The NSA, the original primary developer of SELinux, released the first version to the open source development community under the GNU GPL on December 22, 2000.[6] The software was merged into the mainline Linux kernel 2.6.0-test3, released on 8 August 2003. Other significant contributors include Red Hat, Network Associates, Secure Computing Corporation, Tresys Technology, and Trusted Computer Solutions.

https://en.wikipedia.org/wiki/Security-Enhanced_Linux

  • Snot Flickerman@lemmy.blahaj.zoneEnglish
    1042·
    3 days ago

    I mean, it’s still Open Source, right? So it would be pretty hard for them to hide a backdoor or something??

    I guess I don’t know what’s so sus when it’s easily auditable by the community and has been for two decades now.

    If it’s just because it’s memes and you’re not being that serious, then disregard please.

    • byrtzr@lemmy.world
      81·
      3 days ago

      I mean, it’s still Open Source, right? So it would be pretty hard for them to hide a backdoor or something??

      Right but maybe it combined with other tools they have is what helps them with some exploit.
      Like they figured out an exploit but needed SELinux as a piece of the puzzle. It’s open source
      and we can all read the code but we can’t see the other pieces of the puzzle.

      Come on, put your conspiracy hat on! ;)

      • Shareni@programming.dev
        3·
        2 days ago

        I mean, they almost certainly have built in backdoors like IME. When you can force hardware manufacturers to add shit, you don’t have to think up convoluted solutions like that.

    • spacecadet@lemm.ee
      22·
      3 days ago

      I maintain open source software on a much smaller codebase that is less security critical. We have dozens of maintainers on a project with about 3k stars on GitHub. Stuff gets by that are potentially security vulnerabilities and we don’t know until upstream sources tell us there is a vulnerability

      • Kusimulkku@lemm.ee
        7·
        3 days ago

        I’d imagine in this case there has been extra community scrutiny since it’s security software and it comes from less than trustworthy source.

      • Snot Flickerman@lemmy.blahaj.zoneEnglish
        19·
        3 days ago

        This is also probably the reason why you lost your DARPA funding, they more than likely caught wind of the fact that those backdoors were present and didn’t want to create any derivative products based upon the same.

        Though this implies that the Department of Defense doesn’t want to use compromised tools, since DARPA is DoD. NSA is also DoD.

      • where_am_i@sh.itjust.works
        5·
        3 days ago

        People don’t understand that the way a backdoor is usually implemented is not going to be obviously saying “backdoor_here”, neither it will look like a some magic code loading a large string and unzipping it on the fly – that’s sus af. What you will see is some “play video” functionality that has a very subtle buffer overflow bug that’s also not trivially triggerable.

        This already happened with WhatsApp.