Re[2]: KDE was hacked

[3APA3A <3APA3A () SECURITY NNOV RU>]

Dear Seth Alan Woolley,

--Saturday, May 8, 2004, 2:14:49 AM, you wrote to full-disclosure () lists netsys com:

SAW> Anybody using a CVS build of KDE is taking an inherent risk for such
SAW> things as this.  Anybody using an official release would of course have
SAW> a plethora of people reviewing each commit.  It only took them 1.5 hours
SAW> according to the Russian article to spot the code comments.  I'd say the
SAW> KDE team passed with flying colors.

It's  always  possible  to  insert "backdoor" into code in a way it will
probably  never  be  caught during audit, if code is rather large and is
not  perfectly  styled.  It may be a call to wrong function in a case of
some  race  conditions or another "unexpected" situation - things almost
impossible  to  catch  for  a  person  who  didn't  wrote this code from
beginning.  It's  true for both open source and commercial software, but
commercial  developers  at  least have signed contracts. Any exploitable
bug  found  in software could actually be a backdoor. It's a question of
trust.

-- 
~/ZARAZA
ЭНИАКам - по морде!  (Лем)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html