Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

To secure the supply chain, you must properly fund it

ariadne.space

Post reply on HN
Print view View original

11–20 of 59 posts

Re: To secure the supply chain, you must properly fund it

#11

Post by Bancakes »

rubyist5eva wrote: post #7

> When corporations sponsor the maintenance of the FOSS projects they use, they are effectively buying an insurance policy that guarantees a prompt, well-coordinated response to security problems. Unless there's a contract explicitly stating so, this is not true whatsoever. If you want an "insurance policy" of this kind, hire the maintainer or pay for an actual support contract from them. Donations are exactly that,…

They are under moral obligation in the sense that they need to make the donators happy to keep getting donations.

Re: To secure the supply chain, you must properly fund it

#12

Post by kevincox »

roenxi wrote: post #8

It should be noted up front that paying money for this stuff doesn't secure it either. There are frequent security bugs from well maintained projects too. It does help though. The best defence against this sort of catastrophic bug creeping up into a project is an aggressively simplified dependency tree. It isn't easy, and in some (most?) cases it might be most sensible to take on the risk and wait to fix bugs found i…

The argument made wasn't that paying more secures something. Just that paying more allows better response to insecurities.

Re: To secure the supply chain, you must properly fund it

#13

Post by xoac »

retskrad wrote: post #10

It's kind of crazy that Apple has had the greatest visionary CEO of all time (Steve Jobs) while also having the greatest supply chain manager of all time (Tim Cook). It's no surprise that Apple is the most valuable company in the world and also the most beloved brand.

what?

Re: To secure the supply chain, you must properly fund it

#14

Post by hutzlibu »

retskrad wrote: post #10

It's kind of crazy that Apple has had the greatest visionary CEO of all time (Steve Jobs) while also having the greatest supply chain manager of all time (Tim Cook). It's no surprise that Apple is the most valuable company in the world and also the most beloved brand.

This language reminds me of Gröfaz.

Re: To secure the supply chain, you must properly fund it

#16

Post by mountainb »

rubyist5eva wrote: post #7

> When corporations sponsor the maintenance of the FOSS projects they use, they are effectively buying an insurance policy that guarantees a prompt, well-coordinated response to security problems. Unless there's a contract explicitly stating so, this is not true whatsoever. If you want an "insurance policy" of this kind, hire the maintainer or pay for an actual support contract from them. Donations are exactly that,…

This would be an example of someone using a loose metaphor when they should be using the thing that they are supposed to be invoking with a figure of speech.

To get insurance, you want to pay for and write an insurance contract. The arrangement should be calculated on the same basis as insurance. If you do not actually want insurance and want a dedicated assurance that a FOSS project will be patched quickly, you don't want insurance, you want a contractual guarantee from some individual or group that it will happen when the event triggers, and you have to be prepared to enforce that contract through whatever legal mechanisms are available.

By thinking this through we can also see that 'insurance' was a weak metaphor in the first place. In a situation like the underlying one, you don't just need a contract to pay out cash: you actually need labor to fix the vulnerability immediately.

Re: To secure the supply chain, you must properly fund it

#17

Post by jasode »

>[...] Incidentally, one of the Log4j maintainers’ GitHub sponsors profile is here, if you would like to contribute some money to his cause. [...] these companies should ponder which is more expensive: $100k/year salary for a maintainer of a project they are heavily dependent upon,

I don't understand the logic of cause & effect the author laid out.

Commercial software with well-paid programmer employees also have long lists of CVE/RCE including MS Windows, Azure, AWS, Adobe PDF reader, Oracle database, etc.

I think the crux of the author's argument is the 2nd paragraph:

>Like many projects, Log4j is only maintained by volunteers, and because of this, coordination of security response is naturally more difficult: a coordinated embargo is easy to coordinate, if you have a dedicated maintainer to do it. In the absence of a dedicated maintainer, you have chaos: as soon as a commit lands in git to fix a bug, the race is on: security maintainers are scurrying to reverse engineer what the bug you fixed was, which is why vulnerability embargoes can be helpful.

Exactly how does a permanent paid $100k salary change the "vulnerability embargo" window in this particular case?

E.g. the log4j JNDI code fix was night of December 4: https://github.com/apache/logging-log4j2/commit/d82b47c6fae9...

The widespread news of the RCE was December 9.

How does extra funding change the timeline and coordinate a better embargo? Or asked another way, how do the commercial vendors manage voluntary information embargos better because they have dedicated paid staff?

Re: To secure the supply chain, you must properly fund it

#19

Post by giantg2 »

When I interviewed for my job they mentioned a lot of the software that they used, and much of it was open source. I asked if the company contributes to the code at all. They said they were working on an initiative to do so. That was 10 years ago and it still hasn't happened.

Re: To secure the supply chain, you must properly fund it

#20

Post by ChrisMarshallNY »

> corporations sponsor the maintenance of the FOSS projects they use

The main issue with this, is that no corporate managers I’ve ever known, will let leverage go to waste. You see this in NPO grants, all the time. Some of these grants result in highly suspect research. In some cases, the true extent took years to reveal itself (like Big Tobacco and the "Type A personality"[0]).

I can see certain TLAs, working through shells (a common CIA tactic), to influence infrastructure projects. Maybe to add a bit of “custom” math.

It seems the best approach is a “blind trust,” where a fund is set up, decoupling donations from implementation.

I suspect that would significantly reduce donations, which is probably why these are not more common.

[0] https://www.businessinsider.com/type-a-personality-traits-sm...

Post reply on HN