Live data from Hacker News

Social engineering takeovers of open source projects

openssf.org

131–140 of 379 posts

Re: Social engineering takeovers of open source projects

#131

Earlier quoted context omitted.

>> And I think you probably see a parallel in state-based information warfare, where part of the objective isn't just to spread misinformation, but to shift cultural norms so that the transmission of misinformation is inherently easier, which can involve sewing distrust in institutions or expertise, or normalizing a gish gallop argumentative style. TikTok springs to mind when reading this...

Re: normalization of gish gallop The speed reading shit they do in competitive debate was in my opinion 100% caused by clandestine elements who wanted to keep the future “revolutionary” intelligentsia class obsessed with ivory tower elitism so that they don’t get too close to doing actually subversive things. I have no other explanation for how otherwise smart people think that speed reading lacanian psychoanalysis i…

I agree with you that it's incredibly bizarre, but I associate it with the strange cultural norms that can only crop up in very specific academic environments that have just the right alchemy of academic strangeness, competitiveness, and idiosyncratic historical origin. I'll compare it to something I recently discovered, which is some viral video I recently saw of some sort of pig fare where kids lead pigs out on this walk to show how well the pigs are trained and I think to show off the pigs as models specimens, and the kids do this intentional intense eye contact with judges in order to get the judges to look at them. It seems so strange and abnormal, but it was explained away as just something that's part of the history of the competition and having strategic value for being effective in the competition.

I've seen videos of the college debates you're speaking of though, and I've definitely felt that they're badly in need of reforms that either impose a word count or otherwise disincentivize speed reading.

The long and short of that is just to say you can explain it without regarding it as some sort of intentional state disinformation program. I would also say I find that especially implausible just because, while I don't love the practice, I don't think it degrades our ability to follow arguments or have information literacy necessarily, and meanwhile modern social media absolutely does seem to instill habits that reinforce short-term attention spans, disjointed thinking, object permanence problems and the like, all of which would dispose people to be more receptive to bite-size arguments that don't have to fit into a comprehensive or coherent worldview.

Re: Social engineering takeovers of open source projects

#132
post #112

Earlier quoted context omitted.

You're really going to pretend like there have been no socially-engineered cybersecurity attacks in the last 30 years...? And by the way, stabbings happen all the time, at least 3 per day. Stabbings hurt a few people, cybersecurity incidents can hurt millions.

This is about "social engineering takeovers of open source projects", not "socially-engineered cybersecurity attack", which is much much broader. I've been pretty clued up on open source for the last 20 years, and I don't really recall any other similar incidents other than the two I mentioned. I tried to find other examples a few weeks ago and came up empty-handed. It's certainly not common. So please do post specif…

There are CVEs where an empty string performed an authentication bypass.

> social engineering

The best bugdoors are deniable.

Re: Social engineering takeovers of open source projects

#133
post #5

We've been adding features for 30+ years to open source software, they become so complex only very few people understand them anymore. Recently I looked into jfet level 2 implementation in ngspice, expecting familiar equations, but through series of small changes and maybe some DRY too, the code is almost unrecognizable. When graybeards finally retire, there will be lots of shrugs.

Your average American could quit working for 5 million dollars. They could live comfortably for the rest of their lives off that money, if well invested (read EFT for sp500) 5 million bucks is change for you average government. "Amazon made billions on my project and if I turn a blind eye to this I can retire, fuck them..." Sponsorship, for good or bad makes a lot of decisions simple.

Probably wouldn't even need 5 Million. According the the PBS article about the 2 US Navy sailors arrested for spying around august of last year one of them was apparently only bribed $10k-15K for the year [1]. I was pretty shocked at first but it made sense that with the financial stress many face in today's market a 10K bribe would go along way and have a high return on investment especially if the potential payoff for a backdoor or zero-day is in the millions [2]

[1] https://www.pbs.org/newshour/politics/2-u-s-navy-sailors-arr...

[2] https://en.wikipedia.org/wiki/Market_for_zero-day_exploits

Re: Social engineering takeovers of open source projects

#134
post #112

Earlier quoted context omitted.

You're really going to pretend like there have been no socially-engineered cybersecurity attacks in the last 30 years...? And by the way, stabbings happen all the time, at least 3 per day. Stabbings hurt a few people, cybersecurity incidents can hurt millions.

This is about "social engineering takeovers of open source projects", not "socially-engineered cybersecurity attack", which is much much broader. I've been pretty clued up on open source for the last 20 years, and I don't really recall any other similar incidents other than the two I mentioned. I tried to find other examples a few weeks ago and came up empty-handed. It's certainly not common. So please do post specif…

You seem super confident that there have been zero similar attacks that achieved their goals without detection. By definition, almost anyone who pulled off this kind of thing would try really hard not to burn that backdoor by being super obvious (for instance, using it to deface a website). We literally would not know anything about it, in all likelihood. Therefore I feel like it’s a lot more intellectually honest to say we have no idea if that has happened elsewhere, than it is to confidently proclaim that it certainly has not just because it’s been a month since xz.

Re: Social engineering takeovers of open source projects

#135
post #117
post #107

Earlier quoted context omitted.

You can always use the "we have no idea" argument because you can't prove something doesn't exist. Go find evidence. It's been over a month since xz and thus far we have zero additional incidents. And if you look at the specifics of xz attack: that wouldn't work for most projects because most don't have binary test files.

Are people really looking though? Are all open source libraries being run through extensive performance profiling to look for known heuristics? Are they being looked at line by line for aberrations? I don’t have confidence that people are looking for evidence of potential exploitation because of reasons like the ones you bring up. So we’re back to we just don’t know.

It’s worse than that, and that wouldn’t be enough.

A large class of exploitation methods simply have no performance impact.

Re: Social engineering takeovers of open source projects

#136

Earlier quoted context omitted.

Your average American could quit working for 5 million dollars. They could live comfortably for the rest of their lives off that money, if well invested (read EFT for sp500) 5 million bucks is change for you average government. "Amazon made billions on my project and if I turn a blind eye to this I can retire, fuck them..." Sponsorship, for good or bad makes a lot of decisions simple.

Probably wouldn't even need 5 Million. According the the PBS article about the 2 US Navy sailors arrested for spying around august of last year one of them was apparently only bribed $10k-15K for the year [1]. I was pretty shocked at first but it made sense that with the financial stress many face in today's market a 10K bribe would go along way and have a high return on investment especially if the potential payoff…

Even politicians are cheap these days.

It astonishes me that for less than the price of a nice car, what people seem to be able to do.

Re: Social engineering takeovers of open source projects

#137

I've been saying for years, over and over, that we need to focus on simple architecture and improve our coding standards but I keep getting ignored. People keep making software and tools more complex... "Just use TypeScript" they say, "Just use React, with Typescript" then they end up with literally thousands of unnecessary dependencies. The bad guys are laughing at our collective ignorance and naivety. Now probably…

I suspect that the bad actors aren't merely benefitting from this situation, they're probably actively encouraging it, in GitHub issue discussions, on Reddit, in the comment sections of YouTube videos, here on HN. Maybe I'm paranoid.

Re: Social engineering takeovers of open source projects

#138
post #6

Anyone who has played Eve Online is familiar with this process. Gain membership, become a valued contributor to the corp, then betray it for profit.

And one difficulty here I believe is that those intent on social engineering think about it in more sophisticated terms than their targets, which perhaps is obvious. And part of the process can be a kind of performative incredulity at the very suggestion that they are part of a campaign of hostile takeover, even if it's exactly accurate. I suppose you could even have unfortunate circumstances where parts of an open s…

> And I think you probably see a parallel in state-based information warfare

My own research shows it’s the opposite: they destroy trust in institutions and experts by telling the truth when those groups lie to their own citizens.

The US did this routinely during the Cold War.

More recent examples include:

- demographic facts about murder, violence, and police

- demographic facts about college enrollment, eg the racism at Harvard

- George Floyd’s autopsy report

- images of cities burning; reports of the 70+ people murdered

- facts about COVID

- facts about COVID vaccines

- facts about Ukraine’s status on the battlefield

- footage of Nazis in Ukraine

- facts about Tavistock and WPATH lacking scientific evidence for their recommendations

Because institutions and experts have normalized lying to “nudge” the public via narrative manipulation, it has become easy for adversaries to undermine the nation by showing contrary facts.

People become more radicalized by demonstrating with evidence a supposed ally has betrayed them, eg, your government lying to you. Once broke, trust in institutions and experts takes generations to repair — or a replacement of those institutions entirely.

Re: Social engineering takeovers of open source projects

#139
post #55

Earlier quoted context omitted.

>> And I think you probably see a parallel in state-based information warfare, where part of the objective isn't just to spread misinformation, but to shift cultural norms so that the transmission of misinformation is inherently easier, which can involve sewing distrust in institutions or expertise, or normalizing a gish gallop argumentative style. TikTok springs to mind when reading this...

My thought immediately went to Linus Torvalds. The way he acted was tolerated in the past, but the culture was changed and it was used to force a change onto the project. Same thing with all of those Codes of Conduct that suddenly propped up.

Are you saying codes of conduct make the transmission of misinformation is inherently easier, e.g by sewing distrust in institutions or expertise, or normalizing a gish gallop argumentative style? Are you saying Linus Torvald's behaviour prevented those problems?

Re: Social engineering takeovers of open source projects

#140
post #14

Good warning for the future... but what about the past? Any thoughts on retroactively looking at behavior for existing OS projects? Seems like an impossible amount of work.

Maybe not so impossible. Start with making a list of projects that are everywhere. Inside every Linux distribution, inside every react/angular/vue/etc project, … Then check which companies support those projects with active development, and calculate a rating. Are the companies located inside democracies or are they mostly from china or Russia? It’s probably not that many packages in the end. A few thousand high impa…

The list you speak of already exists — it is the package registries of Debian/Ubuntu, RHEL, etc.

What about American companies using mainland China developers to drive their (well known) open source projects with crappy code? Who’s to blame?

We’re currently smoking at the gas station and things haven’t blown up yet…

Post reply on HN