it appears that this organization is repeatesly agitating for "threats" publicity in open source.. what is the motivation?
Social engineering takeovers of open source projects
61–70 of 379 posts
Re: Social engineering takeovers of open source projects
#62Earlier quoted context omitted.
That's great that you are considering this more now. But the xy story taught us, that every contributor is dangerous, the most dangerous ones are probably the most helpful and most skilled contributors. If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor. Another thing that was not talked about a lot: There are many ways to compromise existing maintainers. Compromising…
> Compromising people is the core competency of intelligence, happens all the time, and most cases probably never come to public knowledge. Yea. It would almost be strange if security service didnt consider the route of getting "kompromat" on a developer to make them "help" them.
They would be really bad at their job, if they didn't try.
Re: Social engineering takeovers of open source projects
#63Earlier quoted context omitted.
Backdoor attempts won't be that obvious. The xz incident just had a random unaffiliated burner account and nothing of any clear national origin.
I wanted to make a different point. If for example Google or Red Hat were deeply involved within the xz project, there might have been more people reviewing the code. The evil changes to xz were easy to overlook, but not impossible to notice. Especially the added "accidential" semicolon made me think about probabilities. I think in a code review I would notice that with a probability of 10-20%. So if 10 people would'…
One possibility could be a license that requires big companies to dedicate one or more people as maintainers or at least reviewers of a project if they want to get license to use the software.
Re: Social engineering takeovers of open source projects
#64> Enable two-factor authentication (2FA) or Multifactor Authentication (MFA). Not on any third party system, where you're locked out forever if you lose your second factor. Fuck that! Only self-hosted, where you can recover via physical access. (That should actually be the first advice: host the stuff yourself. People lose control of projects due to hosting them on third party services. Be the guy who can pull the po…
> Not on any third party system, where you're locked out forever if you lose your second factor.
Every two-factor system I've ever seen is actually two-of-three, with an account recovery code that you save elsewhere.
I lost all my two-factor auths when my phone got wrecked, it was annoying to reestablish access to those accounts (and I now use a TOTP client which backs the tokesn up), but it was tedious rather than difficult.
Re: Social engineering takeovers of open source projects
#65Would it be interesting if Github (and others) had a program where they would verify people using the same regulations the banking industry uses for KYC (know your customer)?
Optional step for developers to show they are who they say they are?
Re: Social engineering takeovers of open source projects
#66Earlier quoted context omitted.
That's great that you are considering this more now. But the xy story taught us, that every contributor is dangerous, the most dangerous ones are probably the most helpful and most skilled contributors. If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor. Another thing that was not talked about a lot: There are many ways to compromise existing maintainers. Compromising…
One follow up to compromising existing maintainers: This makes the creators or long-term good faith maintainers maybe even more "dangerous" than new maintainers.
Are we facing a Byzantine generals kind of situation now?
Re: Social engineering takeovers of open source projects
#67Would it be interesting if Github (and others) had a program where they would verify people using the same regulations the banking industry uses for KYC (know your customer)? Optional step for developers to show they are who they say they are?
No. This is a terrible idea
Re: Social engineering takeovers of open source projects
#68Anyone who has played Eve Online is familiar with this process. Gain membership, become a valued contributor to the corp, then betray it for profit.
If anyone has a few hours free, I'd recommend this documentary about Eve Online - https://www.youtube.com/watch?v=BCSeISYcoyI
Re: Social engineering takeovers of open source projects
#69Earlier quoted context omitted.
yes and no. i hate 2FA as well, but in the end, even if i loose my access to github i only loose access to my github identity but i don't loose access to my code, so i can live with that. of course in the light of this discussion losing access to my github identity would be part of the problem, so it's a tradeoff. is it more likely that someone will break into my account and abuse my identity if i don't have 2FA or i…
[flagged]
gee, people can't take a bit of humor to make a point?
Re: Social engineering takeovers of open source projects
#70I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs. I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"
Wasn't a key thing of the xz attack vector that people where encouraged to download the custom source release instead of the autogenerated Github one? I don't know if that is a pattern but it seems like best practices in the (source) supply-chain could prevent a large class of these attacks.