Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Xz: A microcosm of the interactions in open source projects

robmensching.com

Post reply on HN
Print view View original

71–80 of 353 posts

Re: Xz: A microcosm of the interactions in open source projects

#71

Post by stavros »

cassianoleal wrote: post #70
stavros wrote: post #62

Earlier quoted context omitted.

I see people saying "this almost succeeded". It didn't almost succeed, it succeeded entirely. It made it to production, for a long time (? I'm not sure how long it was in repos). Success is making it to some machine, and then it's "how long it's successful for". Who knows how many other such vulnerabilities there are, and the openness of the source didn't protect us as quickly as we thought it would.

> It made it to production, for a long time Did it? At least in Debian, where it was found in the first place, it only existed in sid/unstable and I think perhaps in testing. It never made it into stable which is the only thing you should be running on a production system. I think in Fedora it was also only in a testing or RC of the next stable version but I'm not sure. Also unsure about others. I have seen several d…

I don't know specifics either, but Debian stable has years-old packages, so I'm not sure if it's a good indicator of how widespread this got. If it's in the latest Ubuntu release, I'd say it's pretty successful.

Re: Xz: A microcosm of the interactions in open source projects

#72

Post by WesolyKubeczek »

armada651 wrote: post #25
sumanthvepa wrote: post #20

The Jigar Kumar account should be treated with extreme suspicion. It seems like it was part of a social engineering attack.

Given how all participants in the discussion were very focused on transferring ownership to the attacker I'd treat everyone in the entire e-mail thread with suspicion. I would not be surprised if Dennis Ens, the one who started the thread in the first place, was also a sock puppet of Jia Tan.

The word that springs to mind is “campaigning”. If persons campaigning are nobodies as their contribution is concerned, whatever they are pushing for should be considered noise and put straight into the bin.

Re: Xz: A microcosm of the interactions in open source projects

#73

Post by arp242 »

stavros wrote: post #58
arp242 wrote: post #39

Earlier quoted context omitted.

In the end you're only pressured as much as you allow yourself to be pressured. "I don't feel like it, if it's important to you then feel free to fork". That's really all that's needed. "I don't feel like it" is all the justification you need. Some guy just made a compression tool, because some people like doing that kind of thing, or because it was useful for him. He didn't ask to be made "critical infrastructure" o…

This ignores the very fact that peer pressure works and puts the entire blame on the victim. No, people react differently when pressured vs when not pressured. That's the entire reason why peer pressure works.

I didn't blame anyone; I just made some observations on how this type of thing can be avoided, partly based on my own experience doing volunteer work for the last 20 years (as open source maintainer and as scout leader), and being subject to the same pressures at times.

I hate this trend of shouting "victim blaming!" once someone tries to explain things or analyse anything. Not everything needs to be a value judgement. "X happened, and Y could have prevented it" is not a judgement.

Re: Xz: A microcosm of the interactions in open source projects

#74

Post by A1kmm »

creato wrote: post #61
b112 wrote: post #38

Earlier quoted context omitted.

This is why OSS can be more secure. How much software has the build scripts, the code, all of it, locked away and hidden behind propriety software? Instead of lots of eyes, just 2 DEVs? Yes, this almost succeeded... but can you imagine how many scenarios where someone such as Andres Freund would have found irregularities, but then.. what? Just had to report it to some webpage's contact page? Without being able to eve…

I think there are huge factors that push things both for and against open source here. Yes, you get more eyes and people like Andres Freund. However, if this had been a mole in a company, he wouldn't be able to hide behind a possibly anonymous fake persona and (likely) be immune from any consequences/fallout from this attack. It would be harder to gain entry in the first place, he would have needed a real identity. B…

> However, if this had been a mole in a company, he wouldn't be able to hide behind a > possibly anonymous fake persona and (likely) be immune from any consequences/fallout from > this attack. It would be harder to gain entry in the first place, he would have needed a > real identity.

Lots of companies hire remote workers sight unseen, and not all require proof of identity, and where they do, that proof can possibly be easily faked by someone willing to break the law.

Larger Open Source projects - e.g. Debian Developers, also have real-identity verification through chain of trust.

> Background checks may not be a big hurdle, but they're at least something more than > signing up for a GitHub account.

GitHub doesn't allow more than one free account per person. Companies might not look for employees sharing an IP address as much as GitHub does.

> He also wouldn't have had his posse of anonymous sock > puppet accounts to add pressure to the original maintainer.

Depending on the software, it might not be that hard to be a customer (or even pretend to be an employee of a known customer, if they aren't validating incoming requests claiming to be from customers enough) and add pressure for features that will provide cover for a backdoor, or even for a product that isn't a commercial success to be handed over to an external developer.

Re: Xz: A microcosm of the interactions in open source projects

#75

Post by kzrdude »

lifeisstillgood wrote: post #59

Some random thoughts: - every Fortune 500 company tracks exactly which FOSS code it includes in its ecosystem (usually code scanning and fingerprinting - can’t remember the usual Provider of such) - this is essentially the software BOM that Biden signed a while back. - this (made public) would give a real time map of the dependancies of all organisations - and linking that to things like the above thread (“cry for he…

> “here are three interns doing two years in gov.uk. They will help for the next 2 years

Having temp workers come and go into all kinds of various open source projects.. does that help? :)

Re: Xz: A microcosm of the interactions in open source projects

#76

Post by WesolyKubeczek »

kijin wrote: post #37
WesolyKubeczek wrote: post #19

“Community desires more” At which point if “the community” consists of one guy doing everything and a couple whiners making demands, fuck it.

Well, in this case it's even worse. The "community" here in all likelihood was overrun with sock puppets of a malicious state-level actor.

I also don’t really understand the notion of a community around a fucking data compression program. “Bro, do you even compress?”

Is there a community of ½" plumbing pipe enthusiasts?

Re: Xz: A microcosm of the interactions in open source projects

#77

Post by stavros »

arp242 wrote: post #73
stavros wrote: post #58

Earlier quoted context omitted.

This ignores the very fact that peer pressure works and puts the entire blame on the victim. No, people react differently when pressured vs when not pressured. That's the entire reason why peer pressure works.

I didn't blame anyone; I just made some observations on how this type of thing can be avoided, partly based on my own experience doing volunteer work for the last 20 years (as open source maintainer and as scout leader), and being subject to the same pressures at times. I hate this trend of shouting "victim blaming!" once someone tries to explain things or analyse anything. Not everything needs to be a value judgemen…

Well, when you say "the victim could just not have succumbed to the pressure" I don't see how that doesn't blame the victim. I understand it's not your intention, but peer pressure works exactly because it gets around people's "wait, I don't actually want to do this" defense, and to say "just don't do it, nobody is physically forcing you to" ignores that fact.

If I were in the maintainer's shoes, and was feeling ambivalent about handing over maintenance to a fairly unknown person, this kind of social attack would definitely push me over the edge, exactly as it was planned to.

Re: Xz: A microcosm of the interactions in open source projects

#79

Post by WesolyKubeczek »

SuperHeavy256 wrote: post #10

So the first step of this huge mess was: a social engineering attack. Attacking a tired, burnt-out open source project developer and peer pressuring him into giving more control of the repo to the attacker.

Here’s the rub: peer pressure counts if done by peers. Users who subscribed to a mailing list only to campaign for a governance change are not peers. Longtime contributors who have earned street cred, can be.

(I guess in the case of xz, Jia Tan has earned the cred before going rogue; the one-off “maintainer needs to be replaced” campaigners, however, haven’t.)

Re: Xz: A microcosm of the interactions in open source projects

#80

Post by Kwpolska »

lifeisstillgood wrote: post #53

>>> Software developers are not fungible cogs that you can swap in and out at will. I am thinking a lot about this. One of the issues is scale and proof. I suspect that I am interested in introducing gated ability to comment / participate in a community Say for example github introduces “gates”. The first might be add a test to the test suite that generates a haha of the version number and test output. Then adding th…

What would that magic number achieve? Having basic coding ability can be checked by looking at the user's repos and contributions. But the primary attacker had pretty good skills, and the other commenters (the attacker's sockpuppets) could also demonstrate some skills.
Post reply on HN