While that's sound advice, I do have a question - do you scour the source code to every app you download, compile, and install, prior to doing so? If so, you must not run any X server - it took me about 50 hours to get my P4-3.2GHz processor to compile KDE 3.3, nevermind actually having me, the human, try to read and comprehend it!

At some point, you need to decide who to trust. Big, well-known companies are one thing, but who's to say that something you downloaded off SourceForge doesn't have some back door in it, in plain sight? Especially if you download the tarball, and the tarball doesn't match what's in CVS, it can get difficult to prove later if the project becomes big.

Paranoia is just paranoia if it's also impractical. ;-)

Well that is why I said.."coming from a big company or organization". We are all taking chances when we run a complex operating system, which we don't fully comprehend line by line. But that is the benefit of "Open Source Software". I am fairly confident, that some geek somewhere, will discover abnormalities if they can be discovered. If they can't be discovered, then we at risk. There is no gaurantee of computer security.

We are all at the mercy of the c libs. How do we know that the NSA isn't "grooming and promoting college professors" who are willing to hide a few special complex backdoors, who will have expalnations to cover up the secrets. Maybe there are a few geeks out there, who have discovered them, and all their posts are reflected back to them, (so they think they are getting out), but in actuality are deleted and never seen by the world?

All you can do is be "diligent". I don't use KDE. Before I compiled and installed Xorg's X Server, I googled for comments about it, and I watch my system for suspicious files and sockets opening. So far, it seems clean.

When I was starting out, I trusted the big companies like SuSE to do the checking and compiling for me. But as you know, all the big distros are now being bought out by big corporations. Since I know that the big corporations are the "hand-maidens" of the military industrial complex, I have become more suspicious about the "complexities" which they introduce to linux. Now I pretty much run a "linux from scratch" installation.

The nice thing about linux, is you don't have to run as root, so you can run things as a "low-priviledged user" and see what they do, without impacting your system. Of course, there are always the secretive things the network engineers may be doing, so it pays to do a tcpdump of your network connections every now and then. That is what bothers me the most. When I log onto my ISP, I am in a Peer-2-Peer level connection, and they may have a way to connect, bypassing the firewalls.

BUT ALL THAT SAID......I probably would run a precompiled package from a reputable website, like SuSE, or Redhat, etc. Otherwise, ( and almost always) I compile everything myself. Even though I don't understand all the c code, at least I HAVE THE EVIDENCE IN HAND, in case the code is malicious.

Now I would NOT even bother to run any encrypted perl script, unless I personally knew the author, or the author has also provided the source code.

P.S. It goes for the hardware too. How do we know that each motherboard (or cpu) dosn't emit a signal, which can be received by "government equipment". Dosn't it make you wonder why it's illegal to put your computer into a "Faraday cage", which defeats "tempest". Or why it's so hard to get promoted in the "engineering ranks" of computer designers? We are at the mercy of the designers, who all must pass the "MI-complex security investigations". And it's not so much that they are worried about your background, they want to make sure you can be forced to "keep the secrets".

---

I'm not really a human, but I play one on earth. flash japh

I think that like in security matters, in life, we have to start believing in something before working in that direction. If you succeed in securing your system, it might be worth for others to break into it to know what are your concealing.

I personally, don't have anything to conceal. Like the biggest part of the people in this world. So, let the important people, care about those things. They are never going to impose such a way of living as they are promoting.

That is not progress. It is a way of wasting everybody's time in nonsense.

Remember that the successful Micro$oft started speaking about security when their creativity started their actual decay. It is like those governments that start seeing everybody as a potencial enemy, to justify wasting the peoples taxes in something invisible and with an increasing greediness.

But some time in the future, we are all going to need to return to what matters. And that is my only target. I only care of trying to waste less time in rebuilding my system when it breaks. And to be really usefull at work.

.{\('v')/}   C H E E R   U P !
 _`(___)' ___a_l_b_e_r_t_o_________

Wherever I lay my KNOPPIX disk, a new FREE LINUX nation could be established.

Oops, I thought it was understood that Microsoft is "the Evil Empire", not " a big company or organization". :-)

I do not trust Microsoft at all, their record of conspiring with the NSA is on the public record, and "Bill Gate's rise to power and dominance" is very suspicious, considering the crappy quality of the Windows Operating System. Therefore, I consider Bill Gates to be the "puppet" of the NSA, which explains it all.

---

I'm not really a human, but I play one on earth. flash japh