Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering takeovers of open source projects

openssf.org

Post reply on HN
Print view View original

11–20 of 379 posts

Re: Social engineering takeovers of open source projects

#11

Post by zer00eyz »

dvh wrote: post #5

We've been adding features for 30+ years to open source software, they become so complex only very few people understand them anymore. Recently I looked into jfet level 2 implementation in ngspice, expecting familiar equations, but through series of small changes and maybe some DRY too, the code is almost unrecognizable. When graybeards finally retire, there will be lots of shrugs.

Your average American could quit working for 5 million dollars. They could live comfortably for the rest of their lives off that money, if well invested (read EFT for sp500)

5 million bucks is change for you average government.

"Amazon made billions on my project and if I turn a blind eye to this I can retire, fuck them..."

Sponsorship, for good or bad makes a lot of decisions simple.

Re: Social engineering takeovers of open source projects

#12

Post by zer00eyz »

glenstein wrote: post #8
chiph wrote: post #6

Anyone who has played Eve Online is familiar with this process. Gain membership, become a valued contributor to the corp, then betray it for profit.

And one difficulty here I believe is that those intent on social engineering think about it in more sophisticated terms than their targets, which perhaps is obvious. And part of the process can be a kind of performative incredulity at the very suggestion that they are part of a campaign of hostile takeover, even if it's exactly accurate. I suppose you could even have unfortunate circumstances where parts of an open s…

>> And I think you probably see a parallel in state-based information warfare, where part of the objective isn't just to spread misinformation, but to shift cultural norms so that the transmission of misinformation is inherently easier, which can involve sewing distrust in institutions or expertise, or normalizing a gish gallop argumentative style.

TikTok springs to mind when reading this...

Re: Social engineering takeovers of open source projects

#13

Post by andix »

Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it.

Those changes of maintainers need to be synced to package distribution sites like npm.js or Debian packages and put in context with versions/releases.

In Europe this was introduced for banks after the banking crisis. If a bank does any organizational change, a report is sent out to all member states of the EU right away and any of the 27 national bank agencies can check if they notice something unusual. It might be possible to bribe a few people in your own country, but it’s really hard to bribe all responsible people in 26 other countries.

Re: Social engineering takeovers of open source projects

#14

Post by andix »

pcloadletter_ wrote: post #10

Good warning for the future... but what about the past? Any thoughts on retroactively looking at behavior for existing OS projects? Seems like an impossible amount of work.

Maybe not so impossible. Start with making a list of projects that are everywhere. Inside every Linux distribution, inside every react/angular/vue/etc project, …

Then check which companies support those projects with active development, and calculate a rating. Are the companies located inside democracies or are they mostly from china or Russia?

It’s probably not that many packages in the end. A few thousand high impact/risk projects probably.

Re: Social engineering takeovers of open source projects

#15

Post by PartiallyTyped »

andix wrote: post #13

Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it. Those changes of maintainers need to be synced to package distribution sites like npm.js or Debian packages and put in context with versions/releases. In Europe this was introduced for banks after the banking crisis. If a bank does any organizational change, a report is sent…

> Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it.

The rust project does it. There's a repo with all [active] members and their permissions on github, etc. These get synchronized and updated every time there's a change.

Re: Social engineering takeovers of open source projects

#17

Post by andy99 »

piecerough wrote: post #16

This is only going to get worse with Large Language Models. Let's imagine a somewhat knowledgeable individual, could craft both emails, messages and even commits with a bunch of prompts. Those will relate deeply to the project.

Do you have any evidence or real examples to support that? I hear people say similar things but see nothing to suggest LLMs are a particular threat.

Re: Social engineering takeovers of open source projects

#18

Post by TechDebtDevin »

andy99 wrote: post #17
piecerough wrote: post #16

This is only going to get worse with Large Language Models. Let's imagine a somewhat knowledgeable individual, could craft both emails, messages and even commits with a bunch of prompts. Those will relate deeply to the project.

Do you have any evidence or real examples to support that? I hear people say similar things but see nothing to suggest LLMs are a particular threat.

The real threat of LLMs is their potential to ruin your day if you use them to assist in your work.

Re: Social engineering takeovers of open source projects

#19

Post by GauntletWizard »

PartiallyTyped wrote: post #15
andix wrote: post #13

Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it. Those changes of maintainers need to be synced to package distribution sites like npm.js or Debian packages and put in context with versions/releases. In Europe this was introduced for banks after the banking crisis. If a bank does any organizational change, a report is sent…

> Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it. The rust project does it. There's a repo with all [active] members and their permissions on github, etc. These get synchronized and updated every time there's a change.

This is, in my eyes, one of the most important parts of "Infrastructure as Code". You should make the list of who has what permissions a critical artifact, as immutably part of the repo as any other change.

Re: Social engineering takeovers of open source projects

#20

Post by andix »

PartiallyTyped wrote: post #15
andix wrote: post #13

Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it. Those changes of maintainers need to be synced to package distribution sites like npm.js or Debian packages and put in context with versions/releases. In Europe this was introduced for banks after the banking crisis. If a bank does any organizational change, a report is sent…

> Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it. The rust project does it. There's a repo with all [active] members and their permissions on github, etc. These get synchronized and updated every time there's a change.

Just for the main project, or for all/most packages on crates.io?
Post reply on HN