x2 z/Nf+s2CJdf/ivnh05P2iaL2dPR6p2w0i0d/O2q+/UouTJ1TWvAiOwyYKxVvmB3csfg2xuQui gLgLdCNmklJGsVxxqgFiUuDWrJhvgGaD5rFvzoRP26Hs8SvNLqVlxEp+OXA= X-Rspamd-Queue-Id: 56CCC81923 X-Spamd-Bar: ++++ Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [4.21 / 15.00]; RCVD_VIA_SMTP_AUTH(0.00)[]; HAS_REPLYTO(0.00)[freebsd@edvax.de]; TO_DN_SOME(0.00)[]; MV_CASE(0.50)[]; HAS_ORG_HEADER(0.00)[]; MX_GOOD(-0.01)[cached: mx01.schlund.de]; RCPT_COUNT_TWO(0.00)[2]; RECEIVED_SPAMHAUS_PBL(0.00)[69.226.193.92.zen.spamhaus.org : 127.0.0.10]; RCVD_TLS_LAST(0.00)[]; R_DKIM_NA(0.00)[]; ASN(0.00)[asn:8560, ipnet:217.72.192.0/20, country:DE]; MIME_TRACE(0.00)[0:+]; FROM_EQ_ENVFROM(0.00)[]; ARC_NA(0.00)[]; REPLYTO_EQ_FROM(0.00)[]; FROM_HAS_DN(0.00)[]; NEURAL_SPAM_SHORT(0.84)[0.836,0]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[edvax.de]; AUTH_NA(1.00)[]; NEURAL_SPAM_MEDIUM(0.36)[0.362,0]; TO_MATCH_ENVRCPT_SOME(0.00)[]; NEURAL_SPAM_LONG(0.65)[0.654,0]; MID_CONTAINS_FROM(1.00)[]; RCVD_IN_DNSWL_NONE(0.00)[73.192.72.217.list.dnswl.org : 127.0.5.0]; R_SPF_NA(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; IP_SCORE(-0.03)[ip: (-1.85), ipnet: 217.72.192.0/20(-0.45), asn: 8560(2.17), country: DE(-0.01)] X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 27 Jan 2019 19:47:49 -0000 On Sun, 27 Jan 2019 11:14:40 -0600, Valeri Galtsev wrote: > I 100% agree with Polytropon, and would just add one simple point: > FreeBSD is open source system. Everyone in the World can (and some/many > do) go and audit the code for backdoors and/or vulnerabilities. It's not that the code of "Windows" or closes-source programs in general won't be audited. But this process is not public. Auditors have to sign an NDA, and there usually is no real indication of _that_ they performed an audit, and _what_ they found out. The primary reason is "trade secret". We know that "security by obscurity" just doesn't work. :-) You need to have trust both in the makers of the software and in the auditors. You cannot buy trust. And especially when they didn't properly do their normal work, and then "surprisingly" something happened, and the public got knowledge about it - instead of admitting the mistakes, adjusting their processes accordingly, and tried to do better next time, they increase prices and shove money into more aggressive marketing and ads, _then_ you know exactly what their priorities are, even though their web site claims "we value your privacy" or "we care for our customers"... Oh, and people still give them money. It's far easier if it's tax payers' money, so no more annoying questions. :-) > To the contrary to > proprietary systems which not only hide the source, but also will do all > to put you in jail if you reverse engineer (disassemble) their binary > code and attempt to publicize spy part if you discover one. On the other hand, there is a market for especially 0days which governments and their spy agencies are interested in. Law also mandates or at least encourages backdoors and bypasses, so if a company wants to do business in a given country, they will surely follow those... suggestions... > Of course we all learned mathematics, and logically it is difficult to > prove FreeBSD does not have malicious code. However for those who claim > an opposite: that FreeBSD does have malicious code in it, it is very > easy to prove their point. It is sufficient to point to one of them. If > one can not point even to single malicious chunk in FreeBSD, one > shouldn't insist there is one. It's also a fact that just because you pay money, you don't get good software, where "good" means about every aspect that one can be interested in: reliable, fast, secure, maintainable, and so on. You can find similar problems everywhere where software plays a significant role, not just PCs, but also appliances, NAS, routers, switches, WLAN modems. Manufacturers don't care because of three reasons: 1. "Good" (see above) costs money. Especially security does not generate an immediate gain, but is expensive to do right. 2. There is an EULA ("you sign by switching on" or "you agree by opening the box") that delegates all risks and troubles to the user - and far far away from the manufacturer. 3. The customer already handed over the money, so what? Brand NAS with hardcoded password bypass, anyone? ;-) -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...