Sorry, I'm a bit paranoid with all this NSA scandal.

Recently I've come across a news article where it is described how the FBI tried to hunt down a computer in an unknown location and its owner. The article goes on how they tried to compromise the users PC by posting a link in his yahoo email account to a server controlled by feds that's serving malicious code. While I'm guessing this user was using windows on his laptop, I can't stop asking myself how would a government agency like NSA, FBI, DoD, etc try to compromise a linux machine. So I was wondering... besides the obvious ways of tricking a user to download a malicious component, what's the chance that a repository gets hit by a national security letter or an equivalent?

I mean can the software downloaded from official repositories really be trusted? What's the chance a goventment orders a company like Canonical or maybe an admin of the Arch linux repository to upload and serve an OS update with an infected component to some of its users? Since the component would be signed by the admin's private key, the OS would simply install it without question. How can such an intrusion into a repository be detected? Can a government even force a repository admin to upload malware.. and sign it with his private key?


Please keep the conversation constructive, I'm asking this question for the purpose of learning more about linux security landscape.

A government, as we have found out and history shows us time and again, can do whatever it wants. The important thing is not the government rather the important thing is the people. Are the people, or corporations, trustworthy and do they have their users as their highest priority. If the answer is yes then you'll be ok, if the answer is no then choose a distro that does.

1 members found this post helpful.

Depends on how thick a person wants to make a hat out of tinfoil I guess. One could say that that repositories might not really be the worst offender - if I was the government I would affect things like actual algorithms used for encryption, hashing and of course I'd probably go after the hardware itself.

Ultimately, a user can choose to be extremely paranoid and cause themselves harm or be cautious and go with a distribution that chooses the user first (which still excludes the actual code authors and contributors).