> > Ok, I appreciate all the feedback and reviews from this community. Still
> > I feel that the review from Theodore Tso is highly biased, and I think
> > this is because Theodore Tso is employed by Google, which makes a
> > competing web browser, Google Chrome. Therefore in my opinion the
> > Nordstjernen web browser was not given a fair chance by the Debian
> > community, and I will focus on other Linux distributions which does not
> > have Google-/corporate-biases like Debian does in this instance.
ObDisclaimer: These are my views, not Google's. I don't speak for
Google and I'm not important enough and my pay scale is **way** below
the level where my views == Google's views. :-)
So first of all, I'll note that Google supports FireFox to the tune of
$500 million USD a year. This is not purely for philantropic purposes
(Firefox is is configured with Google as the default search provider),
but Google has stated many times in the past that having a secure web
that people are comfortable to use for ecommerce is extremely
important to Google, and this is why Google has invested in improving
certificate security which benefits the entire industry.
Secondly, one of the reasons why I ran this security analysis was
because I was concerned that this could have been a supply chain
attack on Debian, ala the Jia Tan / XZ Utils backdoor attack. A
vibe-coded browser appearing out of nowhere, written in C which could
trivially hide all sorts of "accidental" memory pointer bugs that
could be used to remotely compromise Debian users? This raised a lot
of red flags, especially after I spent about five minutes looking at
the Git repo.
(I'm not accusing Northstar of being maliciously backdoored with
security vulnerabilities, because I don't know what the authors'
motives might be. But at the very least, if their intent was not
malicious, my assessment is that they appear to be extremely naive.)
Which brings me to the general observation that perhaps we should
consider as a Project. The cost of this particular assessment was
less than $50 USD retail. (It was less than $25 USD if you use the
introductory discount for Gemini Argon, but after December 1st, it
would be just under $50 USD given the number of tokens that were
used.)
The risk of supply chain attacks on Debian is real, even if the people
behind Northstar had motives that were as pure as the driven snow.
IMHO, it would be a good idea if Debian were to approach the various
AI frontier labs --- Anthropic, Google, Open AI, etc. and ask if they
would support running security audits on those software packages which
are most critical from a security perspective, especially for new
software packages with no track record.
All three of these companies have contributed significant resources to
improving security of critical OSS software. Since many of these
companies rely on Debian, it is in their self interest to help protect
Debian against supply chain attacks, even if they aren't Public
Relations reasons why these companies might want to show how much they
are contributing to the open source ecosystem.
Cheers,
- Ted
