Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering takeovers of open source projects

openssf.org

Post reply on HN
Print view View original

51–60 of 379 posts

Re: Social engineering takeovers of open source projects

#51

Post by andix »

tschwimmer wrote: post #50
andix wrote: post #33

Earlier quoted context omitted.

That's great that you are considering this more now. But the xy story taught us, that every contributor is dangerous, the most dangerous ones are probably the most helpful and most skilled contributors. If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor. Another thing that was not talked about a lot: There are many ways to compromise existing maintainers. Compromising…

>If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor. Unforuntately it's easy to sandbag being dumb. Just because someone submits a PR defining constants for 0-999 does not mean they're actually bad at programming.

Sure, but being known for submitting bad code is going to make code reviews more thorough, not less. It's drawing additional attention to yourself.

Re: Social engineering takeovers of open source projects

#52

Post by em-bee »

kazinator wrote: post #44

> Enable two-factor authentication (2FA) or Multifactor Authentication (MFA). Not on any third party system, where you're locked out forever if you lose your second factor. Fuck that! Only self-hosted, where you can recover via physical access. (That should actually be the first advice: host the stuff yourself. People lose control of projects due to hosting them on third party services. Be the guy who can pull the po…

yes and no.

i hate 2FA as well, but in the end, even if i loose my access to github i only loose access to my github identity but i don't loose access to my code, so i can live with that.

of course in the light of this discussion losing access to my github identity would be part of the problem, so it's a tradeoff. is it more likely that someone will break into my account and abuse my identity if i don't have 2FA or is it more likely that i loose my second factor and have to rebuild my identity. in the latter case someone else could also pretend to be me, but since the xz debacle both of us would face more scrutiny that my hope still is that i would win.

will the real eMBee please raise their hand?

Re: Social engineering takeovers of open source projects

#53

Post by eMBee- »

em-bee wrote: post #52
kazinator wrote: post #44

> Enable two-factor authentication (2FA) or Multifactor Authentication (MFA). Not on any third party system, where you're locked out forever if you lose your second factor. Fuck that! Only self-hosted, where you can recover via physical access. (That should actually be the first advice: host the stuff yourself. People lose control of projects due to hosting them on third party services. Be the guy who can pull the po…

yes and no. i hate 2FA as well, but in the end, even if i loose my access to github i only loose access to my github identity but i don't loose access to my code, so i can live with that. of course in the light of this discussion losing access to my github identity would be part of the problem, so it's a tradeoff. is it more likely that someone will break into my account and abuse my identity if i don't have 2FA or i…

[flagged]

Re: Social engineering takeovers of open source projects

#54

Post by triblemaster »

andix wrote: post #13

Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it. Those changes of maintainers need to be synced to package distribution sites like npm.js or Debian packages and put in context with versions/releases. In Europe this was introduced for banks after the banking crisis. If a bank does any organizational change, a report is sent…

How about simply paying the maintainers and then getting stuff done like the classical business does.

Re: Social engineering takeovers of open source projects

#55

Post by Aerroon »

zer00eyz wrote: post #12
glenstein wrote: post #8

Earlier quoted context omitted.

And one difficulty here I believe is that those intent on social engineering think about it in more sophisticated terms than their targets, which perhaps is obvious. And part of the process can be a kind of performative incredulity at the very suggestion that they are part of a campaign of hostile takeover, even if it's exactly accurate. I suppose you could even have unfortunate circumstances where parts of an open s…

>> And I think you probably see a parallel in state-based information warfare, where part of the objective isn't just to spread misinformation, but to shift cultural norms so that the transmission of misinformation is inherently easier, which can involve sewing distrust in institutions or expertise, or normalizing a gish gallop argumentative style. TikTok springs to mind when reading this...

My thought immediately went to Linus Torvalds. The way he acted was tolerated in the past, but the culture was changed and it was used to force a change onto the project.

Same thing with all of those Codes of Conduct that suddenly propped up.

Re: Social engineering takeovers of open source projects

#56

Post by victorbjorklund »

andix wrote: post #33
bsuvc wrote: post #22

I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs. I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"

That's great that you are considering this more now. But the xy story taught us, that every contributor is dangerous, the most dangerous ones are probably the most helpful and most skilled contributors. If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor. Another thing that was not talked about a lot: There are many ways to compromise existing maintainers. Compromising…

> Compromising people is the core competency of intelligence, happens all the time, and most cases probably never come to public knowledge.

Yea. It would almost be strange if security service didnt consider the route of getting "kompromat" on a developer to make them "help" them.

Re: Social engineering takeovers of open source projects

#60

Post by EVa5I7bHFq9mnYK »

The guidelines are laugthably naive in the light of current global security environment and level of threats involved. Who said a long standing member of community can't be a threat? Who checks identity of contributors? All I know it's enough to have an email to create a github account. Is FBI checking their credentials?
Post reply on HN