Re: [gentoo-amd64] "For What It's Worth" (or How do I know my Gentoo source code hasn't been messed with?)

[Max Cizauskas]

Hello all,

I've been very interested in this topic myself, so I'll pile on my 
question after answering one of Mark's

<Snip>
On 05/08/2014 1:50 PM, Mark Knecht wrote:
> I'm sitting here writing R code. I do it in R-Studio. How do I
> know that every bit of code I run in that tool isn't being sent out to
> some
> server? Most likely no one has done an audit of that GUI so I'm trusting
> that the company isn't nefarious in nature.
>
> I use Chrome. How do I know Chrome isn't scanning my local drives
> and sending stuff somewhere? I don't.
>
> In the limit, how would I even know if the Linux kernel was doing this? I
> got source through emerge, built code using gcc, installed it by hand,
> but I don't know what's really there and never will. I suspect the kernel
> is likely one of the safer things on my box.
>

The answer to most things security related seems to be independent 
verification. If you're going to be the person to do that verification 
because you don't trust others to do it or can't find proof that it's 
been done, then there are two factors at play; time and money.

Where you're only running your own traffic through your system (unlike 
Duncan's TOR example) this is relatively easy and cheap to accomplish. 
For ~$100 you can buy a consumer grade switch with a configurable 
mirroring port which will effectively passively sniff all the traffic 
going through the switch. You then connect this mirrored port to a spare 
junker computer running optimally a different distro of linux like 
Security Onion or anything else with TCPDump capturing full packet 
captures which you can do analytics on. I do the same for my home 
network to detect compromised hosts and to see if I'm under attack for 
any reason. Things I find useful for getting a finger on the pulse are:

  - DNS Query monitoring to see who my home network is reaching out to
  - GeoIPLookup mappings against bandwidth usage to see if lots of data 
is being slurped out of my environment
  - BroIDS, Snorby and Squert (security onion suite of tools) for at a 
glance view of things going wrong and the ability to dig into events quickly

My question is what kind of independent validation, or even peer review, 
is done over the core of Gentoo? Now that new users are being pushed to 
use the Stage3 tarball and genkernel, is seems to me that much of the 
core of the Gentoo system is a "just trust me" package. What I love 
about the Stage 1 approach is you get all the benefits of compiling the 
system as you go, essentially from scratch and customized for your 
system, and all the benefits of the scrutiny Duncan mentioned applying 
to ebuilds is applied. There is much more control in the hands of the 
person using Stage 1, and it's a smaller footprint for someone to 
independently validate malicious code didn't get introduced into it. 
Should someone have been manipulated to put something malicious into the 
stage3 tarball it could much more easily give a permanent foothold over 
your system to a malicious 3rd party (think rootkit) then stage 1 would 
allow.

Thanks to anyone who can provide light on the topic,
Max