Re: FOSS and backdoors in the US

Stefan Claas <pollux@tilde.club> wrote:

Rich wrote:
 

Stefan Claas <pollux@tilde.club> wrote:

 

If I would be forced, which I doubt, I would comment the code with
something like this:
 
// backdoor begins here
 
backdoor code
 
// backdoor ends here
 
and put in the README how to exchange that code with proper one.

 
Likely would not work well.  Such forcing would likely also be
accompanied by a gag order preventing you from admitting the
backdoor even exists and so such comments and readme text would be a
likely gag order violation that would land you in jail.

 
Well, I gues this may only apply to big FOSS projects,

Your prior post did not specify FOSS vs. closed source.

where they can force teams, or an individual team member, but not the
millions of FOSS programmers out there.

We might like to think there are millions of FOSS programmers, but
reality is more like this XKCD than we want to believe:

https://xkcd.com/2347/

Another option for folks, living in West-Eurasia, might be to handle
over the correct code to people in BRICS countries and publish it
there.

In essence, that is what happened with PGP, and was in part what led to
the US govt. giving up on their "crypto export bans".  You should be
able to find an article on the history on the web if you want details.

We should also not forget that Democrats (back then Senator Biden),
in the U.S., started the Crypto War ...

Yes, and worries of inserting backdoors have been around since prior to
that time.  Some that ultimately turned out to appear to be unfounded
(the worry that the NSA's tweak of the DES s-boxes was a hidden
backdoor, years later it turned out the tweaks increased DES's
resistance to differential attacks).  Others were more explicit
(clipper chip, which explicitily contained a "govt. backdoor").